Closed
Bug 1450847
Opened 6 years ago
Closed 6 years ago
Intermittent /streams/readable-byte-streams/construct-byob-request.dedicatedworker.html | application crashed [@ JSObject::as<js::ArrayBufferObject>] After Assertion failure: this->is<T>(), at /builds/worker/workspace/build/src/js/src/vm/JSObject.h:529
Categories
(Core :: DOM: Core & HTML, defect, P5)
Core
DOM: Core & HTML
Tracking
()
RESOLVED
FIXED
mozilla61
Tracking | Status | |
---|---|---|
firefox-esr52 | --- | unaffected |
firefox59 | --- | wontfix |
firefox60 | --- | wontfix |
firefox61 | --- | fixed |
People
(Reporter: intermittent-bug-filer, Assigned: jonco)
References
Details
(Keywords: crash, intermittent-failure)
Crash Data
Attachments
(1 file)
7.00 KB,
patch
|
till
:
review+
|
Details | Diff | Splinter Review |
Filed by: dluca [at] mozilla.com https://treeherder.mozilla.org/logviewer.html#?job_id=171541784&repo=autoland https://queue.taskcluster.net/v1/task/LruIMxePSAy-xxyHQpR1wQ/runs/0/artifacts/public/logs/live_backing.log
Updated•6 years ago
|
Crash Signature: [@ JSObject::as<js::ArrayBufferObject>] → [@ JSObject::as<js::ArrayBufferObject>]
[@ js::ReadableStreamBYOBRequest::constructor(JSContext*, unsigned int, JS::Value*)]
Updated•6 years ago
|
Summary: Intermittent /streams/readable-byte-streams/construct-byob-request.dedicatedworker.html | application crashed [@ JSObject::as<js::ArrayBufferObject>] After Assertion failure: this->is<T>(), at /builds/worker/workspace/build/src/js/src/vm/JSObject.h:529 → False-positive /streams/readable-byte-streams/construct-byob-request.dedicatedworker.html | application crashed [@ JSObject::as<js::ArrayBufferObject>] After Assertion failure: this->is<T>(), at /builds/worker/workspace/build/src/js/src/vm/JSObject.h:529
Comment hidden (Intermittent Failures Robot) |
Comment hidden (Intermittent Failures Robot) |
Comment 4•6 years ago
|
||
The test got added recently via: https://hg.mozilla.org/mozilla-central/rev/967fc8e815a4 I wonder if that is really a false-positive. We have an assertion and crash here while executing a web-platform test, so I would say it's something real. But what is strange is that in some green jobs we also see this crash WITHOUT having it reported correctly: https://treeherder.mozilla.org/logviewer.html#?job_id=173807649&repo=mozilla-central&lineNumber=26718 James, mind having a look? Thanks.
Flags: needinfo?(james)
Comment 5•6 years ago
|
||
It's a real crash. It's presumably marked as expected, so I'm not sure why sometimes we think it's OK and sometimes not. That could be a bug in the harness. Anyway, independent of that, the right fix is to fix the crash.
Flags: needinfo?(till)
Flags: needinfo?(james)
Flags: needinfo?(amarchesini)
Comment 6•6 years ago
|
||
:whimboo :jgraham i hope this clarifies a bit your questions. If you access the initial link in the description you are sent to the failure and if you click on similar jobs - on a green run you see it has the same failures. As instructed by :philor this is a false-positive and it should be classified against an actual fail, meaning the difference between the fail and the green run, which for the failure in the summary is the following: PID 14076 | Assertion failure: !JS_IsDetachedArrayBufferObject(buffer), at /builds/worker/workspace/build/src/js/src/builtin/Stream.cpp:5143 - the last line from the failure summary here: https://treeherder.mozilla.org/#/jobs?repo=autoland&revision=720ffa73f567809363331c3331bf82b2f1af3c68&selectedJob=171541784 (failed test) that differs from https://treeherder.mozilla.org/#/jobs?repo=autoland&revision=ed99d7ab90b95dd09fa165fec75ae90bb77148dd&selectedJob=173850528 (green run) Hope this helps.
Comment 7•6 years ago
|
||
Till, the crash seems to happen in the JS engine.
Flags: needinfo?(amarchesini)
Assignee | ||
Comment 8•6 years ago
|
||
It looks like we just need to cast the view parameter to an ArrayBufferViewObject rather than a ArrayBufferObject in ReadableStreamBYOBRequest::constructor.
Assignee: nobody → jcoppeard
Attachment #8968477 -
Flags: review?(till)
Comment 9•6 years ago
|
||
Comment on attachment 8968477 [details] [diff] [review] bug1450847-stream-crash Review of attachment 8968477 [details] [diff] [review]: ----------------------------------------------------------------- Thank you!
Attachment #8968477 -
Flags: review?(till) → review+
Updated•6 years ago
|
Flags: needinfo?(till)
Comment 10•6 years ago
|
||
Pushed by jcoppeard@mozilla.com: https://hg.mozilla.org/integration/mozilla-inbound/rev/079bd3d58e34 Fix view parameter class check in ReadableStreamBYOBRequest::constructor r=till
Comment 11•6 years ago
|
||
bugherder |
https://hg.mozilla.org/mozilla-central/rev/079bd3d58e34
Status: NEW → RESOLVED
Closed: 6 years ago
status-firefox61:
--- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla61
Comment 12•6 years ago
|
||
The affected code goes back to 56, but it doesn't appear that we're hitting this crash in the wild, so calling this wontfix for 60. Feel free to nominate it for approval if you feel strongly otherwise, however.
status-firefox59:
--- → wontfix
status-firefox60:
--- → wontfix
status-firefox-esr52:
--- → unaffected
Comment 13•6 years ago
|
||
(In reply to Ryan VanderMeulen [:RyanVM] from comment #12) > The affected code goes back to 56, but it doesn't appear that we're hitting > this crash in the wild, so calling this wontfix for 60. Feel free to > nominate it for approval if you feel strongly otherwise, however. We couldn't hit this in the wild: streams are disabled by default and need two different about:config flags to be toggled to enable them.
Updated•6 years ago
|
Blocks: streams-enable
Summary: False-positive /streams/readable-byte-streams/construct-byob-request.dedicatedworker.html | application crashed [@ JSObject::as<js::ArrayBufferObject>] After Assertion failure: this->is<T>(), at /builds/worker/workspace/build/src/js/src/vm/JSObject.h:529 → Intermittent /streams/readable-byte-streams/construct-byob-request.dedicatedworker.html | application crashed [@ JSObject::as<js::ArrayBufferObject>] After Assertion failure: this->is<T>(), at /builds/worker/workspace/build/src/js/src/vm/JSObject.h:529
Comment hidden (Intermittent Failures Robot) |
Comment hidden (Intermittent Failures Robot) |
Updated•5 years ago
|
Component: DOM → DOM: Core & HTML
You need to log in
before you can comment on or make changes to this bug.
Description
•