1293244 - Assertion failure: !IsProxy(this)

Status: RESOLVED INCOMPLETE

(Core :: JavaScript Engine, defect)

Description

[Carsten Book [:Tomcat]]

Attachment: complete stack

Assertion failure: !IsProxy(this), at c:/builds/moz2_slave/m-cen-w32-d-000000000000000000/build/src/js/src/jsobj.cpp:3695

Steps to reproduce:
-> Load http://www.marriott.com/default.mi 
-->> Assertion failure: !IsProxy(this), at c:/builds/moz2_slave/m-cen-w32-d-000000000000000000/build/src/js/src/jsobj.cpp:3695

also crashes opt builds like :

https://crash-stats.mozilla.com/report/index/7c29d9dd-f619-4234-8b7f-547c52160808

one crash was marked in bughunter as security issue as high/low exploitable.

Seems nightly only crash so far, so marking as s-s

Comment 1

[Carsten Book [:Tomcat]]

[Tracking Requested - why for this release]:
bughunter found on topsites

Comment 2

[Jon Coppeard (:jonco)]

This assertion is failing when we try to tenure a nursery object.  I added similar assertions when we allocate nursery objects and they weren't hit which implies this is some kind of corruption.  One guess would be that it's a dynamically allocated Class that is being freed to soon.

Comment 3

[Marcia Knous [:marcia]]

Tracking 51+ for this crash - could affect some topsites.

Comment 4

[Jon Coppeard (:jonco)]

This looks like the JIT code is writing an object value containing this bad pointer in to elements of an array.

Comment 5

[Andrew McCreight [:mccr8]]

Please save a local copy of this page and see if it reproduces there, in case they change the page.

Comment 6

[Andrew McCreight [:mccr8]]

Sounds bad. I'll mark the other one critical too in case it isn't a dupe.

Comment 7

[Tyson Smith [:tsmith]]

Attachment: test_case.html

The issue seems to be triggered by webAnalytics.js

Comment 8

[Tyson Smith [:tsmith]]

Attachment: linux_dbg_log.txt

Comment 9

[Andrew McCreight [:mccr8]]

Gary, could you try minimizing the test case that Tyson attached? Thanks.

Comment 10

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

On a trip currently - I can help better if someone is able to convert to testcase to a standalone one that crashes in a shell.

Comment 11

[Andrew McCreight [:mccr8]]

Bug 1293258 has landed now, which maybe was related to this, so it would be worth retrying it.

Comment 12

[Bob Clary [:bc] (inactive)]

I haven't been able to reproduce in Bughunter using Windows 7 using current builds. Previously Bughunter saw this from late 2016-08-06 to early 2016-08-12 but has not seen it since.

Comment 13

[Liz Henry (:lizzard) (relman/hg->git project)]

There's still 60 crashes with this signature on beta 5, so the issue may still exist. Maybe whatever it was in the analytic on the marriot site isn't loading every time. If we fixed this, or they fixed it, it's still crashing in 49.

Comment 14

[Tyson Smith [:tsmith]]

I don't have the tools to reduce this.

Comment 15

[Al Billings [:abillings - ex-MoCo]]

Christian?

Comment 16

[Christian Holler (:decoder)]

The attached test didn't reproduce for me in a Firefox 51 debug build, is it supposed to?

I'm also seeing this error on the console:

JavaScript error: file:///path/to/test.html, line 5: TypeError: Not allowed to define a non-configurable property on the WindowProxy object

Comment 17

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #10)
> On a trip currently - I can help better if someone is able to convert to
> testcase to a standalone one that crashes in a shell.

Clearing needinfo?, unsure if I am the best person for this now...

Comment 18

[Al Billings [:abillings - ex-MoCo]]

No one can reproduce or reduce this. Tomcat, please re-open if it keeps occurring.