Closed Bug 1054648 Opened 11 years ago Closed 10 years ago

Intermittent test_pathAnimInterpolation.xhtml | application crashed [@ mozilla::CycleCollectedJSRuntime::FixWeakMappingGrayBits() const] after "Assertion failure: !JS::IsIncrementalGCInProgress(mJSRuntime) (Don't call FixWeakMappingGrayBits during a GC.)"

Categories

(Core :: XPCOM, defect)

ARM
Android
defect
Not set
normal

Tracking

()

RESOLVED WORKSFORME
Tracking Status
e10s - ---

People

(Reporter: RyanVM, Assigned: mccr8)

References

Details

(Keywords: assertion, crash, intermittent-failure)

https://tbpl.mozilla.org/php/getParsedLog.php?id=46099674&tree=Mozilla-Inbound Android 4.0 Panda mozilla-inbound debug test mochitest-3 on 2014-08-16 05:34:20 PDT for push 6b62b011c53a slave: panda-0515 06:13:57 INFO - 645 INFO TEST-START | /tests/content/svg/content/test/test_pathAnimInterpolation.xhtml 06:13:57 INFO - INFO | automation.py | Application ran for: 0:28:08.603046 06:13:57 INFO - INFO | zombiecheck | Reading PID log: /tmp/tmpEzcxi9pidlog 06:13:58 INFO - Contents of /data/anr/traces.txt: 06:13:58 INFO - /data/tombstones does not exist; tombstone check skipped 06:13:59 INFO - 646 INFO mozcrash Downloading symbols from: https://ftp-ssl.mozilla.org/pub/mozilla.org/mobile/tinderbox-builds/mozilla-inbound-android-debug/1408190836/fennec-34.0a1.en-US.android-arm.crashreporter-symbols.zip 06:14:04 INFO - 647 INFO mozcrash Saved minidump as /builds/panda-0515/test/build/blobber_upload_dir/17de09ba-0191-2cb6-65f86722-698af2fc.dmp 06:14:04 INFO - 648 INFO mozcrash Saved app info as /builds/panda-0515/test/build/blobber_upload_dir/17de09ba-0191-2cb6-65f86722-698af2fc.extra 06:14:04 WARNING - PROCESS-CRASH | /tests/content/svg/content/test/test_pathAnimInterpolation.xhtml | application crashed [@ mozilla::CycleCollectedJSRuntime::FixWeakMappingGrayBits() const] 06:14:04 INFO - Crash dump filename: /tmp/tmpeajH2d/17de09ba-0191-2cb6-65f86722-698af2fc.dmp 06:14:04 INFO - Operating system: Android 06:14:04 INFO - 0.0.0 Linux 3.2.0+ #2 SMP PREEMPT Thu Nov 29 08:06:57 EST 2012 armv7l pandaboard/pandaboard/pandaboard:4.0.4/IMM76I/5:eng/test-keys 06:14:04 INFO - CPU: arm 06:14:04 INFO - 2 CPUs 06:14:04 INFO - Crash reason: SIGSEGV 06:14:04 INFO - Crash address: 0x0 06:14:04 INFO - Thread 13 (crashed) 06:14:04 INFO - 0 libxul.so!mozilla::CycleCollectedJSRuntime::FixWeakMappingGrayBits() const [CycleCollectedJSRuntime.cpp:6b62b011c53a : 1014 + 0x14] 06:14:04 INFO - r4 = 0x5c356000 r5 = 0x00000000 r6 = 0x5c3b4000 r7 = 0x00000000 06:14:04 INFO - r8 = 0x00000000 r9 = 0x00000001 r10 = 0x00000000 fp = 0x00000000 06:14:04 INFO - sp = 0x5d941738 lr = 0x62a83e33 pc = 0x62a87c28 06:14:04 INFO - Found by: given as instruction pointer in context 06:14:04 INFO - 1 libxul.so!nsCycleCollector::FixGrayBits(bool) [nsCycleCollector.cpp:6b62b011c53a : 3467 + 0x3] 06:14:04 INFO - r4 = 0x5c3b4000 r5 = 0x00000000 r6 = 0x5c3b4000 r7 = 0x00000000 06:14:04 INFO - r8 = 0x00000000 r9 = 0x00000001 r10 = 0x00000000 fp = 0x00000000 06:14:04 INFO - sp = 0x5d941750 pc = 0x62a88b79 06:14:04 INFO - Found by: call frame info 06:14:04 INFO - 2 libxul.so!nsCycleCollector::BeginCollection(ccType, nsICycleCollectorListener*) [nsCycleCollector.cpp:6b62b011c53a : 3731 + 0x9] 06:14:04 INFO - r4 = 0x5c3b4078 r5 = 0x00000000 r6 = 0x5c3b4000 r7 = 0x00000000 06:14:04 INFO - r8 = 0x00000000 r9 = 0x00000001 r10 = 0x00000000 fp = 0x00000000 06:14:04 INFO - sp = 0x5d941768 pc = 0x62a93b47 06:14:04 INFO - Found by: call frame info 06:14:04 INFO - 3 libxul.so!nsCycleCollector::Collect(ccType, js::SliceBudget&, nsICycleCollectorListener*) [nsCycleCollector.cpp:6b62b011c53a : 3574 + 0x9] 06:14:04 INFO - r4 = 0xffffffff r5 = 0x7fffffff r6 = 0x5c3b4000 r7 = 0x00000000 06:14:04 INFO - r8 = 0x5d9417d8 r9 = 0x00000001 r10 = 0x00000000 fp = 0x00000000 06:14:04 INFO - sp = 0x5d9417a8 pc = 0x62a93d75 06:14:04 INFO - Found by: call frame info 06:14:04 INFO - 4 libxul.so!nsCycleCollector_collectSlice(long long) [nsCycleCollector.cpp:6b62b011c53a : 4180 + 0xf] 06:14:04 INFO - r4 = 0x5d9417e8 r5 = 0x00000000 r6 = 0x5d9417d8 r7 = 0x5c32c1d0 06:14:04 INFO - r8 = 0x00000000 r9 = 0x5d94190f r10 = 0x00000001 fp = 0x5c33d784 06:14:04 INFO - sp = 0x5d9417d0 pc = 0x62a93f77 06:14:04 INFO - Found by: call frame info 06:14:04 INFO - 5 libxul.so!nsJSContext::RunCycleCollectorSlice() [nsJSEnvironment.cpp:6b62b011c53a : 1966 + 0x7] 06:14:04 INFO - r4 = 0x00000004 r5 = 0x64c86c70 r6 = 0x64c86cc8 r7 = 0x00000001 06:14:04 INFO - r8 = 0x00000000 r9 = 0x5d94190f r10 = 0x00000001 fp = 0x5c33d784 06:14:04 INFO - sp = 0x5d941810 pc = 0x6303bcff 06:14:04 INFO - Found by: call frame info 06:14:09 INFO - 08-16 06:13:45.437 F/MOZ_Assert( 2264): Assertion failure: !JS::IsIncrementalGCInProgress(mJSRuntime) (Don't call FixWeakMappingGrayBits during a GC.), at /builds/slave/m-in-and-d-0000000000000000000/build/xpcom/base/CycleCollectedJSRuntime.cpp:1015
I should look at this at some point...
Assignee: nobody → continuation
(In reply to Andrew McCreight [:mccr8] from comment #41) > I should look at this at some point... Pretty please? :)
Flags: needinfo?(continuation)
Somehow we're in the middle of an incremental GC when we decide to start a CC. My guess is that either the logic in nsJSEnvironment that is supposed to shut down any GC before we start a CC isn't working, or somehow we're starting up a new GC after we enter the CC. I could probably add some more assertions to this effect. It is also possible that mCCLockedOut isn't right for some reason, so we don't realize a GC is running.
Yeah, I don't really have any ideas here, sorry. :(
Flags: needinfo?(continuation)
Also happening on b2g during scrolling in the mail app: Program received signal SIGSEGV, Segmentation fault. 0xb45a0434 in mozilla::CycleCollectedJSRuntime::FixWeakMappingGrayBits (this=<optimized out>) at ../../../xpcom/base/CycleCollectedJSRuntime.cpp:1006 1006 MOZ_ASSERT(!JS::IsIncrementalGCInProgress(mJSRuntime), (gdb) bt #0 0xb45a0434 in mozilla::CycleCollectedJSRuntime::FixWeakMappingGrayBits (this=<optimized out>) at ../../../xpcom/base/CycleCollectedJSRuntime.cpp:1006 #1 0xb45a0f58 in nsCycleCollector::FixGrayBits (this=this@entry=0xb376f000, aForceGC=<optimized out>) at ../../../xpcom/base/nsCycleCollector.cpp:3480 #2 0xb45a8c12 in nsCycleCollector::BeginCollection (this=this@entry=0xb376f000, aCCType=aCCType@entry=SliceCC, aManualListener=aManualListener@entry=0x0) at ../../../xpcom/base/nsCycleCollector.cpp:3755 #3 0xb45a925e in Collect (aPreferShorterSlices=true, aManualListener=0x0, aBudget=..., aCCType=SliceCC, this=0xb376f000) at ../../../xpcom/base/nsCycleCollector.cpp:3588 #4 nsCycleCollector::Collect (this=0xb376f000, aCCType=SliceCC, aBudget=..., aManualListener=0x0, aPreferShorterSlices=true) at ../../../xpcom/base/nsCycleCollector.cpp:3557 #5 0xb45a93aa in nsCycleCollector_collectSlice (budget=..., aPreferShorterSlices=<optimized out>) at ../../../xpcom/base/nsCycleCollector.cpp:4115 #6 0xb4c3baba in RunCycleCollectorSlice () at ../../../dom/base/nsJSEnvironment.cpp:1550 #7 nsJSContext::RunCycleCollectorSlice () at ../../../dom/base/nsJSEnvironment.cpp:1520 #8 0xb4c3bb8e in CCTimerFired (aTimer=<optimized out>, aClosure=<optimized out>) at ../../../dom/base/nsJSEnvironment.cpp:1885 #9 CCTimerFired (aTimer=<optimized out>, aClosure=<optimized out>) at ../../../dom/base/nsJSEnvironment.cpp:1838 #10 0xb45dda54 in nsTimerImpl::Fire (this=0xaef4ace0) at ../../../xpcom/threads/nsTimerImpl.cpp:631 #11 0xb45ddc06 in nsTimerEvent::Run (this=0xb1f06090) at ../../../xpcom/threads/nsTimerImpl.cpp:724 #12 0xb45dab4c in nsThread::ProcessNextEvent (this=0xb375b180, aMayWait=<optimized out>, aResult=0xbea0aeff) at ../../../xpcom/threads/nsThread.cpp:855 #13 0xb45f07c8 in NS_ProcessNextEvent (aThread=0xb375b180, aMayWait=aMayWait@entry=false) at /Volumes/mac/moz/ib2g/xpcom/glue/nsThreadUtils.cpp:265 #14 0xb47a8ae4 in mozilla::ipc::MessagePump::Run (this=0xb37075c8, aDelegate=0xbea0b058) at ../../../ipc/glue/MessagePump.cpp:99 #15 0xb4794618 in MessageLoop::RunInternal (this=this@entry=0xbea0b058) at ../../../ipc/chromium/src/base/message_loop.cc:233 #16 0xb4794632 in RunHandler (this=0xbea0b058) at ../../../ipc/chromium/src/base/message_loop.cc:226 #17 MessageLoop::Run (this=0xbea0b058) at ../../../ipc/chromium/src/base/message_loop.cc:200 #18 0xb5473932 in nsBaseAppShell::Run (this=0xb216bc20) at ../../widget/nsBaseAppShell.cpp:164 #19 0xb58eb14c in XRE_RunAppShell () at ../../../toolkit/xre/nsEmbedFunctions.cpp:743 #20 0xb47a8c1a in mozilla::ipc::MessagePumpForChildProcess::Run (this=0xb37075c8, aDelegate=0xbea0b058) at ../../../ipc/glue/MessagePump.cpp:272 #21 0xb4794618 in MessageLoop::RunInternal (this=this@entry=0xbea0b058) at ../../../ipc/chromium/src/base/message_loop.cc:233 #22 0xb4794632 in RunHandler (this=0xbea0b058) at ../../../ipc/chromium/src/base/message_loop.cc:226 #23 MessageLoop::Run (this=this@entry=0xbea0b058) at ../../../ipc/chromium/src/base/message_loop.cc:200 #24 0xb58eb0ae in XRE_InitChildProcess (aArgc=<optimized out>, aArgv=<optimized out>, aGMPLoader=<optimized out>) at ../../../toolkit/xre/nsEmbedFunctions.cpp:580 #25 0xb6f5187c in content_process_main (argc=6, argv=0xbea0bb54) at ../../../ipc/app/../contentproc/plugin-container.cpp:211 #26 0xb6e744a4 in __libc_init (raw_args=0xbea0bb50, onexit=<optimized out>, slingshot=0xb6f518dd <main(int, char**)>, structors=<optimized out>) at bionic/libc/bionic/libc_init_dynamic.cpp:112 #27 0xb6f5175c in _start () (gdb) p this $1 = <optimized out> (gdb) up #1 0xb45a0f58 in nsCycleCollector::FixGrayBits (this=this@entry=0xb376f000, aForceGC=<optimized out>) at ../../../xpcom/base/nsCycleCollector.cpp:3480 3480 mJSRuntime->FixWeakMappingGrayBits(); (gdb) p this $2 = (nsCycleCollector * const) 0xb376f000 (gdb) p *this $3 = {<nsIMemoryReporter> = {<nsISupports> = {_vptr.nsISupports = 0xb6985fc0 <vtable for nsCycleCollector+8>}, <No data fields>}, mRefCnt = {static isThreadSafe = false, mValue = 1}, _mOwningThread = {mThread = 0xb374d000}, mActivelyCollecting = true, mFreeingSnowWhite = false, mScanInProgress = false, mResults = {mForcedGC = false, mMergedZones = false, mVisitedRefCounted = 1414, mVisitedGCed = 1021, mFreedRefCounted = 462, mFreedGCed = 898, mFreedJSZones = 0, mNumSlices = 7}, mCollectionStart = {mValue = 277403842711}, mJSRuntime = 0xb3753c00, mIncrementalPhase = IdlePhase, mGraph = {mNodes = {mBlocks = 0x0, mLast = 0x0}, mEdges = {mSentinelAndBlocks = {{ptrInfo = 0x0, block = 0x0}, {ptrInfo = 0x0, block = 0x0}}}, mWeakMaps = {<nsTArray_Impl<WeakMapping, nsTArrayInfallibleAllocator>> = {<nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>> = { mHdr = 0xb6bc0678 <nsTArrayHeader::sEmptyHdr>}, <nsTArray_TypedBase<WeakMapping, nsTArray_Impl<WeakMapping, nsTArrayInfallibleAllocator> >> = {<nsTArray_SafeElementAtHelper<WeakMapping, nsTArray_Impl<WeakMapping, nsTArrayInfallibleAllocator> >> = {<No data fields>}, <No data fields>}, static NoIndex = <optimized out>}, <No data fields>}, mRootCount = 0, mPtrToNodeMap = {mOps = 0x0, mHashShift = 20, mRecursionLevel = 0, mEntrySize = 8, mEntryCount = 1974, mRemovedCount = 26, mGeneration = 3, mEntryStore = 0x0}}, mBuilder = {mRawPtr = 0x0}, mListener = {mRawPtr = 0x0}, mThread = {value = 0xb375b180}, mParams = {mLogAll = false, mLogShutdown = false, mAllTracesAll = false, mAllTracesShutdown = false, mLogThisThread = true}, mWhiteNodeCount = 1360, mBeforeUnlinkCB = 0xb4bcdec9 <ClearBlackMarkedNodes()>, mForgetSkippableCB = 0xb4bd6899 <ClearCycleCollectorCleanupData()>, mPurpleBuf = {mCount = 346, mFirstBlock = {mNext = 0xae82e000, mEntries = {{{mObject = 0xae8307b9, mNextInFreeList = 0xae8307b9}, mRefCnt = 0x0, mParticipant = 0x0}, {{mObject = 0xae5cd5f9, mNextInFreeList = 0xae5cd5f9}, mRefCnt = 0x0, mParticipant = 0x0}, {{mObject = 0xb376f09d, mNextInFreeList = 0xb376f09d}, mRefCnt = 0x0, mParticipant = 0x0}, {{mObject = 0xb102afa8, mNextInFreeList = 0xb102afa8}, mRefCnt = 0xb102afa8, mParticipant = 0xb6bb4c08 <nsXBLBinding::_cycleCollectorGlobal>}, {{ mObject = 0xae5d0a55, mNextInFreeList = 0xae5d0a55}, mRefCnt = 0x0, mParticipant = 0x0}, {{mObject = 0xb376f0cd, mNextInFreeList = 0xb376f0cd}, mRefCnt = 0x0, mParticipant = 0x0}, {{mObject = 0xb376f0d9, mNextInFreeList = 0xb376f0d9}, mRefCnt = 0x0, mParticipant = 0x0}, {{ mObject = 0xb376f0a9, mNextInFreeList = 0xb376f0a9}, mRefCnt = 0x0, mParticipant = 0x0}, {{mObject = 0xb376f0e5, mNextInFreeList = 0xb376f0e5}, mRefCnt = 0x0, mParticipant = 0x0}, {{mObject = 0xb376f0f1, mNextInFreeList = 0xb376f0f1},
Blocks: 1140454
This is happening on other platforms now too.
Flags: needinfo?(continuation)
I hit this on bc1 debug linux runs all the time on try. Looks like more OOM abort problems under e10s.
tracking-e10s: --- → ?
See Also: → 1158558
Flags: needinfo?(continuation)
See Also: 1158558
Depends on: 1158558
Fixed by bug 1158558.
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.