Closed Bug 937191 Opened 11 years ago Closed 11 years ago

crash in js::CompartmentChecker::fail(JSCompartment*, JSCompartment*)

Categories

(Core :: DOM: Workers, defect)

Product:
Core
Component:
DOM: Workers
Version:
28 Branch
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
VERIFIED DUPLICATE of bug 936327
Tracking Flags:
Tracking Status
firefox26 --- unaffected
firefox27 --- unaffected
firefox28 --- affected
firefox-esr24 --- unaffected
b2g18 --- unaffected

People

(Reporter: tracy, Unassigned)

References

Details

(Keywords: crash, regression, sec-high, Whiteboard: [sg:dupe 936327])

This bug was filed from the Socorro interface and is report bp-95de096e-f798-41f7-bd57-50ad42131111. ============================================================= This began to increase in volume on 20131106 (10x previous volume). Then increase another 6 (20131107) to 9 (20131110) fold after that. This occurs mostly on Windows, with a several crashes on Mac. Most interesting is that nearly all of these crashes happen a matter of seconds after the browser has been up for 1 hour. 0 mozjs.dll js::CompartmentChecker::fail(JSCompartment *,JSCompartment *) js/src/jscntxtinlines.h 1 mozjs.dll JS_CallFunctionValue(JSContext *,JSObject *,JS::Value,unsigned int,JS::Value *,JS::Value *) js/src/jsapi.cpp 2 xul.dll mozilla::dom::workers::WorkerPrivate::RunExpiredTimeouts(JSContext *) dom/workers/WorkerPrivate.cpp 3 xul.dll `anonymous namespace'::TimerRunnable::WorkerRun(JSContext *,mozilla::dom::workers::WorkerPrivate *) dom/workers/WorkerPrivate.cpp 4 xul.dll mozilla::dom::workers::WorkerRunnable::Run() dom/workers/WorkerPrivate.cpp 5 xul.dll CallQueryInterface<nsIHTMLCollection,nsIDOMNodeList>(nsIHTMLCollection *,nsIDOMNodeList * *) obj-firefox/dist/include/nsISupportsUtils.h 6 xul.dll mozilla::dom::workers::WorkerPrivate::DoRunLoop(JSContext *) dom/workers/WorkerPrivate.cpp 7 xul.dll JSAutoRequest::JSAutoRequest(JSContext *) obj-firefox/dist/include/jsapi.h 8 xul.dll `anonymous namespace'::WorkerThreadRunnable::Run() dom/workers/RuntimeService.cpp 9 xul.dll nsThread::ProcessNextEvent(bool,bool *) xpcom/threads/nsThread.cpp 10 xul.dll nsThread::ThreadFunc(void *) xpcom/threads/nsThread.cpp 11 nss3.dll _PR_NativeRunThread nsprpub/pr/src/threads/combined/pruthr.c 12 nss3.dll pr_root nsprpub/pr/src/md/windows/w95thred.c 13 msvcr100.dll _callthreadstartex f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\threadex.c 14 msvcr100.dll _threadstartex f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\threadex.c 15 kernel32.dll BaseThreadStart
Group: core-security
The stack is very similar to bug 936327, so this is either the same bug, or another regression from bug 928312.
Component: JavaScript Engine → DOM: Workers
Keywords: sec-high
the fix for bug 928312 does fit the regression range.
Blocks: 928312
status-b2g18: unaffected → ---
status-firefox26: unaffected → ---
status-firefox27: unaffected → ---
status-firefox28: affected → ---
status-firefox-esr24: unaffected → ---
Component: DOM: Workers → JavaScript Engine
Keywords: topcrash-win
status-b2g18: --- → unaffected
status-firefox26: --- → unaffected
status-firefox27: --- → unaffected
status-firefox28: --- → affected
status-firefox-esr24: --- → unaffected
Component: JavaScript Engine → DOM: Workers
ack, sorry.
Yeah this is almost certainly a dupe.
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → DUPLICATE
moved the crash signature to the dupe.
Status: RESOLVED → VERIFIED
Crash Signature: [@ js::CompartmentChecker::fail(JSCompartment*, JSCompartment*)]
Keywords: topcrash-win
Group: core-security
Whiteboard: [sg:dupe 936327]
You need to log in before you can comment on or make changes to this bug.