782575 - Intermittent crash in browser_inspector_treePanel_navigation.js [@ js::UnwrapObject]

Status: RESOLVED DUPLICATE of bug 735472

(Core :: JavaScript Engine, defect)

Description

[Ed Morley [:emorley]]

Rev4 MacOSX Lion 10.7 mozilla-central opt test mochitest-other on 2012-08-13 21:05:27 PDT for push 22f6adf8685b

slave: talos-r4-lion-031

https://tbpl.mozilla.org/php/getParsedLog.php?id=14359332&tree=Firefox

{
TEST-PASS | chrome://mochitests/content/browser/browser/devtools/highlighter/test/browser_inspector_treePanel_navigation.js | [35] right node selected: html
TEST-PASS | chrome://mochitests/content/browser/browser/devtools/highlighter/test/browser_inspector_treePanel_navigation.js | [36] right node selected: html
TEST-UNEXPECTED-FAIL | chrome://mochitests/content/browser/browser/devtools/highlighter/test/browser_inspector_treePanel_navigation.js | Exited with code 1 during test run
INFO | automation.py | Application ran for: 0:11:42.683659
INFO | automation.py | Reading PID log: /var/folders/qd/srwd5f710sj0fcl9z464lkj00000gn/T/tmp9I1_x2pidlog
Downloading symbols from: http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-central-macosx64/1344912102/firefox-17.0a1.en-US.mac.crashreporter-symbols.zip
PROCESS-CRASH | chrome://mochitests/content/browser/browser/devtools/highlighter/test/browser_inspector_treePanel_navigation.js | application crashed (minidump found)
Crash dump filename: /var/folders/qd/srwd5f710sj0fcl9z464lkj00000gn/T/tmpdPTXFC/minidumps/72EEEA27-E5ED-4C5A-B2A9-7B3CB1010622.dmp
Operating system: Mac OS X
                  10.7.2 11C74
CPU: amd64
     family 6 model 23 stepping 10
     2 CPUs

Crash reason:  EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
Crash address: 0x0

Thread 0 (crashed)
 0  XUL!js::UnwrapObject [jsfriendapi.h : 361 + 0x0]
    rbx = 0x00000000   r12 = 0x03198448   r13 = 0xffffffff   r14 = 0x00000000
    r15 = 0x00000000   rip = 0x024fd176   rsp = 0x5fbfd170   rbp = 0x5fbfd1a0
    Found by: given as instruction pointer in context
 1  XUL!js::NukeCrossCompartmentWrappers [jswrapper.cpp : 1114 + 0xe]
    rip = 0x02502e0f   rsp = 0x5fbfd1b0
    Found by: stack scanning
 2  libsystem_c.dylib + 0x4d6aa
    rip = 0x8c2726ab   rsp = 0x5fbfd230
    Found by: stack scanning
 3  XUL!WindowDestroyedEvent::Run [nsGlobalWindow.cpp : 6904 + 0xb]
    rip = 0x016a42c6   rsp = 0x5fbfd290
    Found by: stack scanning
}

Comment 1

[Bobby Holley (:bholley)]

Looks like we've either got a null wrapper in the cross-compartment map, or (more likely I think) a series of wrapper that dead-ends with a null private (meaning we're segfaulting in the while() loop of UnwrapObject). Both would be bad, I think.

Comment 2

[Phil Ringnalda (:philor)]

Happy to be proven wrong by it happening on another slave, but... that slave ain't right, and what we probably had was an access of defective memory.