Closed Bug 752081 Opened 8 years ago Closed 8 years ago

"Assertion failure: invalid trace kind" with incremental GC and multiple browser windows

Categories

(Core :: JavaScript Engine, defect, critical)

x86_64
macOS
defect
Not set
critical

Tracking

()

VERIFIED FIXED
mozilla15
Tracking Status
firefox14 --- unaffected
firefox15 --- verified
firefox-esr10 --- unaffected

People

(Reporter: jruderman, Assigned: billm)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, regression, testcase, Whiteboard: [advisory-tracking-])

Attachments

(3 files)

Attached file testcase
1. Set
  user_pref("javascript.options.mem.gc_incremental", true);
2. Load the testcase
3. Click the button.
4. Wait ~10 seconds for Firefox to load 200 iframes and a new window.

(You might have to click twice.)

Result:
Assertion failure: invalid trace kind, at js/src/jsfriendapi.cpp:790

I'm guessing this is bad interaction between IGC and CPG.
Attached file stack trace
This looks like code sfink added recently in bug 730208.  (The unmarkGrayScript.)
Attached patch patchSplinter Review
Just needed to cover the script case.
Assignee: general → wmccloskey
Status: NEW → ASSIGNED
Attachment #621226 - Flags: review?(sphink)
Duplicate of this bug: 752124
Attachment #621226 - Flags: review?(sphink) → review+
Blocks: 730208
No longer blocks: cpg
https://hg.mozilla.org/mozilla-central/rev/d4796c874d6a
Status: ASSIGNED → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Duplicate of this bug: 752495
Not tracking for advisory since bug was fallout from May 4 checkin, which is after Firefox 15 fork.
Whiteboard: [advisory-tracking-]
I'm having trouble reproducing this. The testcase does not crash Firefox 15.0a1 Nightly Debug 2012-05-04. Should I try a different build?
Whiteboard: [advisory-tracking-] → [advisory-tracking-][qa?]
Hmm.  Incremental GC was disabled at some point in 15.  I'm not sure when.
(In reply to Andrew McCreight [:mccr8] from comment #10)
> Hmm.  Incremental GC was disabled at some point in 15.  I'm not sure when.

Wouldn't setting the pref in comment 0 turn this on? FWIW, I was testing with the mozilla-central build from the day Jesse filed this bug.
I never tried to reproduce this problem. It was fixed based on the stack trace. So maybe it only happens on Jesse's computer or something.
Jesse, can you please give us some assistance in verifying this is fixed in Firefox 15? Thank you.
Keywords: verifyme
I can reproduce with the parent of d4796c874d6a, but not with d4796c874d6a :)
Status: RESOLVED → VERIFIED
Thanks Jesse.
Whiteboard: [advisory-tracking-][qa?] → [advisory-tracking-]
Group: core-security
You need to log in before you can comment on or make changes to this bug.