824209 - intermittent test_transitions_per_property.html crash under XUL!proxy_TraceObject

Status: RESOLVED DUPLICATE of bug 819013

(Core :: CSS Parsing and Computation, defect)

Description

[Cameron McCormack (:heycam)]

Saw this once, couldn't notice any commit in particular that might have caused it.

https://tbpl.mozilla.org/?tree=Mozilla-Inbound&rev=972c3e4a494f
https://tbpl.mozilla.org/php/getParsedLog.php?id=18182864&tree=Mozilla-Inbound

92695 INFO TEST-PASS | /tests/layout/style/test/test_transitions_per_property.html | transitions not supported for property background-image value -moz-radial-gradient(399grad, ellipse closest-corner, red, blue)
92696 INFO TEST-PASS | /tests/layout/style/test/test_transitions_per_property.html | transitions not supported for property background-image value -moz-radial-gradient(44px top -33deg, red, blue)
92697 INFO TEST-PASS | /tests/layout/style/test/test_transitions_per_property.html | transitions not supported for property background-image value -moz-radial-gradient(399grad, farthest-side circle, red, blue)
Assertion failure: *p->value.unsafeGet() == ObjectValue(*obj), at ../../../js/src/jsproxy.cpp:2806
TEST-UNEXPECTED-FAIL | /tests/layout/style/test/test_transitions_per_property.html | Exited with code 1 during test run
INFO | automation.py | Application ran for: 0:03:10.439148
INFO | automation.py | Reading PID log: /var/folders/Hs/HsDn6a9SG8idoIya6p9mtE+++TI/-Tmp-/tmp1stsNtpidlog
PROCESS-CRASH | /tests/layout/style/test/test_transitions_per_property.html | application crashed [@ proxy_TraceObject]
Crash dump filename: /var/folders/Hs/HsDn6a9SG8idoIya6p9mtE+++TI/-Tmp-/tmpIQ4Esl/minidumps/ED601AF7-C51C-4A4C-A5CB-28DA343586B8.dmp
Operating system: Mac OS X
                  10.6.8 10K549
CPU: amd64
     family 6 model 23 stepping 10
     2 CPUs

Crash reason:  EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
Crash address: 0x0

Thread 0 (crashed)
 0  XUL!proxy_TraceObject [jsapi.h : 486 + 0x0]
    rbx = 0x00007fff711a32f8   r12 = 0x0000000100f2f708
    r13 = 0x00007fff5fbfa800   r14 = 0x00007fff5fbfa848
    r15 = 0x00007fff5fbfa848   rip = 0x0000000103933fd7
    rsp = 0x00007fff5fbfa6e0   rbp = 0x00007fff5fbfa700
    Found by: given as instruction pointer in context
 1  XUL!js::ObjectImpl::markChildren(JSTracer*) [ObjectImpl.cpp : 287 + 0x7]
    rbx = 0x000000014e366900   r12 = 0x0000000100f2f708
    r13 = 0x00007fff5fbfa800   r14 = 0x00007fff5fbfa848
    r15 = 0x00007fff5fbfa848   rip = 0x0000000103a17d3c
    rsp = 0x00007fff5fbfa710   rbp = 0x00007fff5fbfa720
    Found by: call frame info
 2  XUL!IncrementalCollectSlice [jsgc.cpp : 2521 + 0xa]
    rbx = 0x0000000000000004   r12 = 0x0000000100f2f708
    r13 = 0x00007fff5fbfa800   r14 = 0x0000000000000000
    r15 = 0x00007fff5fbfa848   rip = 0x0000000103890283
    rsp = 0x00007fff5fbfa730   rbp = 0x00007fff5fbfa8c0
    Found by: call frame info
 3  XUL!GCCycle [jsgc.cpp : 4160 + 0x10]
    rbx = 0x0000000105683000   r12 = 0x0000000000000000
    r13 = 0x0000000000000000   r14 = 0x00000001056833c8
    r15 = 0x0000000105683000   rip = 0x000000010388f84e
    rsp = 0x00007fff5fbfa8d0   rbp = 0x00007fff5fbfa910
    Found by: call frame info
 4  XUL!Collect [jsgc.cpp : 4278 + 0x14]
    rbx = 0x0000000105683000   r12 = 0x0000000000000001
    r13 = 0x00000001056833c8   r14 = 0x0000000000000005
    r15 = 0x0000000000000000   rip = 0x000000010388e18c
    rsp = 0x00007fff5fbfa920   rbp = 0x00007fff5fbfa960
    Found by: call frame info
 5  XUL!js_InvokeOperationCallback(JSContext*) [jscntxt.cpp : 1059 + 0xe]
    rbx = 0x000000012a5a8590   r12 = 0x000000011e7dda00
    r13 = 0xffff800000000000   r14 = 0x00007fffffffffff
    r15 = 0x0000000107a84d40   rip = 0x00000001038542a2
    rsp = 0x00007fff5fbfa970   rbp = 0x00007fff5fbfa980
    Found by: call frame info
 6  XUL!js_HandleExecutionInterrupt(JSContext*) [jscntxt.cpp : 1083 + 0x4]
    rbx = 0x000000012a5a8590   r12 = 0x000000011e7dda00
    r13 = 0xffff800000000000   r14 = 0x00007fffffffffff