Confusing-to-reproduce crash in WPT dom/nodes/ParentNode-querySelector-All-xht.xht

[pshaughn]

The crash is happening on either foundall = root.querySelectorAll(q); or assert_not_equals(foundall, null, "The method should not return null.") during runValidSelectorTest("Document", doc, validSelectors, testType, docType); It happens most of the time when I am running headless.

The confusing thing is that if I change the loop for(var i=0; i < selectors.length; i++) to only go over the first half of selectors, or only the second half, the test doesn't crash. The crash only happens when I'm using lots and lots of query selectors in a row, not reliably for any individual one, suggesting perhaps some unsafe operation is slightly wrong in a way that can add up to a memory problem.

I get no stacktrace.

[jdm]

Any difference if you run the test inside a debugger with --debugger?

[pshaughn]

Answered in IRC, repeating here to keep it visible: It doesn't crash when I do that.

[jdm]

I wonder if you're hitting a long-enough running script in a debug build that the hang detector kicks in, then tries to capture a backtrace and segfaults inside libbacktrace :<

[pshaughn]

Probably #24984; I'll retest to make sure.

[pshaughn]

No longer reproducing.