Closed Bug 942529 Opened 11 years ago Closed 11 years ago

Assertion failure: GetGCThingTraceKind(rope) == JSTRACE_STRING, at c:\work\mozilla\builds\nightly\mozilla\js\src\gc/Marking.cpp:958

Categories

(Core :: JavaScript Engine, defect)

x86
All
defect
Not set
normal

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: cbook, Unassigned)

References

()

Details

(Keywords: assertion, sec-high)

Attachments

(1 file)

Found via Bughunter and reproduced on a Windows 7 debug Build. Loading https://codenvy.com/ide/edunogodz caused after about 40 seconds Assertion failure: GetGCThingTraceKind(rope) == JSTRACE_STRING, at c:\work\mozilla\builds\nightly\mozilla\js\src\gc/Marking.cpp:958 will try to generated a testcase etc for this. Might be related to bug 878576 however this is now on a real world website
Attached file windows stack
please see also bug 942530, same site different assertion
sfink, maybe this is relevant to that rope crash you've been looking into?
Keywords: sec-high
Group: javascript-core-security
Jon can you maybe look into this? It has sat around since November. Thanks.
Flags: needinfo?(jcoppeard)
Does this still reproduce? Maybe the other bug fixed this...
Flags: needinfo?(cbook)
(In reply to Andrew McCreight [:mccr8] from comment #5) > Does this still reproduce? Maybe the other bug fixed this... Yeah I'm pretty sure this is a duplicate of bug 942530. I'll wait for Tomcat to confirm it no longer crashes though.
Flags: needinfo?(jcoppeard)
can't reproduce anymore :) so marking wfm :)
Status: NEW → RESOLVED
Closed: 11 years ago
Flags: needinfo?(cbook)
Resolution: --- → WORKSFORME
Group: javascript-core-security
Group: core-security → core-security-release
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: