Incremental GC: Assertion failure in jsgc.cpp leading to a crash

RESOLVED FIXED in mozilla16

Status

()

Core
JavaScript Engine
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: espadrine, Assigned: billm)

Tracking

unspecified
mozilla16
x86_64
Linux
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [js:waitingforinfo])

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
While browsing on a fx-team build, I got the following error leading to a crash:

Assertion failure: false, at /home/tyl/files/cloud/fx-team/js/src/jsgc.cpp:3182

Stack: <http://pastebin.mozilla.org/1670658>
Backtrace: <http://pastebin.mozilla.org/1670655>

Comment 1

5 years ago
A js_InvokeOperationCallback during scripted QueryInterface (for a WrappedJSClass) which is called while converting the parameters of an XPC call.  What could go wrong?
(Assignee)

Comment 2

5 years ago
What revision is this? I can't figure out which assertion is hitting.

Can you make this happen more than once?
Whiteboard: [js:waitingforinfo]
(Reporter)

Comment 3

5 years ago
Revision: 97352:06873a64a192 (merge to fx-team).
I believe the latest commit to the JS subtree was 97341:14305028261b (meaning, the most recent commit in my branch history; this commit is very likely not responsible).

I cannot make it happen again. I have no idea if there is a reproducible way to do it over again. I know I was testing the future devtools timeline <https://github.com/scrapmac/Graphical-Timeline-of-Events> and it was listening to all GC/CC events on a GC-expensive page.
(Assignee)

Comment 4

5 years ago
Created attachment 636523 [details] [diff] [review]
patch

Man, what a disaster. In bug 743396, I accidentally checked in the assertion that we never find black/gray edges. Either this is a very rare case to hit, or else not many people run debug builds.
Assignee: general → wmccloskey
Status: NEW → ASSIGNED
Attachment #636523 - Flags: review?(continuation)
Comment on attachment 636523 [details] [diff] [review]
patch

Review of attachment 636523 [details] [diff] [review]:
-----------------------------------------------------------------

Oops!
Attachment #636523 - Flags: review?(continuation) → review+
I guess it is a good sign we don't hit it that much...
(Assignee)

Comment 7

5 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/394ff92cde98
Target Milestone: --- → mozilla16

Comment 8

5 years ago
https://hg.mozilla.org/mozilla-central/rev/394ff92cde98
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.