Closed Bug 1054648 Opened 6 years ago Closed 5 years ago

Intermittent test_pathAnimInterpolation.xhtml | application crashed [@ mozilla::CycleCollectedJSRuntime::FixWeakMappingGrayBits() const] after "Assertion failure: !JS::IsIncrementalGCInProgress(mJSRuntime) (Don't call FixWeakMappingGrayBits during a GC.)"

Categories

(Core :: XPCOM, defect)

ARM
Android
defect
Not set
normal

Tracking

()

RESOLVED WORKSFORME
Tracking Status
e10s - ---

People

(Reporter: RyanVM, Assigned: mccr8)

References

Details

(Keywords: assertion, crash, intermittent-failure)

https://tbpl.mozilla.org/php/getParsedLog.php?id=46099674&tree=Mozilla-Inbound

Android 4.0 Panda mozilla-inbound debug test mochitest-3 on 2014-08-16 05:34:20 PDT for push 6b62b011c53a
slave: panda-0515

06:13:57     INFO -  645 INFO TEST-START | /tests/content/svg/content/test/test_pathAnimInterpolation.xhtml
06:13:57     INFO -  INFO | automation.py | Application ran for: 0:28:08.603046
06:13:57     INFO -  INFO | zombiecheck | Reading PID log: /tmp/tmpEzcxi9pidlog
06:13:58     INFO -  Contents of /data/anr/traces.txt:
06:13:58     INFO -  /data/tombstones does not exist; tombstone check skipped
06:13:59     INFO -  646 INFO mozcrash Downloading symbols from: https://ftp-ssl.mozilla.org/pub/mozilla.org/mobile/tinderbox-builds/mozilla-inbound-android-debug/1408190836/fennec-34.0a1.en-US.android-arm.crashreporter-symbols.zip
06:14:04     INFO -  647 INFO mozcrash Saved minidump as /builds/panda-0515/test/build/blobber_upload_dir/17de09ba-0191-2cb6-65f86722-698af2fc.dmp
06:14:04     INFO -  648 INFO mozcrash Saved app info as /builds/panda-0515/test/build/blobber_upload_dir/17de09ba-0191-2cb6-65f86722-698af2fc.extra
06:14:04  WARNING -  PROCESS-CRASH | /tests/content/svg/content/test/test_pathAnimInterpolation.xhtml | application crashed [@ mozilla::CycleCollectedJSRuntime::FixWeakMappingGrayBits() const]
06:14:04     INFO -  Crash dump filename: /tmp/tmpeajH2d/17de09ba-0191-2cb6-65f86722-698af2fc.dmp
06:14:04     INFO -  Operating system: Android
06:14:04     INFO -                    0.0.0 Linux 3.2.0+ #2 SMP PREEMPT Thu Nov 29 08:06:57 EST 2012 armv7l pandaboard/pandaboard/pandaboard:4.0.4/IMM76I/5:eng/test-keys
06:14:04     INFO -  CPU: arm
06:14:04     INFO -       2 CPUs
06:14:04     INFO -  Crash reason:  SIGSEGV
06:14:04     INFO -  Crash address: 0x0
06:14:04     INFO -  Thread 13 (crashed)
06:14:04     INFO -   0  libxul.so!mozilla::CycleCollectedJSRuntime::FixWeakMappingGrayBits() const [CycleCollectedJSRuntime.cpp:6b62b011c53a : 1014 + 0x14]
06:14:04     INFO -       r4 = 0x5c356000    r5 = 0x00000000    r6 = 0x5c3b4000    r7 = 0x00000000
06:14:04     INFO -       r8 = 0x00000000    r9 = 0x00000001   r10 = 0x00000000    fp = 0x00000000
06:14:04     INFO -       sp = 0x5d941738    lr = 0x62a83e33    pc = 0x62a87c28
06:14:04     INFO -      Found by: given as instruction pointer in context
06:14:04     INFO -   1  libxul.so!nsCycleCollector::FixGrayBits(bool) [nsCycleCollector.cpp:6b62b011c53a : 3467 + 0x3]
06:14:04     INFO -       r4 = 0x5c3b4000    r5 = 0x00000000    r6 = 0x5c3b4000    r7 = 0x00000000
06:14:04     INFO -       r8 = 0x00000000    r9 = 0x00000001   r10 = 0x00000000    fp = 0x00000000
06:14:04     INFO -       sp = 0x5d941750    pc = 0x62a88b79
06:14:04     INFO -      Found by: call frame info
06:14:04     INFO -   2  libxul.so!nsCycleCollector::BeginCollection(ccType, nsICycleCollectorListener*) [nsCycleCollector.cpp:6b62b011c53a : 3731 + 0x9]
06:14:04     INFO -       r4 = 0x5c3b4078    r5 = 0x00000000    r6 = 0x5c3b4000    r7 = 0x00000000
06:14:04     INFO -       r8 = 0x00000000    r9 = 0x00000001   r10 = 0x00000000    fp = 0x00000000
06:14:04     INFO -       sp = 0x5d941768    pc = 0x62a93b47
06:14:04     INFO -      Found by: call frame info
06:14:04     INFO -   3  libxul.so!nsCycleCollector::Collect(ccType, js::SliceBudget&, nsICycleCollectorListener*) [nsCycleCollector.cpp:6b62b011c53a : 3574 + 0x9]
06:14:04     INFO -       r4 = 0xffffffff    r5 = 0x7fffffff    r6 = 0x5c3b4000    r7 = 0x00000000
06:14:04     INFO -       r8 = 0x5d9417d8    r9 = 0x00000001   r10 = 0x00000000    fp = 0x00000000
06:14:04     INFO -       sp = 0x5d9417a8    pc = 0x62a93d75
06:14:04     INFO -      Found by: call frame info
06:14:04     INFO -   4  libxul.so!nsCycleCollector_collectSlice(long long) [nsCycleCollector.cpp:6b62b011c53a : 4180 + 0xf]
06:14:04     INFO -       r4 = 0x5d9417e8    r5 = 0x00000000    r6 = 0x5d9417d8    r7 = 0x5c32c1d0
06:14:04     INFO -       r8 = 0x00000000    r9 = 0x5d94190f   r10 = 0x00000001    fp = 0x5c33d784
06:14:04     INFO -       sp = 0x5d9417d0    pc = 0x62a93f77
06:14:04     INFO -      Found by: call frame info
06:14:04     INFO -   5  libxul.so!nsJSContext::RunCycleCollectorSlice() [nsJSEnvironment.cpp:6b62b011c53a : 1966 + 0x7]
06:14:04     INFO -       r4 = 0x00000004    r5 = 0x64c86c70    r6 = 0x64c86cc8    r7 = 0x00000001
06:14:04     INFO -       r8 = 0x00000000    r9 = 0x5d94190f   r10 = 0x00000001    fp = 0x5c33d784
06:14:04     INFO -       sp = 0x5d941810    pc = 0x6303bcff
06:14:04     INFO -      Found by: call frame info

06:14:09     INFO -  08-16 06:13:45.437 F/MOZ_Assert( 2264): Assertion failure: !JS::IsIncrementalGCInProgress(mJSRuntime) (Don't call FixWeakMappingGrayBits during a GC.), at /builds/slave/m-in-and-d-0000000000000000000/build/xpcom/base/CycleCollectedJSRuntime.cpp:1015
I should look at this at some point...
Assignee: nobody → continuation
(In reply to Andrew McCreight [:mccr8] from comment #41)
> I should look at this at some point...

Pretty please? :)
Flags: needinfo?(continuation)
Somehow we're in the middle of an incremental GC when we decide to start a CC.  My guess is that either the logic in nsJSEnvironment that is supposed to shut down any GC before we start a CC isn't working, or somehow we're starting up a new GC after we enter the CC.  I could probably add some more assertions to this effect.  It is also possible that mCCLockedOut isn't right for some reason, so we don't realize a GC is running.
Yeah, I don't really have any ideas here, sorry. :(
Flags: needinfo?(continuation)
Also happening on b2g during scrolling in the mail app:

Program received signal SIGSEGV, Segmentation fault.
0xb45a0434 in mozilla::CycleCollectedJSRuntime::FixWeakMappingGrayBits (this=<optimized out>) at ../../../xpcom/base/CycleCollectedJSRuntime.cpp:1006
1006	  MOZ_ASSERT(!JS::IsIncrementalGCInProgress(mJSRuntime),
(gdb) bt
#0  0xb45a0434 in mozilla::CycleCollectedJSRuntime::FixWeakMappingGrayBits (this=<optimized out>) at ../../../xpcom/base/CycleCollectedJSRuntime.cpp:1006
#1  0xb45a0f58 in nsCycleCollector::FixGrayBits (this=this@entry=0xb376f000, aForceGC=<optimized out>) at ../../../xpcom/base/nsCycleCollector.cpp:3480
#2  0xb45a8c12 in nsCycleCollector::BeginCollection (this=this@entry=0xb376f000, aCCType=aCCType@entry=SliceCC, aManualListener=aManualListener@entry=0x0) at ../../../xpcom/base/nsCycleCollector.cpp:3755
#3  0xb45a925e in Collect (aPreferShorterSlices=true, aManualListener=0x0, aBudget=..., aCCType=SliceCC, this=0xb376f000) at ../../../xpcom/base/nsCycleCollector.cpp:3588
#4  nsCycleCollector::Collect (this=0xb376f000, aCCType=SliceCC, aBudget=..., aManualListener=0x0, aPreferShorterSlices=true) at ../../../xpcom/base/nsCycleCollector.cpp:3557
#5  0xb45a93aa in nsCycleCollector_collectSlice (budget=..., aPreferShorterSlices=<optimized out>) at ../../../xpcom/base/nsCycleCollector.cpp:4115
#6  0xb4c3baba in RunCycleCollectorSlice () at ../../../dom/base/nsJSEnvironment.cpp:1550
#7  nsJSContext::RunCycleCollectorSlice () at ../../../dom/base/nsJSEnvironment.cpp:1520
#8  0xb4c3bb8e in CCTimerFired (aTimer=<optimized out>, aClosure=<optimized out>) at ../../../dom/base/nsJSEnvironment.cpp:1885
#9  CCTimerFired (aTimer=<optimized out>, aClosure=<optimized out>) at ../../../dom/base/nsJSEnvironment.cpp:1838
#10 0xb45dda54 in nsTimerImpl::Fire (this=0xaef4ace0) at ../../../xpcom/threads/nsTimerImpl.cpp:631
#11 0xb45ddc06 in nsTimerEvent::Run (this=0xb1f06090) at ../../../xpcom/threads/nsTimerImpl.cpp:724
#12 0xb45dab4c in nsThread::ProcessNextEvent (this=0xb375b180, aMayWait=<optimized out>, aResult=0xbea0aeff) at ../../../xpcom/threads/nsThread.cpp:855
#13 0xb45f07c8 in NS_ProcessNextEvent (aThread=0xb375b180, aMayWait=aMayWait@entry=false) at /Volumes/mac/moz/ib2g/xpcom/glue/nsThreadUtils.cpp:265
#14 0xb47a8ae4 in mozilla::ipc::MessagePump::Run (this=0xb37075c8, aDelegate=0xbea0b058) at ../../../ipc/glue/MessagePump.cpp:99
#15 0xb4794618 in MessageLoop::RunInternal (this=this@entry=0xbea0b058) at ../../../ipc/chromium/src/base/message_loop.cc:233
#16 0xb4794632 in RunHandler (this=0xbea0b058) at ../../../ipc/chromium/src/base/message_loop.cc:226
#17 MessageLoop::Run (this=0xbea0b058) at ../../../ipc/chromium/src/base/message_loop.cc:200
#18 0xb5473932 in nsBaseAppShell::Run (this=0xb216bc20) at ../../widget/nsBaseAppShell.cpp:164
#19 0xb58eb14c in XRE_RunAppShell () at ../../../toolkit/xre/nsEmbedFunctions.cpp:743
#20 0xb47a8c1a in mozilla::ipc::MessagePumpForChildProcess::Run (this=0xb37075c8, aDelegate=0xbea0b058) at ../../../ipc/glue/MessagePump.cpp:272
#21 0xb4794618 in MessageLoop::RunInternal (this=this@entry=0xbea0b058) at ../../../ipc/chromium/src/base/message_loop.cc:233
#22 0xb4794632 in RunHandler (this=0xbea0b058) at ../../../ipc/chromium/src/base/message_loop.cc:226
#23 MessageLoop::Run (this=this@entry=0xbea0b058) at ../../../ipc/chromium/src/base/message_loop.cc:200
#24 0xb58eb0ae in XRE_InitChildProcess (aArgc=<optimized out>, aArgv=<optimized out>, aGMPLoader=<optimized out>) at ../../../toolkit/xre/nsEmbedFunctions.cpp:580
#25 0xb6f5187c in content_process_main (argc=6, argv=0xbea0bb54) at ../../../ipc/app/../contentproc/plugin-container.cpp:211
#26 0xb6e744a4 in __libc_init (raw_args=0xbea0bb50, onexit=<optimized out>, slingshot=0xb6f518dd <main(int, char**)>, structors=<optimized out>) at bionic/libc/bionic/libc_init_dynamic.cpp:112
#27 0xb6f5175c in _start ()
(gdb) p this
$1 = <optimized out>
(gdb) up
#1  0xb45a0f58 in nsCycleCollector::FixGrayBits (this=this@entry=0xb376f000, aForceGC=<optimized out>) at ../../../xpcom/base/nsCycleCollector.cpp:3480
3480	    mJSRuntime->FixWeakMappingGrayBits();
(gdb) p this
$2 = (nsCycleCollector * const) 0xb376f000
(gdb) p *this
$3 = {<nsIMemoryReporter> = {<nsISupports> = {_vptr.nsISupports = 0xb6985fc0 <vtable for nsCycleCollector+8>}, <No data fields>}, mRefCnt = {static isThreadSafe = false, mValue = 1}, _mOwningThread = {mThread = 0xb374d000}, mActivelyCollecting = true, mFreeingSnowWhite = false, 
  mScanInProgress = false, mResults = {mForcedGC = false, mMergedZones = false, mVisitedRefCounted = 1414, mVisitedGCed = 1021, mFreedRefCounted = 462, mFreedGCed = 898, mFreedJSZones = 0, mNumSlices = 7}, mCollectionStart = {mValue = 277403842711}, mJSRuntime = 0xb3753c00, 
  mIncrementalPhase = IdlePhase, mGraph = {mNodes = {mBlocks = 0x0, mLast = 0x0}, mEdges = {mSentinelAndBlocks = {{ptrInfo = 0x0, block = 0x0}, {ptrInfo = 0x0, block = 0x0}}}, 
    mWeakMaps = {<nsTArray_Impl<WeakMapping, nsTArrayInfallibleAllocator>> = {<nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>> = {
          mHdr = 0xb6bc0678 <nsTArrayHeader::sEmptyHdr>}, <nsTArray_TypedBase<WeakMapping, nsTArray_Impl<WeakMapping, nsTArrayInfallibleAllocator> >> = {<nsTArray_SafeElementAtHelper<WeakMapping, nsTArray_Impl<WeakMapping, nsTArrayInfallibleAllocator> >> = {<No data fields>}, <No data fields>}, 
        static NoIndex = <optimized out>}, <No data fields>}, mRootCount = 0, mPtrToNodeMap = {mOps = 0x0, mHashShift = 20, mRecursionLevel = 0, mEntrySize = 8, mEntryCount = 1974, mRemovedCount = 26, mGeneration = 3, mEntryStore = 0x0}}, mBuilder = {mRawPtr = 0x0}, mListener = {mRawPtr = 0x0}, 
  mThread = {value = 0xb375b180}, mParams = {mLogAll = false, mLogShutdown = false, mAllTracesAll = false, mAllTracesShutdown = false, mLogThisThread = true}, mWhiteNodeCount = 1360, mBeforeUnlinkCB = 0xb4bcdec9 <ClearBlackMarkedNodes()>, 
  mForgetSkippableCB = 0xb4bd6899 <ClearCycleCollectorCleanupData()>, mPurpleBuf = {mCount = 346, mFirstBlock = {mNext = 0xae82e000, mEntries = {{{mObject = 0xae8307b9, mNextInFreeList = 0xae8307b9}, mRefCnt = 0x0, mParticipant = 0x0}, {{mObject = 0xae5cd5f9, mNextInFreeList = 0xae5cd5f9}, 
          mRefCnt = 0x0, mParticipant = 0x0}, {{mObject = 0xb376f09d, mNextInFreeList = 0xb376f09d}, mRefCnt = 0x0, mParticipant = 0x0}, {{mObject = 0xb102afa8, mNextInFreeList = 0xb102afa8}, mRefCnt = 0xb102afa8, mParticipant = 0xb6bb4c08 <nsXBLBinding::_cycleCollectorGlobal>}, {{
            mObject = 0xae5d0a55, mNextInFreeList = 0xae5d0a55}, mRefCnt = 0x0, mParticipant = 0x0}, {{mObject = 0xb376f0cd, mNextInFreeList = 0xb376f0cd}, mRefCnt = 0x0, mParticipant = 0x0}, {{mObject = 0xb376f0d9, mNextInFreeList = 0xb376f0d9}, mRefCnt = 0x0, mParticipant = 0x0}, {{
            mObject = 0xb376f0a9, mNextInFreeList = 0xb376f0a9}, mRefCnt = 0x0, mParticipant = 0x0}, {{mObject = 0xb376f0e5, mNextInFreeList = 0xb376f0e5}, mRefCnt = 0x0, mParticipant = 0x0}, {{mObject = 0xb376f0f1, mNextInFreeList = 0xb376f0f1},
Duplicate of this bug: 1149133
Duplicate of this bug: 1154177
Duplicate of this bug: 1111140
Blocks: 1140454
This is happening on other platforms now too.
Flags: needinfo?(continuation)
I hit this on bc1 debug linux runs all the time on try. Looks like more OOM abort problems under e10s.
tracking-e10s: --- → ?
See Also: → 1158558
Flags: needinfo?(continuation)
See Also: 1158558
Depends on: 1158558
Duplicate of this bug: 1155213