Closed Bug 1450847 Opened 6 years ago Closed 6 years ago

Intermittent /streams/readable-byte-streams/construct-byob-request.dedicatedworker.html | application crashed [@ JSObject::as<js::ArrayBufferObject>] After Assertion failure: this->is<T>(), at /builds/worker/workspace/build/src/js/src/vm/JSObject.h:529

Categories

(Core :: DOM: Core & HTML, defect, P5)

Product:
Core
Component:
DOM: Core & HTML
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla61
Tracking Flags:
Tracking Status
firefox-esr52 --- unaffected
firefox59 --- wontfix
firefox60 --- wontfix
firefox61 --- fixed

People

(Reporter: intermittent-bug-filer, Assigned: jonco)

References

Details

(Keywords: crash, intermittent-failure)

Crash Data

Attachments

(1 file)

bug1450847-stream-crash
7.00 KB, patch
till
: review+
Details | Diff | Splinter Review
Crash Signature: [@ JSObject::as<js::ArrayBufferObject>] → [@ JSObject::as<js::ArrayBufferObject>] [@ js::ReadableStreamBYOBRequest::constructor(JSContext*, unsigned int, JS::Value*)]
Summary: Intermittent /streams/readable-byte-streams/construct-byob-request.dedicatedworker.html | application crashed [@ JSObject::as<js::ArrayBufferObject>] After Assertion failure: this->is<T>(), at /builds/worker/workspace/build/src/js/src/vm/JSObject.h:529 → False-positive /streams/readable-byte-streams/construct-byob-request.dedicatedworker.html | application crashed [@ JSObject::as<js::ArrayBufferObject>] After Assertion failure: this->is<T>(), at /builds/worker/workspace/build/src/js/src/vm/JSObject.h:529
The test got added recently via:
https://hg.mozilla.org/mozilla-central/rev/967fc8e815a4

I wonder if that is really a false-positive. We have an assertion and crash here while executing a web-platform test, so I would say it's something real. But what is strange is that in some green jobs we also see this crash WITHOUT having it reported correctly:

https://treeherder.mozilla.org/logviewer.html#?job_id=173807649&repo=mozilla-central&lineNumber=26718

James, mind having a look? Thanks.
Flags: needinfo?(james)
It's a real crash. It's presumably marked as expected, so I'm not sure why sometimes we think it's OK and sometimes not. That could be a bug in the harness.

Anyway, independent of that, the right fix is to fix the crash.
Flags: needinfo?(till)
Flags: needinfo?(james)
Flags: needinfo?(amarchesini)
:whimboo :jgraham i hope this clarifies a bit your questions. If you access the initial link in the description you are sent to the failure and if you click on similar jobs - on a green run you see it has the same failures.
As instructed by :philor this is a false-positive and it should be classified against an actual fail, meaning the difference between the fail and the green run, which for the failure in the summary is the following: 

PID 14076 | Assertion failure: !JS_IsDetachedArrayBufferObject(buffer), at /builds/worker/workspace/build/src/js/src/builtin/Stream.cpp:5143 - the last line from the failure summary here: https://treeherder.mozilla.org/#/jobs?repo=autoland&revision=720ffa73f567809363331c3331bf82b2f1af3c68&selectedJob=171541784  (failed test)
 
that differs from  https://treeherder.mozilla.org/#/jobs?repo=autoland&revision=ed99d7ab90b95dd09fa165fec75ae90bb77148dd&selectedJob=173850528  (green run)

Hope this helps.
Till, the crash seems to happen in the JS engine.
Flags: needinfo?(amarchesini)
It looks like we just need to cast the view parameter to an ArrayBufferViewObject rather than a ArrayBufferObject in ReadableStreamBYOBRequest::constructor.
Assignee: nobody → jcoppeard
Attachment #8968477 - Flags: review?(till)
Comment on attachment 8968477 [details] [diff] [review]
bug1450847-stream-crash

Review of attachment 8968477 [details] [diff] [review]:
-----------------------------------------------------------------

Thank you!
Attachment #8968477 - Flags: review?(till) → review+
Flags: needinfo?(till)
Pushed by jcoppeard@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/079bd3d58e34
Fix view parameter class check in ReadableStreamBYOBRequest::constructor r=till
https://hg.mozilla.org/mozilla-central/rev/079bd3d58e34
Status: NEW → RESOLVED
Closed: 6 years ago
status-firefox61: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla61
The affected code goes back to 56, but it doesn't appear that we're hitting this crash in the wild, so calling this wontfix for 60. Feel free to nominate it for approval if you feel strongly otherwise, however.
status-firefox59: --- → wontfix
status-firefox60: --- → wontfix
status-firefox-esr52: --- → unaffected
(In reply to Ryan VanderMeulen [:RyanVM] from comment #12)
> The affected code goes back to 56, but it doesn't appear that we're hitting
> this crash in the wild, so calling this wontfix for 60. Feel free to
> nominate it for approval if you feel strongly otherwise, however.

We couldn't hit this in the wild: streams are disabled by default and need two different about:config flags to be toggled to enable them.
Blocks: streams-enable
Summary: False-positive /streams/readable-byte-streams/construct-byob-request.dedicatedworker.html | application crashed [@ JSObject::as<js::ArrayBufferObject>] After Assertion failure: this->is<T>(), at /builds/worker/workspace/build/src/js/src/vm/JSObject.h:529 → Intermittent /streams/readable-byte-streams/construct-byob-request.dedicatedworker.html | application crashed [@ JSObject::as<js::ArrayBufferObject>] After Assertion failure: this->is<T>(), at /builds/worker/workspace/build/src/js/src/vm/JSObject.h:529
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: