899687 - crash in (anonymous namespace)::Worker::Trace(JSTracer*, JSObject*)

Status: RESOLVED FIXED

(Core :: DOM: Workers, defect)

Description

[Till Schneidereit [:till]]

Looks like this is x64 only. From crashstats.m.o, it seem to also happen under other circumstances, but these STR work reliably for me on OS X 10.8 and a reporter (:Pereba in #shumway) on Win.


STR:

- install the Shumway extension from http://www.areweflashyet.com/shumway/
- install the Custom Buttons extension from https://addons.mozilla.org/en-US/firefox/addon/custom-buttons/
- disable the Flash plugin
- restart the browser
- visit http://geocities.ws/___/troll.swf

A stack trace for these STR can be found at https://crash-stats.mozilla.com/report/index/15b1ec1a-cc5b-470f-bc04-2bbd32130730

Comment 1

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Would you mind taking a look at this, Jon? It looks like a fun bug.

Comment 2

[Jon Coppeard (:jonco)]

(In reply to Bill McCloskey (:billm) from comment #1)
> Would you mind taking a look at this, Jon? It looks like a fun bug.

Fun? :)

Sure, no problem.

Comment 3

[Jon Coppeard (:jonco)]

Attachment: worker-crash

The DOM_OBJECT_SLOT of the JSObject is always assumed to hold a private value.  However, it can be accessed by the Trace() method before it is initialised as such if WorkerPrivate::Create() triggers a GC.

The solution is just to always set it to a null private value as soon as it is created.

Comment 4

[Jon Coppeard (:jonco)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/284946982e36

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/284946982e36