752081 - "Assertion failure: invalid trace kind" with incremental GC and multiple browser windows

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

Attachment: testcase

1. Set
  user_pref("javascript.options.mem.gc_incremental", true);
2. Load the testcase
3. Click the button.
4. Wait ~10 seconds for Firefox to load 200 iframes and a new window.

(You might have to click twice.)

Result:
Assertion failure: invalid trace kind, at js/src/jsfriendapi.cpp:790

I'm guessing this is bad interaction between IGC and CPG.

Comment 1

[Jesse Ruderman]

Attachment: stack trace

Comment 2

[Andrew McCreight [:mccr8]]

This looks like code sfink added recently in bug 730208.  (The unmarkGrayScript.)

Comment 3

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Attachment: patch

Just needed to cover the script case.

Comment 5

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/d4796c874d6a

Comment 6

[(no longer active)]

https://hg.mozilla.org/mozilla-central/rev/d4796c874d6a

Comment 8

[Al Billings [:abillings - ex-MoCo]]

Not tracking for advisory since bug was fallout from May 4 checkin, which is after Firefox 15 fork.

Comment 9

[u279076]

I'm having trouble reproducing this. The testcase does not crash Firefox 15.0a1 Nightly Debug 2012-05-04. Should I try a different build?

Comment 10

[Andrew McCreight [:mccr8]]

Hmm.  Incremental GC was disabled at some point in 15.  I'm not sure when.

Comment 11

[u279076]

(In reply to Andrew McCreight [:mccr8] from comment #10)
> Hmm.  Incremental GC was disabled at some point in 15.  I'm not sure when.

Wouldn't setting the pref in comment 0 turn this on? FWIW, I was testing with the mozilla-central build from the day Jesse filed this bug.

Comment 12

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

I never tried to reproduce this problem. It was fixed based on the stack trace. So maybe it only happens on Jesse's computer or something.

Comment 13

[u279076]

Jesse, can you please give us some assistance in verifying this is fixed in Firefox 15? Thank you.

Comment 14

[Jesse Ruderman]

I can reproduce with the parent of d4796c874d6a, but not with d4796c874d6a :)

Comment 15

[u279076]

Thanks Jesse.