750449 - [ESR] "Assertion failure: !comp->rt->gcRunning," using jsdbg2 features

Status: RESOLVED DUPLICATE of bug 684575

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

Debugger(evalcx(''));
gc(<x/>)

asserts js debug shell on mozilla-esr10 changeset 7d395fbcb557 without any CLI arguments at Assertion failure: !comp->rt->gcRunning,

s-s because gc is involved, just-in-case this is security-sensitive.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   76348:de4425a74643
user:        Igor Bukanov
date:        Tue Aug 09 10:51:59 2011 +0200
summary:     bug 674251 - making JSScript a GC-thing. r=jorendorff,bhackett1024

but fixed on m-c by:

The first good revision is:
changeset:   87140:2a8ceeb27f7c
user:        Bill McCloskey
date:        Fri Feb 17 14:35:20 2012 -0800
summary:     Bug 641025 - Incremental GC (r=igor,smaug,roc,cdleary,gregor)

Comment 1

[Daniel Veditz [:dveditz]]

None of those functions exist in client release builds, but evalcx and gc can be approximated. What about Debugger? is that crucial to the brokenness or just one of potentially many things that could create the conditions for this bug?

In other words, is this really an sg:critical client bug or just an interesting shell issue?

Comment 2

[Christian Holler (:decoder)]

There are many bugs with Debugger on ESR, most of those are related to the jsdbg2 API and not relevant for content.

Comment 3

[Daniel Veditz [:dveditz]]

If the fix is "land incremental GC" I can't see that ever happening. If the problem is strictly in jsdbg2 I'd feel better about wontfixing this.

Comment 4

[Daniel Veditz [:dveditz]]

Also, if the problem is only reachable through the debugger APIs then it's more of a sec-moderate than sec-critical.

Comment 5

[Jason Orendorff [:jorendorff]]

This is a duplicate of bug 684575. Note that bug 684575 comment 6 says incremental GC probably fixes this; but that bug is not closed yet.

Comment 7

[Christian Holler (:decoder)]

Clearing security flags since we usually don't treat jsdbg2 issues as security bugs.