Last Comment Bug 693124 - "Assertion failure: cannot reenter" in Proxy::objectClassIs
: "Assertion failure: cannot reenter" in Proxy::objectClassIs
Status: RESOLVED FIXED
: assertion, regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86_64 Windows 7
: -- critical (vote)
: mozilla10
Assigned To: Luke Wagner [:luke]
:
:
Mentors:
Depends on:
Blocks: 326633 683361
  Show dependency tree / graph
 
Reported: 2011-10-08 22:06 PDT by Jesse Ruderman
Modified: 2011-10-11 16:32 PDT (History)
4 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

Attachments
testcase (asserts fatally on 25% of launches) (189 bytes, text/html)
2011-10-08 22:06 PDT, Jesse Ruderman 		no flags Details
top of the stack (11.17 KB, text/plain)
2011-10-08 22:08 PDT, Jesse Ruderman 		no flags Details
rm assert (791 bytes, patch)
2011-10-10 10:39 PDT, Luke Wagner [:luke] 		jwalden+bmo: review+
Details | Diff | Splinter Review
View All Add an attachment (proposed patch, testcase, etc.)

Description Jesse Ruderman 2011-10-08 22:06:56 PDT 
Created attachment 565772 [details]
testcase (asserts fatally on 25% of launches)

On about 25% of launches of Firefox, this testcase triggers:
  Assertion failure: cannot reenter, at js/src/jsproxy.cpp:880

This assertion was added in:
  http://hg.mozilla.org/mozilla-central/rev/b626aecfddf7
  Bug 683361 - Fix part 6: add and call Proxy::objectClassIs (r=waldo)
Comment 1 Jesse Ruderman 2011-10-08 22:08:01 PDT 
Related to bug 618906?
Comment 2 Jesse Ruderman 2011-10-08 22:08:20 PDT 
Created attachment 565773 [details]
top of the stack
Comment 3 Luke Wagner [:luke] 2011-10-10 10:24:04 PDT 
Jesse, can you still reproduce the crash?  Also, what platform?

Regardless, this shouldn't be an infinite recursion; it isn't in the shell...
Comment 4 Luke Wagner [:luke] 2011-10-10 10:38:45 PDT 
Ah, so the infinite recursion is happening outside the engine when XPConnect tries to convert the cyclic object to nsISupports and the assert is bogus and can be removed.  I added the assert for visual symmetry with the other Proxy functions but it clearly has false negatives.
Comment 5 Luke Wagner [:luke] 2011-10-10 10:39:57 PDT 
Created attachment 565972 [details] [diff] [review]
rm assert
Comment 7 Ed Morley [:emorley] 2011-10-11 16:32:03 PDT 
https://hg.mozilla.org/mozilla-central/rev/6c60fe2051fe
Note You need to log in before you can comment on or make changes to this bug.