If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

Intermittent "Assertion failure: key.kind != CrossCompartmentKey::StringWrapper, at ../../../js/src/jscompartment.cpp:710" in browser_InlineSpellChecker.js, browser_bug295977_autoscroll_overflow.js [@ JSCompartment::sweepCrossCompartmentWrappers()]

RESOLVED FIXED in mozilla20

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: emorley, Assigned: jonco)

Tracking

({assertion, intermittent-failure})

Trunk
mozilla20
x86_64
Mac OS X
assertion, intermittent-failure
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
Rev4 MacOSX Lion 10.7 mozilla-inbound debug test mochitest-browser-chrome on 2012-11-27 18:46:39 PST for push a2ee1d41edff

slave: talos-r4-lion-078

https://tbpl.mozilla.org/php/getParsedLog.php?id=17395300&tree=Mozilla-Inbound

{
TEST-PASS | chrome://mochitests/content/browser/toolkit/content/tests/browser/browser_InlineSpellChecker.js | 'en-x-ignore' should display as 'English'
TEST-PASS | chrome://mochitests/content/browser/toolkit/content/tests/browser/browser_InlineSpellChecker.js | 'en-x-ignore-this' should display as 'English'
TEST-PASS | chrome://mochitests/content/browser/toolkit/content/tests/browser/browser_InlineSpellChecker.js | 'en-x-ignore-this-subtag' should display as 'English'
TEST-KNOWN-FAIL | chrome://mochitests/content/browser/toolkit/content/tests/browser/browser_InlineSpellChecker.js | 'en-Cyrl-t-en-latn-m0-ungegn-2007-x-ignore-this-subtag' should display as 'English / Cyrillic'
INFO TEST-END | chrome://mochitests/content/browser/toolkit/content/tests/browser/browser_InlineSpellChecker.js | finished in 81ms
TEST-INFO | checking window state
Assertion failure: key.kind != CrossCompartmentKey::StringWrapper, at ../../../js/src/jscompartment.cpp:710
TEST-UNEXPECTED-FAIL | chrome://mochitests/content/browser/toolkit/content/tests/browser/browser_InlineSpellChecker.js | Exited with code 1 during test run
INFO | automation.py | Application ran for: 0:53:20.861355
INFO | automation.py | Reading PID log: /var/folders/qd/srwd5f710sj0fcl9z464lkj00000gn/T/tmpX_zxqJpidlog
Downloading symbols from: http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-inbound-macosx64-debug/1354068813/firefox-20.0a1.en-US.mac64.crashreporter-symbols.zip
PROCESS-CRASH | chrome://mochitests/content/browser/toolkit/content/tests/browser/browser_InlineSpellChecker.js | application crashed (minidump found)
Crash dump filename: /var/folders/qd/srwd5f710sj0fcl9z464lkj00000gn/T/tmpHcS8AF/minidumps/75636F79-7E1E-4BF6-9A94-3D8B8FCB5E51.dmp
Operating system: Mac OS X
                  10.7.2 11C74
CPU: amd64
     family 6 model 23 stepping 10
     2 CPUs

Crash reason:  EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
Crash address: 0x0

Thread 0 (crashed)
 0  XUL!JSCompartment::sweepCrossCompartmentWrappers() [HashTable.h : 1223 + 0x0]
    rbx = 0x00007fff748e9630   r12 = 0x000000010d28cd00
    r13 = 0x00007fff5fbfcdf8   r14 = 0x00007fff5fbfce28
    r15 = 0x00007fff5fbfce20   rip = 0x0000000102ff2dec
    rsp = 0x00007fff5fbfcdd0   rbp = 0x00007fff5fbfce70
    Found by: given as instruction pointer in context
 1  XUL!JSCompartment::sweep(js::FreeOp*, bool) [jscompartment.cpp : 594 + 0x7]
    rbx = 0x00007fff5fbfcfb8   r12 = 0x0000000000000000
    r13 = 0x00000001052e7000   r14 = 0x0004cf85f0ff48a6
    r15 = 0x00000001062f63f8   rip = 0x0000000102ff26b9
    rsp = 0x00007fff5fbfce80   rbp = 0x00007fff5fbfcf80
    Found by: call frame info
 2  XUL!BeginSweepingCompartmentGroup [jsgc.cpp : 4068 + 0xe]
    rbx = 0x00000001052e7000   r12 = 0x0000000000000000
    r13 = 0x00000001062f63f8   r14 = 0x0004cf85f0ff48a6
    r15 = 0x0000000000000196   rip = 0x000000010302ea08
    rsp = 0x00007fff5fbfcf90   rbp = 0x00007fff5fbfcff0
    Found by: call frame info
 3  XUL!IncrementalCollectSlice [jsgc.cpp : 4207 + 0x7]
    rbx = 0x00007fff5fbfd108   r12 = 0x00000001062f6000
    r13 = 0x0000000103883c20   r14 = 0x00007fff5fbfd040
    r15 = 0x00000001062f6000   rip = 0x000000010302b5ac
    rsp = 0x00007fff5fbfd000   rbp = 0x00007fff5fbfd180
    Found by: call frame info
 4  XUL!GCCycle [jsgc.cpp : 4816 + 0x10]
    rbx = 0x00000001062f6001   r12 = 0x0000000000009c40
    r13 = 0x0000000000000000   r14 = 0x00000001062f63f8
    r15 = 0x00000001062f6000   rip = 0x000000010302a9de
    rsp = 0x00007fff5fbfd190   rbp = 0x00007fff5fbfd1d0
    Found by: call frame info
 5  XUL!Collect [jsgc.cpp : 4931 + 0x14]
    rbx = 0x00000001062f6000   r12 = 0x0000000000000001
    r13 = 0x00000001062f63f8   r14 = 0x0000000000000019
    r15 = 0x0000000000000000   rip = 0x000000010302739c
    rsp = 0x00007fff5fbfd1e0   rbp = 0x00007fff5fbfd220
    Found by: call frame info
 6  XUL!nsJSContext::GarbageCollectNow(js::gcreason::Reason, nsJSContext::IsIncremental, nsJSContext::IsCompartment, nsJSContext::IsShrinking, long long) [nsJSEnvironment.cpp : 2939 + 0xa]
    rbx = 0x0000000000000000   r12 = 0x0000000000000019
    r13 = 0x0000000000000001   r14 = 0x0000000000000028
}
(Reporter)

Comment 1

5 years ago
https://tbpl.mozilla.org/php/getParsedLog.php?id=17397474&tree=Mozilla-Inbound
(Reporter)

Comment 2

5 years ago
https://tbpl.mozilla.org/php/getParsedLog.php?id=17407043&tree=Mozilla-Inbound
(Reporter)

Updated

5 years ago
Summary: Intermittent "Assertion failure: key.kind != CrossCompartmentKey::StringWrapper, at ../../../js/src/jscompartment.cpp:710" in browser_InlineSpellChecker.js [@ JSCompartment::sweepCrossCompartmentWrappers()] → Intermittent "Assertion failure: key.kind != CrossCompartmentKey::StringWrapper, at ../../../js/src/jscompartment.cpp:710" in browser_InlineSpellChecker.js, browser_bug295977_autoscroll_overflow.js [@ JSCompartment::sweepCrossCompartmentWrappers()]
(Reporter)

Updated

5 years ago
Keywords: crash → assertion
Comment hidden (Treeherder Robot)
(Assignee)

Updated

5 years ago
Assignee: general → jcoppeard
Status: NEW → ASSIGNED
(Assignee)

Comment 4

5 years ago
Created attachment 686116 [details] [diff] [review]
Possible fix

When a string in a compartment that is currently being marked is wrapped, mark the string to prevent it being finalized in this collection.
(Assignee)

Updated

5 years ago
Attachment #686116 - Flags: review?(wmccloskey)
Comment on attachment 686116 [details] [diff] [review]
Possible fix

Looks good with the assertion about not moving.
Attachment #686116 - Flags: review?(wmccloskey) → review+
(Assignee)

Comment 6

5 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/b2175d0f4770
https://hg.mozilla.org/mozilla-central/rev/b2175d0f4770
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla20
You need to log in before you can comment on or make changes to this bug.