608800 - "Assertion failure: compartment mismatched" & abort at player.vimeo.com, with NoScript

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Daniel Holbert [:dholbert]]

Attachment: backtrace

STEPS TO REPRODUCE:
 0. Run a debug build of either m-c or tracemonkey, w/ fresh profile.

 1. Install NoScript (e.g. from green "INSTALL" button http://noscript.net/getit )  I've got version 2.0.4.  Restart to complete installation.

 2. Visit http://vimeo.com/
 3. Click "Options" in noscript bar @ bottom of screen, and allow vimeo.com
 4. Click "Options" in noscript bar @ bottom of screen, and allow vimeocdn.com
 5. Visit URL ( http://player.vimeo.com/video/15112974 )

ACTUAL RESULTS: This output in my terminal:
> *** Compartment mismatch 0x7f7f198cc800 vs. 0x7f7f0937a000
> Assertion failure: compartment mismatched, at ../../../mozilla/js/src/jscntxtinlines.h:541
... followed by an abort (or intentional crash) from the assertion-failure.

GDB back trace attached.

Comment 1

[Daniel Holbert [:dholbert]]

The attached backtrace is from an up-to-date tracemonkey debug build, BTW.

Comment 2

[Daniel Holbert [:dholbert]]

about:plugins says I have Flash 10.1 r85.  It's from the (up-to-date) "flashplugin-installer" package in Ubuntu 10.10.

Comment 3

[Andreas Gal :gal]

Thanks dholbert. We better fix this for b7. Probably an easy fix though.

Comment 4

[Andreas Gal :gal]

I cant reproduce this. Can you help me with testing if need be?

Comment 5

[Daniel Holbert [:dholbert]]

Yup, definitely.

Comment 6

[Daniel Holbert [:dholbert]]

FWIW, I can reproduce this 100% of the time on two different Ubuntu 10.10 boxes (one x86 and one x86_64).  Both are using flash from up-to-date flashplugin-installer package.

Comment 7

[Blake Kaplan (:mrbkap) (inactive)]

gal has now reproduced this and will attach a fix shortly.

Comment 8

[Andreas Gal :gal]

I don't think this is particularly fatal in opt builds.

Comment 9

[Andreas Gal :gal]

Attachment: patch

Comment 10

[Daniel Holbert [:dholbert]]

(In reply to comment #8)
> I don't think this is particularly fatal in opt builds.

Right - as far as I've seen, this doesn't cause visible problems for opt builds.

(Well, my nightly build did hang the first time I viewed a page with this video embedded -- http://upnotnorth.net/projects/typewriter/ -- but I couldn't reproduce that hang later on, and it's probably unrelated anyway.)

Comment 11

[Andreas Gal :gal]

Attachment: patch

Comment 12

[Andreas Gal :gal]

http://hg.mozilla.org/tracemonkey/rev/ceae36472690

dholbert, can you verify? (pushed to TM)

Comment 13

[Daniel Holbert [:dholbert]]

Confirmed -- assertion-failure + abort become fixed with up-to-date tracemonkey.  (I pulled just gal's changeset from comment 12 and that fixed it.)

However, there's one issue remaining at this bug's testcase -- when I click the "play" button on the testcase, the viewport goes entirely black (aside from the video controls), and no video is visible (though I can hear the audio). This behavior persists when I disable NoScript, so it's not dependent on whatever interaction NoScript had in the assertion-failure here.  This doesn't affect my nightly opt build from today, and (in my debug build) it doesn't affect the vanilla "vimeo.com" version of the video.  (That is: it doesn't affect http://vimeo.com/15112974  -- it only affects http://player.vimeo.com/video/15112974 in debug builds.)

This remaining issue is probably a different bug -- I'm happy to file a new bug on it, unless you think it's related to whatever was failing here.

Comment 14

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/ceae36472690