Open Bug 1604498 Opened 4 months ago Updated 3 months ago

Assertion failure: !mTable (Tear-off objects remain in hashtable at shutdown.), at /builds/worker/workspace/build/src/dom/svg/SVGAttrTearoffTable.h:29

Categories

(Core :: SVG, defect, P5)

defect

Tracking

()

Tracking Status
firefox73 --- affected

People

(Reporter: jkratzer, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

Attachments

(2 files)

Attached file testcase.html

Testcase found while fuzzing mozilla-central rev 83fc8cf83221. Testcase must be served via a local webserver in order to reproduce. Furthermore, testcase may require a few attempts to trigger the assertion.

Flags: in-testsuite?

The priority flag is not set for this bug.
:TYLin, could you have a look please?

For more information, please visit auto_nag documentation.

Flags: needinfo?(aethanyc)

I cannot reproduce this on my local m-c debug build with the testcase served via a local webserver.

Jason, is there any preferences required to set to reproduce this?

Flags: needinfo?(aethanyc) → needinfo?(jkratzer)
Attached file prefs-default-e10s.js
Flags: needinfo?(jkratzer)

:TYLin, I'm not sure exactly which pref is required but it reproduces for me consistently using the prefs attached here.

The priority flag is not set for this bug.
:heycam, could you have a look please?

For more information, please visit auto_nag documentation.

Flags: needinfo?(cam)

Thanks! I can reproduce with the prefs attached in comment 4 by

python -m ffpuppet obj-firefox/dist/bin/firefox -p ~/Downloads/prefs-default-e10s.js -d -u http://localhost:8000/1604498.html --rr -l log

The minumum prefs that I can produce are (I can only reporduce for about 70% of the time, not always).

user_pref("datareporting.healthreport.service.enabled", false);
user_pref("datareporting.healthreport.service.firstRun", false);
user_pref("datareporting.healthreport.uploadEnabled", false);
user_pref("datareporting.policy.firstRunURL", "");
user_pref("dom.allow_scripts_to_close_windows", true);

The full stack is like:

#0  0x00007f70a3d5b4a7 in mozilla::SVGAttrTearoffTable<mozilla::SVGAnimatedLength, mozilla::dom::DOMSVGAnimatedLength>::~SVGAttrTearoffTable() (this=0x7f70ad6d6960 <mozilla::sSVGAnimatedLengthTearoffTable>)
    at /home/aethanyc/Projects/gecko/dom/svg/SVGAttrTearoffTable.h:29
#1  0x00007f70b75d3041 in __run_exit_handlers (status=0, listp=0x7f70b797b718 <__exit_funcs>, run_list_atexit=run_list_atexit@entry=true, run_dtors=run_dtors@entry=true) at exit.c:108
#2  0x00007f70b75d313a in __GI_exit (status=<optimized out>) at exit.c:139
#3  0x00007f70b75b1b9e in __libc_start_main (main=0x55baac7a01f0 <main(int, char**, char**)>, argc=16, argv=0x7ffec9b1aad8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7ffec9b1aac8)
    at ../csu/libc-start.c:344
#4  0x000055baac7a002a in _start ()

So this looks like a shutdown issue, and the assertion only fired in debug build. P5 for now.

Flags: needinfo?(cam)
Priority: -- → P5
You need to log in before you can comment on or make changes to this bug.