Closed Bug 937191 Opened 6 years ago Closed 6 years ago

crash in js::CompartmentChecker::fail(JSCompartment*, JSCompartment*)

Categories

(Core :: DOM: Workers, defect, critical)

28 Branch
defect
Not set
critical

Tracking

()

VERIFIED DUPLICATE of bug 936327
Tracking Status
firefox26 --- unaffected
firefox27 --- unaffected
firefox28 --- affected
firefox-esr24 --- unaffected
b2g18 --- unaffected

People

(Reporter: tracy, Unassigned)

References

Details

(Keywords: crash, regression, sec-high, Whiteboard: [sg:dupe 936327])

This bug was filed from the Socorro interface and is 
report bp-95de096e-f798-41f7-bd57-50ad42131111.
=============================================================

This began to increase in volume on 20131106 (10x previous volume). Then increase another 6 (20131107) to 9 (20131110) fold after that.

This occurs mostly on Windows, with a several crashes on Mac.  Most interesting is that nearly all of these crashes happen a matter of seconds after the browser has been up for 1 hour.  

0 	mozjs.dll 	js::CompartmentChecker::fail(JSCompartment *,JSCompartment *) 	js/src/jscntxtinlines.h
1 	mozjs.dll 	JS_CallFunctionValue(JSContext *,JSObject *,JS::Value,unsigned int,JS::Value *,JS::Value *) 	js/src/jsapi.cpp
2 	xul.dll 	mozilla::dom::workers::WorkerPrivate::RunExpiredTimeouts(JSContext *) 	dom/workers/WorkerPrivate.cpp
3 	xul.dll 	`anonymous namespace'::TimerRunnable::WorkerRun(JSContext *,mozilla::dom::workers::WorkerPrivate *) 	dom/workers/WorkerPrivate.cpp
4 	xul.dll 	mozilla::dom::workers::WorkerRunnable::Run() 	dom/workers/WorkerPrivate.cpp
5 	xul.dll 	CallQueryInterface<nsIHTMLCollection,nsIDOMNodeList>(nsIHTMLCollection *,nsIDOMNodeList * *) 	obj-firefox/dist/include/nsISupportsUtils.h
6 	xul.dll 	mozilla::dom::workers::WorkerPrivate::DoRunLoop(JSContext *) 	dom/workers/WorkerPrivate.cpp
7 	xul.dll 	JSAutoRequest::JSAutoRequest(JSContext *) 	obj-firefox/dist/include/jsapi.h
8 	xul.dll 	`anonymous namespace'::WorkerThreadRunnable::Run() 	dom/workers/RuntimeService.cpp
9 	xul.dll 	nsThread::ProcessNextEvent(bool,bool *) 	xpcom/threads/nsThread.cpp
10 	xul.dll 	nsThread::ThreadFunc(void *) 	xpcom/threads/nsThread.cpp
11 	nss3.dll 	_PR_NativeRunThread 	nsprpub/pr/src/threads/combined/pruthr.c
12 	nss3.dll 	pr_root 	nsprpub/pr/src/md/windows/w95thred.c
13 	msvcr100.dll 	_callthreadstartex 	f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\threadex.c
14 	msvcr100.dll 	_threadstartex 	f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\threadex.c
15 	kernel32.dll 	BaseThreadStart
Group: core-security
The stack is very similar to bug 936327, so this is either the same bug, or another regression from bug 928312.
Component: JavaScript Engine → DOM: Workers
Keywords: sec-high
the fix for bug 928312 does fit the regression range.
Blocks: 928312
Component: DOM: Workers → JavaScript Engine
Keywords: topcrash-win
Component: JavaScript Engine → DOM: Workers
ack, sorry.
Yeah this is almost certainly a dupe.
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 936327
moved the crash signature to the dupe.
Status: RESOLVED → VERIFIED
Crash Signature: [@ js::CompartmentChecker::fail(JSCompartment*, JSCompartment*)]
Keywords: topcrash-win
Group: core-security
Whiteboard: [sg:dupe 936327]
You need to log in before you can comment on or make changes to this bug.