1314764 - worker console.log() can trigger MOZ_DIAGNOSTIC_ASSERT(rt->allowGCBarriers()) failure

Status: RESOLVED DUPLICATE of bug 1328423

(Core :: JavaScript: GC, defect)

Description

[Ben Kelly [:bkelly, not reviewing]]

I was recently running my worker anti-flooding test and hit a new reproduceable crash:

1) open new nightly browser
2) open http://mozilla.pettay.fi/workerconsole/ in new tab
3) Enter `while(true) { console.log('foo'); }` into the worker script text box
4) Observe cpu and memory should increase, but browser is still responsive
5) Open a new content tab... example.com or something
6) Switch back and forth between the workerconsole tab and the second tab
7) Eventually the content process will crash

I make a debug build and got this stack trace on a *worker* thread:

>	xul.dll!js::gc::ExposeGCThingToActiveJS(JS::GCCellPtr thing) Line 643	C++
 	xul.dll!JS::ExposeValueToActiveJS(const JS::Value & v) Line 985	C++
 	xul.dll!js::BarrierMethods<JS::Value>::exposeToJS(const JS::Value & v) Line 1308	C++
 	xul.dll!JS::Heap<JS::Value>::exposeToActiveJS() Line 262	C++
 	xul.dll!JS::Heap<JS::Value>::get() Line 265	C++
 	xul.dll!JS::Heap<JS::Value>::operator JS::Value const & __ptr64() Line 255	C++
 	xul.dll!mozilla::dom::ConsoleCallDataRunnable::PreDispatch(JSContext * aCx) Line 544	C++
 	xul.dll!mozilla::dom::ConsoleRunnable::Dispatch(JSContext * aCx) Line 337	C++
 	xul.dll!mozilla::dom::Console::MethodInternal(JSContext * aCx, mozilla::dom::Console::MethodName aMethodName, const nsAString_internal & aMethodString, const mozilla::dom::Sequence<JS::Value> & aData) Line 1384	C++
 	xul.dll!mozilla::dom::Console::Method(const mozilla::dom::GlobalObject & aGlobal, mozilla::dom::Console::MethodName aMethodName, const nsAString_internal & aMethodString, const mozilla::dom::Sequence<JS::Value> & aData) Line 1211	C++
 	xul.dll!mozilla::dom::Console::Log(const mozilla::dom::GlobalObject & aGlobal, const mozilla::dom::Sequence<JS::Value> & aData) Line 967	C++
 	xul.dll!mozilla::dom::consoleBinding::log(JSContext * cx, unsigned int argc, JS::Value * vp) Line 2269	C++


Does this assertion even make sense on workers?  Or should it only be in effect on main thread?

Comment 1

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

This assertion is now gone since bug 1308039 was backed out.