Last Comment Bug 767643 - Incremental GC: Assertion failure in jsgc.cpp leading to a crash
: Incremental GC: Assertion failure in jsgc.cpp leading to a crash
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: x86_64 Linux
-- normal (vote)
: mozilla16
Assigned To: Bill McCloskey (:billm)
: Jason Orendorff [:jorendorff]
Depends on:
  Show dependency treegraph
Reported: 2012-06-22 17:59 PDT by Thaddee Tyl [:espadrine]
Modified: 2012-06-27 03:35 PDT (History)
4 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

patch (742 bytes, patch)
2012-06-25 16:13 PDT, Bill McCloskey (:billm)
continuation: review+
Details | Diff | Splinter Review

Description User image Thaddee Tyl [:espadrine] 2012-06-22 17:59:34 PDT
While browsing on a fx-team build, I got the following error leading to a crash:

Assertion failure: false, at /home/tyl/files/cloud/fx-team/js/src/jsgc.cpp:3182

Stack: <>
Backtrace: <>
Comment 1 User image Luke Wagner [:luke] 2012-06-22 18:16:24 PDT
A js_InvokeOperationCallback during scripted QueryInterface (for a WrappedJSClass) which is called while converting the parameters of an XPC call.  What could go wrong?
Comment 2 User image Bill McCloskey (:billm) 2012-06-22 18:44:47 PDT
What revision is this? I can't figure out which assertion is hitting.

Can you make this happen more than once?
Comment 3 User image Thaddee Tyl [:espadrine] 2012-06-25 12:51:07 PDT
Revision: 97352:06873a64a192 (merge to fx-team).
I believe the latest commit to the JS subtree was 97341:14305028261b (meaning, the most recent commit in my branch history; this commit is very likely not responsible).

I cannot make it happen again. I have no idea if there is a reproducible way to do it over again. I know I was testing the future devtools timeline <> and it was listening to all GC/CC events on a GC-expensive page.
Comment 4 User image Bill McCloskey (:billm) 2012-06-25 16:13:50 PDT
Created attachment 636523 [details] [diff] [review]

Man, what a disaster. In bug 743396, I accidentally checked in the assertion that we never find black/gray edges. Either this is a very rare case to hit, or else not many people run debug builds.
Comment 5 User image Andrew McCreight [:mccr8] 2012-06-25 16:26:37 PDT
Comment on attachment 636523 [details] [diff] [review]

Review of attachment 636523 [details] [diff] [review]:

Comment 6 User image Andrew McCreight [:mccr8] 2012-06-25 16:27:04 PDT
I guess it is a good sign we don't hit it that much...
Comment 8 User image Ed Morley [:emorley] 2012-06-27 03:35:36 PDT

Note You need to log in before you can comment on or make changes to this bug.