Last Comment Bug 767643 - Incremental GC: Assertion failure in jsgc.cpp leading to a crash
: Incremental GC: Assertion failure in jsgc.cpp leading to a crash
Status: RESOLVED FIXED
[js:waitingforinfo]
:
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: x86_64 Linux
: -- normal (vote)
: mozilla16
Assigned To: Bill McCloskey (:billm)
:
: Jason Orendorff [:jorendorff]
Mentors:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2012-06-22 17:59 PDT by Thaddee Tyl [:espadrine]
Modified: 2012-06-27 03:35 PDT (History)
4 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
patch (742 bytes, patch)
2012-06-25 16:13 PDT, Bill McCloskey (:billm)
continuation: review+
Details | Diff | Splinter Review

Description Thaddee Tyl [:espadrine] 2012-06-22 17:59:34 PDT
While browsing on a fx-team build, I got the following error leading to a crash:

Assertion failure: false, at /home/tyl/files/cloud/fx-team/js/src/jsgc.cpp:3182

Stack: <http://pastebin.mozilla.org/1670658>
Backtrace: <http://pastebin.mozilla.org/1670655>
Comment 1 Luke Wagner [:luke] 2012-06-22 18:16:24 PDT
A js_InvokeOperationCallback during scripted QueryInterface (for a WrappedJSClass) which is called while converting the parameters of an XPC call.  What could go wrong?
Comment 2 Bill McCloskey (:billm) 2012-06-22 18:44:47 PDT
What revision is this? I can't figure out which assertion is hitting.

Can you make this happen more than once?
Comment 3 Thaddee Tyl [:espadrine] 2012-06-25 12:51:07 PDT
Revision: 97352:06873a64a192 (merge to fx-team).
I believe the latest commit to the JS subtree was 97341:14305028261b (meaning, the most recent commit in my branch history; this commit is very likely not responsible).

I cannot make it happen again. I have no idea if there is a reproducible way to do it over again. I know I was testing the future devtools timeline <https://github.com/scrapmac/Graphical-Timeline-of-Events> and it was listening to all GC/CC events on a GC-expensive page.
Comment 4 Bill McCloskey (:billm) 2012-06-25 16:13:50 PDT
Created attachment 636523 [details] [diff] [review]
patch

Man, what a disaster. In bug 743396, I accidentally checked in the assertion that we never find black/gray edges. Either this is a very rare case to hit, or else not many people run debug builds.
Comment 5 Andrew McCreight [:mccr8] 2012-06-25 16:26:37 PDT
Comment on attachment 636523 [details] [diff] [review]
patch

Review of attachment 636523 [details] [diff] [review]:
-----------------------------------------------------------------

Oops!
Comment 6 Andrew McCreight [:mccr8] 2012-06-25 16:27:04 PDT
I guess it is a good sign we don't hit it that much...
Comment 8 Ed Morley [:emorley] 2012-06-27 03:35:36 PDT
https://hg.mozilla.org/mozilla-central/rev/394ff92cde98

Note You need to log in before you can comment on or make changes to this bug.