1291124 - Intermittent SUMMARY: AddressSanitizer: SEGV /home/worker/workspace/build/src/js/src/vm/ObjectGroup.h:127:49 in compartment

Status: RESOLVED DUPLICATE of bug 1294747

(Core :: JavaScript Engine, defect, P3)

Description

[Treeherder Bug Filer]

Filed by: philringnalda [at] gmail.com

https://treeherder.mozilla.org/logviewer.html#?job_id=1250777&repo=autoland

https://queue.taskcluster.net/v1/task/FR6zXGiMRp6wUnjEpvWAog/runs/0/artifacts/public%2Flogs%2Flive_backing.log

Comment 1

[Intermittent Failures Robot]

48 automation job failures were associated with this bug in the last 7 days.

Repository breakdown:
* mozilla-inbound: 18
* autoland: 16
* fx-team: 7
* mozilla-central: 4
* try: 3

Platform breakdown:
* linux64: 47
* windows7-32: 1

For more details, see:
https://brasstacks.mozilla.com/orangefactor/?display=Bug&bugid=1291124&startday=2016-08-01&endday=2016-08-07&tree=all

Comment 2

[Intermittent Failures Robot]

6 automation job failures were associated with this bug in the last 7 days.

Repository breakdown:
* mozilla-inbound: 3
* try: 1
* mozilla-central: 1
* fx-team: 1

Platform breakdown:
* linux64: 6

For more details, see:
https://brasstacks.mozilla.com/orangefactor/?display=Bug&bugid=1291124&startday=2016-08-22&endday=2016-08-28&tree=all

Comment 3

[BMO Automation]

Bulk assigning P3 to all open intermittent bugs without a priority set in Firefox components per bug 1298978.

Comment 4

[Ryan VanderMeulen [:RyanVM]]

Terrence, does this look like the ASAN version of any of the failures you're looking at?
https://brasstacks.mozilla.com/orangefactor/?display=Bug&bugid=1291124&endday=2016-09-20&startday=2016-07-01&tree=trunk

Comment 5

[Terrence Cole [:terrence]]

Yup, this is definitely the same gray issue!

It looks like ReparentWrapper uses JSAPI on the, presumably gray, wrapper. I guess this is a case where we may actually want to keep the wrapper gray? Need to look deeper still.

Comment 6

[Terrence Cole [:terrence]]

The gray thing must be:

JS::Rooted<JSObject*> copyFrom(aCx, isProxy ? expandoObject : aObj);

I thought we had already solved this instance? Maybe I'm thinking of a different one?

Comment 7

[Boris Zbarsky [:bzbarsky]]

This looks like the ASAN version of bug 1294747 to me.  There's nothing gray here; we're just crashing in ObjectGroup.h because we're trying to compartment() a swept object.

Ryan, has this happened after bug 1294747 landed?

Comment 8

[Terrence Cole [:terrence]]

Ah, thanks for refreshing my memory!

Ryan pointed out on IRC that the last instance of this was on 7 Sept. The fix for bug 1294747 landed on 17 Sept, but the instances are rare enough that it's not so surprising if we didn't see any in the meantime. So I think this fixed.