Created attachment 704073 [details] testcase Exposed by the fix for bug 829430. 1. Create a new profile (mkdir -p ~/px/a; firefox -profile ~/px/a) 2. Install https://www.squarefree.com/extensions/domFuzzLite3.xpi 3. Load the testcase ###!!! ASSERTION: bad pop from per thread data: 'old == this', file /Users/jruderman/trees/mozilla-central/js/xpconnect/src/XPCCallContext.cpp, line 295 Followed by one of the following: Assertion failure: constraintsPurged(), at /Users/jruderman/trees/mozilla-central/js/src/jsinfer.h:695 Or a null deref [@ js::types::TypeSet::unknown]
Should that first assertion be fatal?
Yeah, it's hard to say totally because XPCCallContexts do this crazy unintuitive stack management, but but I _think_ this shouldn't happen. That is to say, I think this might be memory corruption. :-(
I can reproduce with a normal debug build, but not an ASan debug build??
Can also lead to: Assertion failure: cx->maybeRegs() == ®s_, at js/src/jscntxtinlines.h:125
Or crashes in js::types::TypeSet::hasType
Or: Assertion failure: hasfp(), at js/src/vm/Stack.h:1747