540367 - "ASSERTION: bad param: 'aScope'" when running crashtests

Status: RESOLVED FIXED

(Core :: XPConnect, defect, P3)

Description

[Jesse Ruderman]

Attachment: stack traces for the assertions

When I run the full set of crashtests, I usually get these at some point (during cycle collection).

###!!! ASSERTION: bad param: 'aScope', file /Users/jruderman/central/js/src/xpconnect/src/nsXPConnect.cpp, line 1277
###!!! ASSERTION: bad param: 'scope', file /Users/jruderman/central/js/src/xpconnect/src/xpcconvert.cpp, line 1060

These show up on Tinderbox too.

Comment 1

[Jesse Ruderman]

Also, I'm vaguely suspicious that these assertions are related to this timeout orange:
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1263783795.1263785210.1372.gz&fulltext=1

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

OK, mrbkap, sicking, and I just discussed this.

The Unlink phase of cycle collection happens after JS GC finalization.  global->GetGlobalJSObject() is returning something that is nulled out by nsWindowSH::OnFinalize.  That means that if it's null, we can safely presume that we don't much care about fixing up the prototype chain, since it's all been cycle collected already anyway.

So we should just be able to add a null-check higher up in the function.

Comment 3

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: patch

Comment 4

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Comment on attachment 443500 [details] [diff] [review]
patch

Thanks!

Comment 5

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

http://hg.mozilla.org/mozilla-central/rev/71c8fd654a3e