Closed Bug 810560 Opened 12 years ago Closed 12 years ago

Intermittent Assertion failure: !thing->compartment()->scheduledForDestruction in test_bug518122.html [@ js::gc::MarkInternal]

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86_64
macOS
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla19
Tracking Flags:
Tracking Status
firefox18 --- unaffected

People

(Reporter: philor, Assigned: billm)

References

Details

(Keywords: assertion, intermittent-failure)

Attachments

(1 file)

fix
12.77 KB, patch
luke
: review+
Details | Diff | Splinter Review 
https://tbpl.mozilla.org/php/getParsedLog.php?id=16918272&tree=Mozilla-Inbound
Rev4 MacOSX Snow Leopard 10.6 mozilla-inbound debug test mochitest-1 on 2012-11-09 20:56:56 PST for push 98e22583895a
slave: talos-r4-snow-082

10916 INFO TEST-START | /tests/content/html/content/test/test_bug518122.html
++DOMWINDOW == 96 (0x14e026300) [serial = 2133] [outer = 0x12918d680]
Assertion failure: !thing->compartment()->scheduledForDestruction, at ../../../js/src/gc/Marking.cpp:92
[Child 357] WARNING: shutting down early because of crash!: file ../../../dom/ipc/ContentChild.cpp, line 813
[Child 357] WARNING: content process _exit()ing: file ../../../dom/ipc/ContentChild.cpp, line 858
TEST-UNEXPECTED-FAIL | /tests/content/html/content/test/test_bug518122.html | Exited with code 1 during test run
INFO | automation.py | Application ran for: 0:20:06.484813
INFO | automation.py | Reading PID log: /var/folders/Hs/HsDn6a9SG8idoIya6p9mtE+++TI/-Tmp-/tmp8wq0rdpidlog
Downloading symbols from: http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-inbound-macosx64-debug/1352521172/firefox-19.0a1.en-US.mac64.crashreporter-symbols.zip
PROCESS-CRASH | /tests/content/html/content/test/test_bug518122.html | application crashed (minidump found)
Crash dump filename: /var/folders/Hs/HsDn6a9SG8idoIya6p9mtE+++TI/-Tmp-/tmpxjqB02/minidumps/CBF78EE0-EAE0-49AE-AC6E-9CA0B95BA210.dmp
Operating system: Mac OS X
                  10.6.8 10K549
CPU: amd64
     family 6 model 23 stepping 10
     2 CPUs

Crash reason:  EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
Crash address: 0x0

Thread 0 (crashed)
 0  XUL!void js::gc::MarkInternal<JSObject>(JSTracer*, JSObject**) [Marking.cpp : 110 + 0x0]
    rbx = 0x00007fff701a72f8   r12 = 0x000000010549a2a8
    r13 = 0x000000010549a000   r14 = 0x0000000148fd5250
    r15 = 0x0000000107b92701   rip = 0x000000010392fec0
    rsp = 0x00007fff5fbfad00   rbp = 0x00007fff5fbfad30
    Found by: given as instruction pointer in context
 1  XUL!js::ObjectImpl::writeBarrierPre(js::ObjectImpl*) [ObjectImpl-inl.h : 438 + 0x16]
    rbx = 0x0000000148fd5250   r12 = 0x0000000000000000
    r13 = 0x000000014c5dbc00   r14 = 0x0000000100c59a00
    r15 = 0x0000000107b92701   rip = 0x00000001036c8ca4
    rsp = 0x00007fff5fbfad40   rbp = 0x00007fff5fbfad50
    Found by: call frame info
 2  XUL!js::IncrementalReferenceBarrier(void*) [jsfriendapi.cpp : 912 + 0x7]
    rbx = 0x0000000148fd5250   r12 = 0x0000000000000000
    r13 = 0x000000014c5dbc00   r14 = 0x0000000100c59a00
    r15 = 0x0000000107b92701   rip = 0x0000000103717af1
    rsp = 0x00007fff5fbfad60   rbp = 0x00007fff5fbfad80
    Found by: call frame info
 3  XUL!nsNodeSH::PreCreate(nsISupports*, JSContext*, JSObject*, JSObject**) [xpcpublic.h : 152 + 0x7]
    rbx = 0x00000001462bfc01   r12 = 0x0000000148fd5250
    r13 = 0x000000014c5dbc00   r14 = 0x000000014c5dbc08
    r15 = 0x0000000107b92740   rip = 0x00000001022e4890
    rsp = 0x00007fff5fbfad90   rbp = 0x00007fff5fbfae30
    Found by: call frame info
 4  XUL!nsElementSH::PreCreate(nsISupports*, JSContext*, JSObject*, JSObject**) [nsDOMClassInfo.cpp : 8144 + 0x4]
    rbx = 0x00000001462bfca8   r12 = 0x00007fff5fbfb570
    r13 = 0x00000001022e5a80   r14 = 0x0000000107b92740
    r15 = 0x00007fff5fbfb050   rip = 0x00000001022e55f5
    rsp = 0x00007fff5fbfae40   rbp = 0x00007fff5fbfae80
    Found by: call frame info
 5  XUL!ConstructSlimWrapper(XPCCallContext&, xpcObjectHelper&, XPCWrappedNativeScope*, JS::Value*) [XPCWrappedNative.cpp : 3814 + 0xc]
    rbx = 0x00000001462bfca8   r12 = 0x00007fff5fbfb570
    r13 = 0x00000001022e5a80   r14 = 0x000000010aabb060
    r15 = 0x00007fff5fbfb050   rip = 0x0000000102832854
    rsp = 0x00007fff5fbfae90   rbp = 0x00007fff5fbfaf40
    Found by: call frame info
 6  XUL!XPCConvert::NativeInterface2JSObject(XPCLazyCallContext&, JS::Value*, nsIXPConnectJSObjectHolder**, xpcObjectHelper&, nsID const*, XPCNativeInterface**, bool, tag_nsresult*) [XPCConvert.cpp : 875 + 0x15]
    rbx = 0x0000000000000000   r12 = 0x00007fff5fbfb280
    r13 = 0x0000000107b92748   r14 = 0x00007fff5fbfb270
Mmm, PreCreate.
Attached patch fix — — Splinter Review 
I think this should take care of the problem.
Assignee: general → wmccloskey
Status: NEW → ASSIGNED
Attachment #680784 - Flags: review?(luke)
Comment on attachment 680784 [details] [diff] [review]
fix

Review of attachment 680784 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jsapi.cpp
@@ +1556,5 @@
>      JS_ASSERT(origobj != target);
>      JS_ASSERT(!IsCrossCompartmentWrapper(origobj));
>      JS_ASSERT(!IsCrossCompartmentWrapper(target));
>  
> +    AutoDeadCompartmentGC agc(cx);

A "dead compartment GC" sounds like a different thing.  How about AutoMaybeTouchDeadCompartments?

::: js/src/jswrapper.h
@@ +299,5 @@
> + * This auto class should be used around any code, such as brain transplants,
> + * that may touch dead compartments. Brain transplants can cause problems
> + * because they operate on all compartments, whether live or dead. A brain
> + * transplant can cause a formerly dead object to be "reanimated" by causing a
> + * read or write barrier to be invoked on it during the transplant.

I would not be opposed to appending:
"In this way, a compartment becomes a zombie, kept alive by repeatedly consuming (transplanted) brains."

::: js/xpconnect/src/XPCWrappedNative.cpp
@@ +510,5 @@
>      mozilla::Maybe<JSAutoCompartment> ac;
>  
>      if (sciWrapper.GetFlags().WantPreCreate()) {
> +        // PreCreate may touch dead compartments.
> +        js::AutoDeadCompartmentGC agc(parent);

It seems like you'd want to scope 'agc' here (and below x2) as narrowly as possible to avoid unintended full GCs.  There is a lot of code below PreCreate, so perhaps you could either block-scope it or, if that looks ugly, use Maybe<> and call 'destruct' after.
Attachment #680784 - Flags: review?(luke) → review+
https://hg.mozilla.org/mozilla-central/rev/a10481c78d8e
https://hg.mozilla.org/mozilla-central/rev/866e9c7d656d
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla19
Blocks: 811587
Whiteboard: [orange]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: