1029549 - Intermittent browser_audionode-actor-get-param-flags.js | application crashed [@ js::gc::Cell::arenaHeader() const] (after: "Assertion failure: isTenured(), at js/src/gc/Heap.h:1001")

Status: RESOLVED WORKSFORME

(Core :: JavaScript: GC, defect)

Description

[Ed Morley [:emorley]]

Ubuntu VM 12.04 mozilla-inbound debug test mochitest-devtools-chrome-3 on 2014-06-24 05:40:47 PDT for push f90e81750943

slave: tst-linux32-spot-343

https://tbpl.mozilla.org/php/getParsedLog.php?id=42353484&tree=Mozilla-Inbound

{
06:02:26     INFO -  [1765] WARNING: NS_ENSURE_SUCCESS(EnsureScriptEnvironment(), nullptr) failed with result 0x80040111: file /builds/slave/m-in-lx-d-00000000000000000000/build/docshell/base/nsDocShell.cpp, line 4147
06:02:26     INFO -  [1765] WARNING: NS_ENSURE_SUCCESS(EnsureScriptEnvironment(), nullptr) failed with result 0x80040111: file /builds/slave/m-in-lx-d-00000000000000000000/build/docshell/base/nsDocShell.cpp, line 4147
06:02:26     INFO -  [1765] WARNING: NS_ENSURE_SUCCESS(EnsureScriptEnvironment(), nullptr) failed with result 0x80040111: file /builds/slave/m-in-lx-d-00000000000000000000/build/docshell/base/nsDocShell.cpp, line 4147
06:02:26     INFO -  [1765] WARNING: NS_ENSURE_SUCCESS(EnsureScriptEnvironment(), nullptr) failed with result 0x80040111: file /builds/slave/m-in-lx-d-00000000000000000000/build/docshell/base/nsDocShell.cpp, line 4147
06:02:26     INFO -  [1765] WARNING: NS_ENSURE_SUCCESS(EnsureScriptEnvironment(), nullptr) failed with result 0x80040111: file /builds/slave/m-in-lx-d-00000000000000000000/build/docshell/base/nsDocShell.cpp, line 4147
06:02:27     INFO -  [1765] WARNING: NS_ENSURE_SUCCESS(EnsureScriptEnvironment(), nullptr) failed with result 0x80040111: file /builds/slave/m-in-lx-d-00000000000000000000/build/docshell/base/nsDocShell.cpp, line 4147
06:02:27     INFO -  [1765] WARNING: NS_ENSURE_SUCCESS(EnsureScriptEnvironment(), nullptr) failed with result 0x80040111: file /builds/slave/m-in-lx-d-00000000000000000000/build/docshell/base/nsDocShell.cpp, line 4147
06:02:27     INFO -  [1765] WARNING: NS_ENSURE_SUCCESS(EnsureScriptEnvironment(), nullptr) failed with result 0x80040111: file /builds/slave/m-in-lx-d-00000000000000000000/build/docshell/base/nsDocShell.cpp, line 4147
06:02:27     INFO -  [1765] WARNING: NS_ENSURE_SUCCESS(EnsureScriptEnvironment(), nullptr) failed with result 0x80040111: file /builds/slave/m-in-lx-d-00000000000000000000/build/docshell/base/nsDocShell.cpp, line 4147
06:02:27     INFO -  [1765] WARNING: NS_ENSURE_SUCCESS(EnsureScriptEnvironment(), nullptr) failed with result 0x80040111: file /builds/slave/m-in-lx-d-00000000000000000000/build/docshell/base/nsDocShell.cpp, line 4147
06:02:27     INFO -  [1765] WARNING: NS_ENSURE_SUCCESS(EnsureScriptEnvironment(), nullptr) failed with result 0x80040111: file /builds/slave/m-in-lx-d-00000000000000000000/build/docshell/base/nsDocShell.cpp, line 4147
06:02:27     INFO -  TEST-INFO | chrome://mochitests/content/browser/browser/devtools/webaudioeditor/test/browser_audionode-actor-get-param-flags.js | Removing tab.
06:02:27     INFO -  TEST-INFO | chrome://mochitests/content/browser/browser/devtools/webaudioeditor/test/browser_audionode-actor-get-param-flags.js | Tab removed and finished closing.
06:02:27     INFO -  [1765] WARNING: NS_ENSURE_TRUE(mMutable) failed: file /builds/slave/m-in-lx-d-00000000000000000000/build/netwerk/base/src/nsSimpleURI.cpp, line 265
06:02:27     INFO -  TEST-INFO | chrome://mochitests/content/browser/browser/devtools/webaudioeditor/test/browser_audionode-actor-get-param-flags.js | finish() was called, cleaning up...
06:02:27     INFO -  Assertion failure: isTenured(), at /builds/slave/m-in-lx-d-00000000000000000000/build/js/src/gc/Heap.h:1001
06:02:29     INFO -  TEST-INFO | Main app process: killed by SIGSEGV
06:02:29  WARNING -  TEST-UNEXPECTED-FAIL | chrome://mochitests/content/browser/browser/devtools/webaudioeditor/test/browser_audionode-actor-get-param-flags.js | application terminated with exit code 11
06:02:29     INFO -  INFO | runtests.py | Application ran for: 0:19:43.643997
06:02:29     INFO -  INFO | zombiecheck | Reading PID log: /tmp/tmpEMYgD1pidlog
06:02:42  WARNING -  PROCESS-CRASH | chrome://mochitests/content/browser/browser/devtools/webaudioeditor/test/browser_audionode-actor-get-param-flags.js | application crashed [@ js::gc::Cell::arenaHeader() const]
06:02:42     INFO -  Crash dump filename: /tmp/tmpzJA3Q_/minidumps/49263c83-4a40-a8cf-28e711c0-600d8d2e.dmp
06:02:42     INFO -  Operating system: Linux
06:02:42     INFO -                    0.0.0 Linux 3.2.0-23-generic-pae #36-Ubuntu SMP Tue Apr 10 22:19:09 UTC 2012 i686
06:02:42     INFO -  CPU: x86
06:02:42     INFO -       GenuineIntel family 6 model 45 stepping 7
06:02:42     INFO -       1 CPU
06:02:42     INFO -  Crash reason:  SIGSEGV
06:02:42     INFO -  Crash address: 0x0
06:02:42     INFO -  Thread 0 (crashed)
06:02:42     INFO -   0  libxul.so!js::gc::Cell::arenaHeader() const [Heap.h:f90e81750943 : 1001 + 0x18]
06:02:42     INFO -      eip = 0xb4be6afc   esp = 0xbf9e1ff0   ebp = 0xbf9e2008   ebx = 0xb6da5980
06:02:42     INFO -      esi = 0xaceffff0   edi = 0x000000ef   eax = 0x00000000   ecx = 0xb76518ac
06:02:42     INFO -      edx = 0x00000000   efl = 0x00210282
06:02:42     INFO -      Found by: given as instruction pointer in context
06:02:42     INFO -   1  libxul.so!js::gc::GCRuntime::beginMarkPhase() [Heap.h:f90e81750943 : 1063 + 0x1a]
06:02:42     INFO -      eip = 0xb4bfd995   esp = 0xbf9e2010   ebp = 0xbf9e20f8   ebx = 0xb6da5980
06:02:42     INFO -      esi = 0xaceffff0   edi = 0x000000ef
06:02:42     INFO -      Found by: call frame info
06:02:42     INFO -   2  libxul.so!js::gc::GCRuntime::incrementalCollectSlice(long long, JS::gcreason::Reason, js::JSGCInvocationKind) [jsgc.cpp:f90e81750943 : 4735 + 0x7]
06:02:42     INFO -      eip = 0xb4c09d20   esp = 0xbf9e2100   ebp = 0xbf9e2178   ebx = 0xb6da5980
06:02:42     INFO -      esi = 0xadfd81cc   edi = 0xbf9e2144
06:02:42     INFO -      Found by: call frame info
06:02:42     INFO -   3  libxul.so!js::gc::GCRuntime::gcCycle(bool, long long, js::JSGCInvocationKind, JS::gcreason::Reason) [jsgc.cpp:f90e81750943 : 4928 + 0x23]
06:02:42     INFO -      eip = 0xb4c0a9cd   esp = 0xbf9e2180   ebp = 0xbf9e2208   ebx = 0xb6da5980
06:02:42     INFO -      esi = 0xadfd81cc   edi = 0x00000000
06:02:42     INFO -      Found by: call frame info
06:02:42     INFO -   4  libxul.so!js::gc::GCRuntime::collect(bool, long long, js::JSGCInvocationKind, JS::gcreason::Reason) [jsgc.cpp:f90e81750943 : 5084 + 0x27]
06:02:42     INFO -      eip = 0xb4c0adaa   esp = 0xbf9e2210   ebp = 0xbf9e22b8   ebx = 0xb6da5980
06:02:42     INFO -      esi = 0xadfd81cc   edi = 0xadfd8438
06:02:42     INFO -      Found by: call frame info
06:02:42     INFO -   5  libxul.so!js::GC(JSRuntime*, js::JSGCInvocationKind, JS::gcreason::Reason) [jsgc.cpp:f90e81750943 : 5115 + 0x2d]
06:02:42     INFO -      eip = 0xb4c0b566   esp = 0xbf9e22c0   ebp = 0xbf9e22e8   ebx = 0xb6da5980
06:02:42     INFO -      esi = 0xadfd8000   edi = 0xbf9e2370
06:02:42     INFO -      Found by: call frame info
06:02:42     INFO -   6  libxul.so!JS::GCForReason(JSRuntime*, JS::gcreason::Reason) [jsfriendapi.cpp:f90e81750943 : 190 + 0x17]
06:02:42     INFO -      eip = 0xb4bd4e7e   esp = 0xbf9e22f0   ebp = 0xbf9e2308   ebx = 0xb6da5980
06:02:42     INFO -      esi = 0xadfd8000   edi = 0xbf9e2370
06:02:42     INFO -      Found by: call frame info
}

Comment 1

[Legacy TBPL/Treeherder Robot]

Tomcat
https://tbpl.mozilla.org/php/getParsedLog.php?id=42423378&tree=Mozilla-Inbound
Ubuntu VM 12.04 mozilla-inbound debug test mochitest-devtools-chrome-3 on 2014-06-25 00:41:40
revision: a10da316a35f
slave: tst-linux32-spot-166

Assertion failure: isTenured(), at /builds/slave/m-in-lx-d-00000000000000000000/build/js/src/gc/Heap.h:1001
TEST-UNEXPECTED-FAIL | chrome://mochitests/content/browser/browser/devtools/webaudioeditor/test/browser_audionode-actor-get-param-flags.js | application terminated with exit code 11
PROCESS-CRASH | chrome://mochitests/content/browser/browser/devtools/webaudioeditor/test/browser_audionode-actor-get-param-flags.js | application crashed [@ js::gc::Cell::arenaHeader() const]
Return code: 1

Comment 2

[Legacy TBPL/Treeherder Robot]

Tomcat
https://tbpl.mozilla.org/php/getParsedLog.php?id=42434177&tree=Mozilla-Inbound
Ubuntu VM 12.04 mozilla-inbound debug test mochitest-devtools-chrome-3 on 2014-06-25 03:20:55
revision: 7bbedf6937aa
slave: tst-linux32-spot-365

Assertion failure: isTenured(), at /builds/slave/m-in-lx-d-00000000000000000000/build/js/src/gc/Heap.h:1001
TEST-UNEXPECTED-FAIL | chrome://mochitests/content/browser/browser/devtools/webaudioeditor/test/browser_audionode-actor-get-param-flags.js | application terminated with exit code 11
PROCESS-CRASH | chrome://mochitests/content/browser/browser/devtools/webaudioeditor/test/browser_audionode-actor-get-param-flags.js | application crashed [@ js::gc::Cell::arenaHeader() const]
Return code: 1

Comment 3

[Legacy TBPL/Treeherder Robot]

KWierso
https://tbpl.mozilla.org/php/getParsedLog.php?id=42480335&tree=Fx-Team
Ubuntu VM 12.04 fx-team debug test mochitest-devtools-chrome-3 on 2014-06-25 15:47:37
revision: 6929caed9dc4
slave: tst-linux32-spot-690

Assertion failure: isTenured(), at /builds/slave/fx-team-lx-d-00000000000000000/build/js/src/gc/Heap.h:1001
TEST-UNEXPECTED-FAIL | chrome://mochitests/content/browser/browser/devtools/webaudioeditor/test/browser_audionode-actor-get-param-flags.js | application terminated with exit code 11
PROCESS-CRASH | chrome://mochitests/content/browser/browser/devtools/webaudioeditor/test/browser_audionode-actor-get-param-flags.js | application crashed [@ js::gc::Cell::arenaHeader() const]
Return code: 1

Comment 4

[Legacy TBPL/Treeherder Robot]

Tomcat
https://tbpl.mozilla.org/php/getParsedLog.php?id=42622751&tree=Mozilla-Inbound
Ubuntu VM 12.04 mozilla-inbound debug test mochitest-devtools-chrome-3 on 2014-06-27 05:12:24
revision: 7e8a25258eb9
slave: tst-linux32-spot-220

Assertion failure: isTenured(), at /builds/slave/m-in-lx-d-00000000000000000000/build/js/src/gc/Heap.h:1001
TEST-UNEXPECTED-FAIL | chrome://mochitests/content/browser/browser/devtools/webaudioeditor/test/browser_audionode-actor-get-param-flags.js | application terminated with exit code 11
PROCESS-CRASH | chrome://mochitests/content/browser/browser/devtools/webaudioeditor/test/browser_audionode-actor-get-param-flags.js | application crashed [@ js::gc::Cell::arenaHeader() const]
Return code: 1

Comment 5

[Legacy TBPL/Treeherder Robot]

Tomcat
https://tbpl.mozilla.org/php/getParsedLog.php?id=43317118&tree=B2g-Inbound
Ubuntu VM 12.04 b2g-inbound debug test mochitest-devtools-chrome-3 on 2014-07-07 23:47:26
revision: 5944f23a2178
slave: tst-linux32-spot-300

Assertion failure: isTenured(), at /builds/slave/b2g-in-lx-d-000000000000000000/build/js/src/gc/Heap.h:1000
TEST-UNEXPECTED-FAIL | chrome://mochitests/content/browser/browser/devtools/webaudioeditor/test/browser_audionode-actor-get-param-flags.js | application terminated with exit code 11
PROCESS-CRASH | chrome://mochitests/content/browser/browser/devtools/webaudioeditor/test/browser_audionode-actor-get-param-flags.js | application crashed [@ js::gc::Cell::arenaHeader() const]

Comment 6

[Legacy TBPL/Treeherder Robot]

KWierso
https://tbpl.mozilla.org/php/getParsedLog.php?id=44141245&tree=Mozilla-Inbound
Windows XP 32-bit mozilla-inbound debug test mochitest-devtools-chrome-2 on 2014-07-18 14:19:51
revision: 51b6fd0998d8
slave: t-xp32-ix-012

1415 INFO Assertion failure: isEmpty(), at c:\builds\moz2_slave\m-in-w32-d-0000000000000000000\build\obj-firefox\dist\include\mozilla/LinkedList.h:305
1521 INFO TEST-UNEXPECTED-FAIL | chrome://mochitests/content/browser/browser/devtools/inspector/test/browser_inspector_infobar_02.js | application terminated with exit code 2147483651
PROCESS-CRASH | chrome://mochitests/content/browser/browser/devtools/inspector/test/browser_inspector_infobar_02.js | application crashed [@ js::gc::Cell::arenaHeader()]
Return code: 1

Comment 7

[Legacy TBPL/Treeherder Robot]

jorendorff
https://tbpl.mozilla.org/php/getParsedLog.php?id=44167453&tree=Try
Rev5 MacOSX Mountain Lion 10.8 try debug test mochitest-devtools-chrome-1 on 2014-07-18 21:04:55
revision: 095324865e88
slave: talos-mtnlion-r5-004

14909 INFO TEST-UNEXPECTED-FAIL | chrome://mochitests/content/browser/browser/devtools/debugger/test/browser_dbg_variables-view-edit-getset-01.js | application terminated with exit code 1
PROCESS-CRASH | chrome://mochitests/content/browser/browser/devtools/debugger/test/browser_dbg_variables-view-edit-getset-01.js | application crashed [@ js::gc::Cell::arenaHeader() const]
Return code: 1

Comment 8

[Legacy TBPL/Treeherder Robot]

jorendorff
https://tbpl.mozilla.org/php/getParsedLog.php?id=44186309&tree=Try
Rev5 MacOSX Mountain Lion 10.8 try debug test mochitest-devtools-chrome-1 on 2014-07-19 06:17:23
revision: 2ab212cbff92
slave: talos-mtnlion-r5-004

14913 INFO TEST-UNEXPECTED-FAIL | chrome://mochitests/content/browser/browser/devtools/debugger/test/browser_dbg_variables-view-edit-getset-01.js | application terminated with exit code 1
PROCESS-CRASH | chrome://mochitests/content/browser/browser/devtools/debugger/test/browser_dbg_variables-view-edit-getset-01.js | application crashed [@ js::gc::Cell::arenaHeader() const]
Return code: 1

Comment 9

[Legacy TBPL/Treeherder Robot]

philor
https://tbpl.mozilla.org/php/getParsedLog.php?id=48093783&tree=B2g-Inbound
Rev4 MacOSX Snow Leopard 10.6 b2g-inbound debug test mochitest-browser-chrome-1 on 2014-09-15 06:40:47
revision: cb23604875d1
slave: t-snow-r4-0029

Assertion failure: isTenured(), at /builds/slave/b2g-in-osx64-d-000000000000000/build/js/src/gc/Heap.h:1064
TEST-UNEXPECTED-FAIL | ShutdownLeaks | process() called before end of test suite
1366 ERROR TEST-UNEXPECTED-FAIL | chrome://mochitests/content/browser/browser/components/tabview/test/browser_tabview_bug587351.js | application terminated with exit code 1
PROCESS-CRASH | chrome://mochitests/content/browser/browser/components/tabview/test/browser_tabview_bug587351.js | application crashed [@ js::gc::Cell::arenaHeader() const]
Return code: 1

Comment 10

[Terrence Cole [:terrence]]

The crash here is happening because the Chunk's "location" field is 0 instead of tenured or nursery. The marking is for a Shape's Getter or Setter object out of the CC's visitChildren on a JSObject. This would indicate that one of those objects is dead or corrupt, or that the shape's property flags are out of sync with reality.

Comment 11

[Legacy TBPL/Treeherder Robot]

Tomcat
https://tbpl.mozilla.org/php/getParsedLog.php?id=48263511&tree=Mozilla-Inbound
Windows 7 32-bit mozilla-inbound debug test mochitest-2 on 2014-09-16 23:07:00
revision: f4123c7172ee
slave: t-w732-ix-023

Assertion failure: isTenured(), at c:\builds\moz2_slave\m-in-w32-d-0000000000000000000\build\js\src\gc/Heap.h:1064
2360 ERROR TEST-UNEXPECTED-FAIL | /tests/dom/indexedDB/test/test_webapp_clearBrowserData_inproc_inproc.html | application terminated with exit code 2147483651
PROCESS-CRASH | /tests/dom/indexedDB/test/test_webapp_clearBrowserData_inproc_inproc.html | application crashed [@ js::gc::Cell::arenaHeader()]
Return code: 1

Comment 12

[Terrence Cole [:terrence]]

Attachment: sanity_check_TenuredHeap_on_access-v0.diff

We're falling over here either when we access the arena header or the chunk trailer -- it's hard to tell with the inlining. What we do know is that it is on a TenuredHeap in the wrapper cache (XPCWN). This patch puts the same sanity checks we make when accessing the arenaHeader into getPtr. At the very least this will move the crash up the stack.

Comment 13

[Jon Coppeard (:jonco)]

Comment on attachment 8491648 [details] [diff] [review]
sanity_check_TenuredHeap_on_access-v0.diff

Review of attachment 8491648 [details] [diff] [review]:
-----------------------------------------------------------------

r=me.

Comment 14

[Terrence Cole [:terrence]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/b7f417116d90

Comment 15

[Terrence Cole [:terrence]]

And that really should not have turned the tree orange. This should be fun.
https://hg.mozilla.org/integration/mozilla-inbound/rev/8e6e924ff00b

Comment 16

[Terrence Cole [:terrence]]

I forgot that we don't null-check anywhere on that path. Derp!

Comment 17

[Andrew McCreight [:mccr8]]

Looks like this is fixed.

Comment 18

[Firefox Bug Husbandry Bot]

Removing leave-open keyword from resolved bugs, per :sylvestre.