1088117 - Intermittent "SUMMARY: AddressSanitizer: SEGV /builds/slave/m-in-l64-asan-0000000000000000/build/js/src/ds/BitArray.h:40 get"

Status: RESOLVED FIXED

(Core :: JavaScript: GC, defect)

Description

[Ryan VanderMeulen [:RyanVM]]

Probably also related to bug 1087892.

https://treeherder.mozilla.org/ui/logviewer.html#?job_id=3248004&repo=mozilla-inbound

builder 	Ubuntu ASAN VM 12.04 x64 mozilla-inbound opt test mochitest-devtools-chrome
buildid 	20141023064618
builduid 	f209a932c8f74c4186bdc89876fa24c0
results 	warnings (1)
revision 	710ca80bb1d7
slave 		tst-linux64-spot-1030
starttime 	Thu Oct 23 2014 10:36:53 GMT-0400 (Eastern Standard Time)

08:10:03 INFO - 688 INFO TEST-START | chrome://mochitests/content/browser/browser/devtools/inspector/test/browser_inspector_highlighter-02.js
08:10:08 INFO - ASAN:SIGSEGV
08:10:08 INFO - =================================================================
08:10:08 INFO - ==1875==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7fc1966b7f11 sp 0x7fff103bb5b0 bp 0x7fff103bb5d0 T0)
08:10:09 INFO - #0 0x7fc1966b7f10 in get /builds/slave/m-in-l64-asan-0000000000000000/build/js/src/ds/BitArray.h:40
08:10:09 INFO - #1 0x7fc1966b7f10 in findDecommittedArenaOffset /builds/slave/m-in-l64-asan-0000000000000000/build/js/src/jsgc.cpp:856
08:10:09 INFO - #2 0x7fc1966b7f10 in js::gc::Chunk::fetchNextDecommittedArena() /builds/slave/m-in-l64-asan-0000000000000000/build/js/src/jsgc.cpp:867
08:10:09 INFO - #3 0x7fc1966b8444 in js::gc::Chunk::allocateArena(JS::Zone*, js::gc::AllocKind) /builds/slave/m-in-l64-asan-0000000000000000/build/js/src/jsgc.cpp:924
08:10:09 INFO - #4 0x7fc1966c0ca1 in js::gc::ArenaLists::allocateFromArena(JS::Zone*, js::gc::AllocKind, js::gc::AutoMaybeStartBackgroundAllocation&) /builds/slave/m-in-l64-asan-0000000000000000/build/js/src/jsgc.cpp:1910
08:10:09 INFO - #5 0x7fc1966c7c84 in void* js::gc::GCRuntime::refillFreeListFromMainThread<(js::AllowGC)1>(JSContext*, js::gc::AllocKind) /builds/slave/m-in-l64-asan-0000000000000000/build/js/src/jsgc.cpp:2678
08:10:09 INFO - #6 0x7fc1966c76fe in void* js::gc::GCRuntime::refillFreeListFromAnyThread<(js::AllowGC)1>(js::ThreadSafeContext*, js::gc::AllocKind) /builds/slave/m-in-l64-asan-0000000000000000/build/js/src/jsgc.cpp:2737
08:10:09 INFO - #7 0x7fc195c648d1 in JSObject* js::gc::AllocateObject<(js::AllowGC)1>(js::ThreadSafeContext*, js::gc::AllocKind, unsigned long, js::gc::InitialHeap) /builds/slave/m-in-l64-asan-0000000000000000/build/js/src/jsgcinlines.h:607
08:10:09 INFO - #8 0x7fc1964afa80 in NewGCObject<1> /builds/slave/m-in-l64-asan-0000000000000000/build/js/src/jsgcinlines.h:705:12
08:10:09 INFO - #9 0x7fc1964afa80 in JSObject::create(js::ExclusiveContext*, js::gc::AllocKind, js::gc::InitialHeap, JS::Handle<js::Shape*>, JS::Handle<js::types::TypeObject*>) /builds/slave/m-in-l64-asan-0000000000000000/build/js/src/jsobjinlines.h:324
08:10:09 INFO - #10 0x7fc19674e5c6 in NewObject(js::ExclusiveContext*, js::types::TypeObject*, JSObject*, js::gc::AllocKind, js::NewObjectKind) /builds/slave/m-in-l64-asan-0000000000000000/build/js/src/jsobj.cpp:1437:21
08:10:09 INFO - #11 0x7fc19674f782 in js::NewObjectWithClassProtoCommon(js::ExclusiveContext*, js::Class const*, JSObject*, JSObject*, js::gc::AllocKind, js::NewObjectKind) /builds/slave/m-in-l64-asan-0000000000000000/build/js/src/jsobj.cpp:1631:21
08:10:09 INFO - #12 0x7fc19668e2a6 in NewObjectWithClassProto /builds/slave/m-in-l64-asan-0000000000000000/build/js/src/jsobjinlines.h:656
08:10:09 INFO - #13 0x7fc19668e2a6 in js::NewFunctionWithProto(js::ExclusiveContext*, JS::Handle<JSObject*>, bool (*)(JSContext*, unsigned int, JS::Value*), unsigned int, JSFunction::Flags, JS::Handle<JSObject*>, JS::Handle<JSAtom*>, JSObject*, js::gc::AllocKind, js::NewObjectKind) /builds/slave/m-in-l64-asan-0000000000000000/build/js/src/jsfun.cpp:1966
08:10:09 INFO - #14 0x7fc1966b015d in js::NewFunction(js::ExclusiveContext*, JS::Handle<JSObject*>, bool (*)(JSContext*, unsigned int, JS::Value*), unsigned int, JSFunction::Flags, JS::Handle<JSObject*>, JS::Handle<JSAtom*>, js::gc::AllocKind, js::NewObjectKind) /builds/slave/m-in-l64-asan-0000000000000000/build/js/src/jsfun.cpp:1940
08:10:09 INFO - #15 0x7fc1965f26fc in DefinePropertyById(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::Handle<JS::Value>, JSPropertyOpWrapper const&, JSStrictPropertyOpWrapper const&, unsigned int, unsigned int) /builds/slave/m-in-l64-asan-0000000000000000/build/js/src/jsapi.cpp:2864
08:10:09 INFO - #16 0x7fc1965f7469 in JS_DefineProperties(JSContext*, JS::Handle<JSObject*>, JSPropertySpec const*) /builds/slave/m-in-l64-asan-0000000000000000/build/js/src/jsapi.cpp:3317
08:10:09 INFO - #17 0x7fc191a43976 in Define /builds/slave/m-in-l64-asan-0000000000000000/build/dom/bindings/BindingUtils.cpp:300
08:10:09 INFO - #18 0x7fc191a43976 in DefinePrefable<const JSPropertySpec> /builds/slave/m-in-l64-asan-0000000000000000/build/dom/bindings/BindingUtils.cpp:317
08:10:09 INFO - #19 0x7fc191a43976 in mozilla::dom::DefineProperties(JSContext*, JS::Handle<JSObject*>, mozilla::dom::NativeProperties const*, mozilla::dom::NativeProperties const*) /builds/slave/m-in-l64-asan-0000000000000000/build/dom/bindings/BindingUtils.cpp:596
08:10:09 INFO - #20 0x7fc191a4430e in CreateInterfacePrototypeObject /builds/slave/m-in-l64-asan-0000000000000000/build/dom/bindings/BindingUtils.cpp:577
08:10:09 INFO - #21 0x7fc191a4430e in mozilla::dom::CreateInterfaceObjects(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, js::Class const*, JS::Heap<JSObject*>*, JS::Handle<JSObject*>, js::Class const*, mozilla::dom::JSNativeHolder const*, unsigned int, mozilla::dom::NamedConstructor const*, JS::Heap<JSObject*>*, mozilla::dom::NativeProperties const*, mozilla::dom::NativeProperties const*, char const*, bool) /builds/slave/m-in-l64-asan-0000000000000000/build/dom/bindings/BindingUtils.cpp:666
08:10:09 INFO - #22 0x7fc190cf4fe5 in mozilla::dom::HTMLElementBinding::CreateInterfaceObjects(JSContext*, JS::Handle<JSObject*>, mozilla::dom::ProtoAndIfaceCache&, bool) /builds/slave/m-in-l64-asan-0000000000000000/build/obj-firefox/dom/bindings/./HTMLElementBinding.cpp:6729
08:10:09 INFO - #23 0x7fc190ce451f in mozilla::dom::HTMLElementBinding::GetProtoObjectHandle(JSContext*, JS::Handle<JSObject*>) /builds/slave/m-in-l64-asan-0000000000000000/build/obj-firefox/dom/bindings/./HTMLElementBinding.cpp:6753
08:10:09 INFO - #24 0x7fc190c5e532 in mozilla::dom::HTMLBaseElementBinding::CreateInterfaceObjects(JSContext*, JS::Handle<JSObject*>, mozilla::dom::ProtoAndIfaceCache&, bool) /builds/slave/m-in-l64-asan-0000000000000000/build/obj-firefox/dom/bindings/./HTMLBaseElementBinding.cpp:368
08:10:09 INFO - #25 0x7fc190c5dd4a in GetProtoObjectHandle /builds/slave/m-in-l64-asan-0000000000000000/build/obj-firefox/dom/bindings/./HTMLBaseElementBinding.cpp:410
08:10:09 INFO - #26 0x7fc190c5dd4a in mozilla::dom::HTMLBaseElementBinding::Wrap(JSContext*, mozilla::dom::HTMLSharedElement*, nsWrapperCache*) /builds/slave/m-in-l64-asan-0000000000000000/build/obj-firefox/dom/bindings/./HTMLBaseElementBinding.cpp:346
08:10:09 INFO - #27 0x7fc1928b8d4c in nsINode::WrapObject(JSContext*) /builds/slave/m-in-l64-asan-0000000000000000/build/content/base/src/nsINode.cpp:2694
08:10:09 INFO - #28 0x7fc19264a97f in mozilla::dom::Element::WrapObject(JSContext*) /builds/slave/m-in-l64-asan-0000000000000000/build/content/base/src/Element.cpp:409
08:10:09 INFO - #29 0x7fc19061afb6 in WrapNewBindingObject<mozilla::dom::Element> /builds/slave/m-in-l64-asan-0000000000000000/build/obj-firefox/dom/events/../../dist/include/mozilla/dom/BindingUtils.h:866
08:10:09 INFO - #30 0x7fc19061afb6 in bool mozilla::dom::WrapNewBindingObject<mozilla::dom::Element*>(JSContext*, JS::Handle<JSObject*>, mozilla::dom::Element*&, JS::MutableHandle<JS::Value>) /builds/slave/m-in-l64-asan-0000000000000000/build/obj-firefox/dom/events/../../dist/include/mozilla/dom/BindingUtils.h:1623
08:10:09 INFO - #31 0x7fc190bfe8bf in mozilla::dom::DocumentBinding::querySelector(JSContext*, JS::Handle<JSObject*>, nsIDocument*, JSJitMethodCallArgs const&) /builds/slave/m-in-l64-asan-0000000000000000/build/obj-firefox/dom/bindings/./DocumentBinding.cpp:2954:8
08:10:09 INFO - #32 0x7fc191a55c73 in mozilla::dom::GenericBindingMethod(JSContext*, unsigned int, JS::Value*) /builds/slave/m-in-l64-asan-0000000000000000/build/dom/bindings/BindingUtils.cpp:2425
08:10:09 INFO - #33 0x7fc1969548ed in CallJSNative /builds/slave/m-in-l64-asan-0000000000000000/build/js/src/jscntxtinlines.h:231
08:10:09 INFO - #34 0x7fc1969548ed in js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) /builds/slave/m-in-l64-asan-0000000000000000/build/js/src/vm/Interpreter.cpp:482
08:10:09 INFO - #35 0x7fc196989506 in Interpret(JSContext*, js::RunState&) /builds/slave/m-in-l64-asan-0000000000000000/build/js/src/vm/Interpreter.cpp:2537
08:10:09 INFO - #36 0x7fc19696d6fc in js::RunScript(JSContext*, js::RunState&) /builds/slave/m-in-l64-asan-0000000000000000/build/js/src/vm/Interpreter.cpp:432
08:10:09 INFO - #37 0x7fc196954ea7 in js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) /builds/slave/m-in-l64-asan-0000000000000000/build/js/src/vm/Interpreter.cpp:501
08:10:09 INFO - #38 0x7fc196904f9e in js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value const*, JS::MutableHandle<JS::Value>) /builds/slave/m-in-l64-asan-0000000000000000/build/js/src/vm/Interpreter.cpp:538
08:10:09 INFO - #39 0x7fc19660be4f in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/slave/m-in-l64-asan-0000000000000000/build/js/src/jsapi.cpp:4949
08:10:09 INFO - #40 0x7fc190b54115 in mozilla::dom::EventListener::HandleEvent(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&) /builds/slave/m-in-l64-asan-0000000000000000/build/obj-firefox/dom/bindings/./EventListenerBinding.cpp:46
08:10:09 INFO - #41 0x7fc191cc1bc0 in void mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>(mozilla::dom::EventTarget* const&, mozilla::dom::Event&, mozilla::ErrorResult&, mozilla::dom::CallbackObject::ExceptionHandling) /builds/slave/m-in-l64-asan-0000000000000000/build/obj-firefox/dom/events/../../dist/include/mozilla/dom/EventListenerBinding.h:54
08:10:09 INFO - #42 0x7fc191cc1438 in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, nsIDOMEvent*, mozilla::dom::EventTarget*) /builds/slave/m-in-l64-asan-0000000000000000/build/dom/events/EventListenerManager.cpp:945
08:10:09 INFO - #43 0x7fc191cc2756 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent**, mozilla::dom::EventTarget*, nsEventStatus*) /builds/slave/m-in-l64-asan-0000000000000000/build/dom/events/EventListenerManager.cpp:1010
08:10:09 INFO - #44 0x7fc191cb2eaf in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /builds/slave/m-in-l64-asan-0000000000000000/build/dom/events/EventDispatcher.cpp:271
08:10:09 INFO - #45 0x7fc191cb735d in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsCOMArray<mozilla::dom::EventTarget>*) /builds/slave/m-in-l64-asan-0000000000000000/build/dom/events/EventDispatcher.cpp:606
08:10:09 INFO - #46 0x7fc1937fffef in nsDocumentViewer::LoadComplete(tag_nsresult) /builds/slave/m-in-l64-asan-0000000000000000/build/layout/base/nsDocumentViewer.cpp:1005
08:10:09 INFO - #47 0x7fc1943e3acf in nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, tag_nsresult) /builds/slave/m-in-l64-asan-0000000000000000/build/docshell/base/nsDocShell.cpp:7295
08:10:09 INFO - #48 0x7fc1943e03c3 in nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, tag_nsresult) /builds/slave/m-in-l64-asan-0000000000000000/build/docshell/base/nsDocShell.cpp:7113
08:10:09 INFO - #49 0x7fc1943e6b9f in non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, tag_nsresult) /builds/slave/m-in-l64-asan-0000000000000000/build/obj-firefox/docshell/base/Unified_cpp_docshell_base0.cpp:7120
08:10:09 INFO - #50 0x7fc18fb916bb in nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, tag_nsresult) /builds/slave/m-in-l64-asan-0000000000000000/build/uriloader/base/nsDocLoader.cpp:1269
08:10:09 INFO - #51 0x7fc18fb909a3 in nsDocLoader::doStopDocumentLoad(nsIRequest*, tag_nsresult) /builds/slave/m-in-l64-asan-0000000000000000/build/uriloader/base/nsDocLoader.cpp:850
08:10:09 INFO - #52 0x7fc18fb8dbed in nsDocLoader::DocLoaderIsEmpty(bool) /builds/slave/m-in-l64-asan-0000000000000000/build/uriloader/base/nsDocLoader.cpp:740
08:10:09 INFO - #53 0x7fc18fb8faf6 in nsDocLoader::OnStopRequest(nsIRequest*, nsISupports*, tag_nsresult) /builds/slave/m-in-l64-asan-0000000000000000/build/uriloader/base/nsDocLoader.cpp:624
08:10:09 INFO - #54 0x7fc18fb9036c in non-virtual thunk to nsDocLoader::OnStopRequest(nsIRequest*, nsISupports*, tag_nsresult) /builds/slave/m-in-l64-asan-0000000000000000/build/obj-firefox/uriloader/base/Unified_cpp_uriloader_base0.cpp:628
08:10:09 INFO - #55 0x7fc18e7c6847 in nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, tag_nsresult) /builds/slave/m-in-l64-asan-0000000000000000/build/netwerk/base/src/nsLoadGroup.cpp:689
08:10:09 INFO - #56 0x7fc19281206c in nsDocument::DoUnblockOnload() /builds/slave/m-in-l64-asan-0000000000000000/build/content/base/src/nsDocument.cpp:8859
08:10:09 INFO - #57 0x7fc192811d1a in nsDocument::UnblockOnload(bool) /builds/slave/m-in-l64-asan-0000000000000000/build/content/base/src/nsDocument.cpp:8787
08:10:09 INFO - #58 0x7fc1927e6790 in nsDocument::DispatchContentLoadedEvents() /builds/slave/m-in-l64-asan-0000000000000000/build/content/base/src/nsDocument.cpp:5034
08:10:09 INFO - #59 0x7fc19288a690 in nsRunnableMethodImpl<void (nsDocument::*)(), void, true>::Run() /builds/slave/m-in-l64-asan-0000000000000000/build/obj-firefox/content/base/src/../../../dist/include/nsThreadUtils.h:388
08:10:09 INFO - #60 0x7fc18e627884 in nsThread::ProcessNextEvent(bool, bool*) /builds/slave/m-in-l64-asan-0000000000000000/build/xpcom/threads/nsThread.cpp:830
08:10:09 INFO - #61 0x7fc18e6866aa in NS_ProcessNextEvent(nsIThread*, bool) /builds/slave/m-in-l64-asan-0000000000000000/build/xpcom/glue/nsThreadUtils.cpp:265
08:10:09 INFO - #62 0x7fc18eebac49 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/slave/m-in-l64-asan-0000000000000000/build/ipc/glue/MessagePump.cpp:99
08:10:09 INFO - #63 0x7fc18ee6a2ec in RunInternal /builds/slave/m-in-l64-asan-0000000000000000/build/ipc/chromium/src/base/message_loop.cc:233
08:10:09 INFO - #64 0x7fc18ee6a2ec in RunHandler /builds/slave/m-in-l64-asan-0000000000000000/build/ipc/chromium/src/base/message_loop.cc:226
08:10:09 INFO - #65 0x7fc18ee6a2ec in MessageLoop::Run() /builds/slave/m-in-l64-asan-0000000000000000/build/ipc/chromium/src/base/message_loop.cc:200
08:10:09 INFO - #66 0x7fc1924d0377 in nsBaseAppShell::Run() /builds/slave/m-in-l64-asan-0000000000000000/build/widget/xpwidgets/nsBaseAppShell.cpp:164
08:10:09 INFO - #67 0x7fc194a2e028 in nsAppStartup::Run() /builds/slave/m-in-l64-asan-0000000000000000/build/toolkit/components/startup/nsAppStartup.cpp:280
08:10:09 INFO - #68 0x7fc194b1323a in XREMain::XRE_mainRun() /builds/slave/m-in-l64-asan-0000000000000000/build/toolkit/xre/nsAppRunner.cpp:4095
08:10:09 INFO - #69 0x7fc194b14116 in XREMain::XRE_main(int, char**, nsXREAppData const*) /builds/slave/m-in-l64-asan-0000000000000000/build/toolkit/xre/nsAppRunner.cpp:4168
08:10:09 INFO - #70 0x7fc194b14f6d in XRE_main /builds/slave/m-in-l64-asan-0000000000000000/build/toolkit/xre/nsAppRunner.cpp:4384
08:10:09 INFO - #71 0x48a2f7 in do_main /builds/slave/m-in-l64-asan-0000000000000000/build/browser/app/nsBrowserApp.cpp:287
08:10:09 INFO - #72 0x48a2f7 in main /builds/slave/m-in-l64-asan-0000000000000000/build/browser/app/nsBrowserApp.cpp:656
08:10:09 INFO - #73 0x7fc1a78dd76c (/lib/x86_64-linux-gnu/libc.so.6+0x2176c)
08:10:09 INFO - #74 0x48975c in _start (/builds/slave/test/build/application/firefox/firefox+0x48975c)
08:10:09 INFO - AddressSanitizer can not provide additional info.
08:10:10 INFO - SUMMARY: AddressSanitizer: SEGV /builds/slave/m-in-l64-asan-0000000000000000/build/js/src/ds/BitArray.h:40 get
08:10:10 INFO - ==1875==ABORTING
08:10:10 INFO - TEST-INFO | Main app process: killed by SIGHUP

Comment 1

[Ryan VanderMeulen [:RyanVM]]

Should be fixed by Terrence's backout.