Closed Bug 1568238 Opened 5 years ago Closed 5 years ago

Crash in [@ mozilla::dom::RemoteObjectProxyBase::GetOrCreateProxyObject]

Categories

(Core :: DOM: Content Processes, defect, P2)

Product:
Core
Component:
DOM: Content Processes
Platform:
Unspecified
Windows 10
Type:
defect

Tracking

()

Status:
RESOLVED WORKSFORME
Project Flags:
Fission Milestone M4
Tracking Flags:
Tracking Status
firefox68 --- unaffected
firefox69 --- unaffected
firefox70 --- fix-optional

People

(Reporter: marcia, Assigned: mccr8)

References

(Regression)

Details

(Keywords: crash, regression)

Crash Data

Seen while doing nightly crash triage. 2 crashes so far. Crashes started in 20190722093634. Crash reason: MOZ_RELEASE_ASSERT(js::GetObjectClass(aProxy) == aClasp)

Possible regression range based on build ID: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=5b21e285d546b38bbdae18c075c079f4b56350a7&tochange=b8141448e0baa767e8eff61e28c5a418c438f3d2

Bug 1510760 is not in the regression range, but touched code in this area.

ni on Andrew

Flags: needinfo?(continuation)

Yeah, bug 1510760 added that assert, so it is certainly the cause.

Component: DOM: Bindings (WebIDL) → DOM: Content Processes
Flags: needinfo?(continuation)
Regressed by: 1510760

I wonder if this is an instance of the problem Nika brought up, where maybe we could have an xray wrapper and a waiver wrapper in the same compartment.

Assignee: nobody → continuation
Fission Milestone: --- → M4
Priority: -- → P2

The crash on 68 is going to be a different issue.

status-firefox68: affected → unaffected

Kris found crashes that look similar to this while he was working on getting mochitests working with Fission. One such test is dom/file/tests/test_mozfiledataurl.html

With bug 1559489 applied (that handles remote-to-local transplanting), that test fails the MOZ_ASSERT_IF(oldWaiver, GetNonCCWObjectRealm(oldWaiver) == GetNonCCWObjectRealm(origobj)); assertion in xpc::TransplantObject(), which supports the theory above that this is waiver related.

A few crashes only in 70, marking as fix-optional.

status-firefox70: affected → fix-optional
Depends on: 1559489
Blocks: fission-dogfooding

Closing because no crashes reported for 12 weeks.

Status: NEW → RESOLVED
Closed: 5 years ago
Resolution: --- → WORKSFORME
Has Regression Range: --- → yes
You need to log in before you can comment on or make changes to this bug.