1449794 - Crash in js::AssertObjectIsSavedFrameOrWrapper

Status: RESOLVED WORKSFORME

(DevTools :: Debugger, defect, P3)

Description

[Ben Kelly [:bkelly, not reviewing]]

This bug was filed from the Socorro interface and is
report bp-a6b88944-1758-4ee4-a0ec-2b71d0180329.
=============================================================

Top 10 frames of crashing thread:

0 xul.dll js::AssertObjectIsSavedFrameOrWrapper js/src/vm/SavedStacks-inl.h:26
1 xul.dll js::ErrorObject::create js/src/vm/ErrorObject.cpp:93
2 xul.dll js::CopyErrorObject js/src/jsexn.cpp:1080
3 xul.dll js::ErrorCopier::~ErrorCopier js/src/proxy/Wrapper.cpp:459
4 xul.dll js::DebuggerObject::getOwnPropertyNames js/src/vm/Debugger.cpp:10377
5 xul.dll js::DebuggerObject::getOwnPropertyNamesMethod js/src/vm/Debugger.cpp:9477
6 xul.dll js::InternalCallOrConstruct js/src/vm/Interpreter.cpp:468
7 xul.dll js::ForwardingProxyHandler::call js/src/proxy/Wrapper.cpp:176
8 xul.dll js::InternalCallOrConstruct js/src/vm/Interpreter.cpp:450
9 xul.dll js::jit::DoCallFallback js/src/jit/BaselineIC.cpp:2380

=============================================================

Comment 1

[Ben Kelly [:bkelly, not reviewing]]

I have a user reports that they can reproduce this:

Addon code that I've been using to trigger it: https://github.com/jamesgecko/tab-rasa/tree/crash

- Have pause-on-break turned on in the debugger. Open the extension popup, click outside to close it, then open the extension again. The debugger crashes a few seconds later.
- The addon is copying objects from the popup context to the background context. The crash may be related to dead object refs.

Kris, do you know who should look at this?

Comment 2

[Kris Maglione [:kmag]]

So, at the moment, if you try to wrap an object for a nuked compartment, we treat it as a success, but return a dead wrapper. It looks like what that ErrorCopier is doing is taking the stack from an Error object, trying to wrap it for the nuked popup window compartment it's stopped in, getting a dead wrapper, and passing that dead wrapper as the stack for a new error object.

I'm not really sure what the best solution for that problem is... Probably ideally something like bailing out sooner if we're stopped in a nuked compartment. But possibly we shouldn't nuke a compartment the debugger is paused in, or possibly the error copier should check for dead wrappers there.

Comment 3

[Jason Laster [:jlast]]

Brian, i'm curious what you think of this?

Comment 4

[Brian Hackett [Laid off!]]

I don't have a great understanding of this code, but it seems like this immediate error could be handled in ErrorObject::create by just ignoring the stack argument if it is a dead wrapper.

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.