Closed
Bug 1105123
Opened 11 years ago
Closed 11 years ago
Intermittent webcam.html | application crashed [@ js::gc::GCRuntime::sweepBackgroundThings(js::gc::ZoneList&, js::ThreadType)]
Categories
(Core :: JavaScript: GC, defect)
Tracking
()
RESOLVED
FIXED
mozilla37
| Tracking | Status | |
|---|---|---|
| firefox35 | --- | unaffected |
| firefox36 | --- | fixed |
| firefox37 | --- | fixed |
| firefox-esr31 | --- | unaffected |
People
(Reporter: RyanVM, Assigned: jonco)
References
Details
(Keywords: crash, intermittent-failure)
Attachments
(1 file)
|
4.14 KB,
patch
|
terrence
:
review+
|
Details | Diff | Splinter Review |
17:53:51 INFO - REFTEST TEST-START | file:///builds/slave/talos-slave/test/build/tests/reftest/tests/image/test/reftest/gif/webcam.html
17:53:51 INFO - REFTEST TEST-LOAD | http://localhost:49199/1416966768711/14/webcam.html | 511 / 11637 (4%)
17:54:03 WARNING - TEST-UNEXPECTED-FAIL | file:///builds/slave/talos-slave/test/build/tests/reftest/tests/image/test/reftest/gif/webcam.html | application terminated with exit code 1
17:54:03 INFO - mozcrash INFO | Downloading symbols from: https://ftp-ssl.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-inbound-macosx64/1416959074/firefox-36.0a1.en-US.mac.crashreporter-symbols.zip
17:54:59 INFO - mozcrash INFO | Saved minidump as /builds/slave/talos-slave/test/build/blobber_upload_dir/0FE8E441-2449-4EA1-8ACA-9E2CD95F02E1.dmp
17:54:59 INFO - mozcrash INFO | Saved app info as /builds/slave/talos-slave/test/build/blobber_upload_dir/0FE8E441-2449-4EA1-8ACA-9E2CD95F02E1.extra
17:54:59 WARNING - PROCESS-CRASH | file:///builds/slave/talos-slave/test/build/tests/reftest/tests/image/test/reftest/gif/webcam.html | application crashed [@ js::gc::GCRuntime::sweepBackgroundThings(js::gc::ZoneList&, js::ThreadType)]
17:54:59 INFO - Crash dump filename: /var/folders/qx/1_2zp9mx0v10zxphhmmvkxkm00000w/T/tmprpYcAC.mozrunner/minidumps/0FE8E441-2449-4EA1-8ACA-9E2CD95F02E1.dmp
17:54:59 INFO - Operating system: Mac OS X
17:54:59 INFO - 10.8.0 12A269
17:54:59 INFO - CPU: amd64
17:54:59 INFO - family 6 model 42 stepping 7
17:54:59 INFO - 8 CPUs
17:54:59 INFO - Crash reason: EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
17:54:59 INFO - Crash address: 0x381
17:54:59 INFO - Thread 14 (crashed)
17:54:59 INFO - 0 XUL!js::gc::GCRuntime::sweepBackgroundThings(js::gc::ZoneList&, js::ThreadType) [jsgc.cpp:4f830e8fb84b : 3458 + 0x4]
17:54:59 INFO - rbx = 0x0000000000000000 r12 = 0x00000001046276c0
17:54:59 INFO - r13 = 0x000000010e69ed70 r14 = 0x0000000000000001
17:54:59 INFO - r15 = 0x0000000104627700 rip = 0x00000001040bdf44
17:54:59 INFO - rsp = 0x000000010e69ed60 rbp = 0x000000010e69edd0
17:54:59 INFO - Found by: given as instruction pointer in context
17:54:59 INFO - 1 XUL!js::GCHelperState::doSweep(js::AutoLockGC&) [jsgc.cpp:4f830e8fb84b : 3703 + 0x16]
17:54:59 INFO - rbx = 0x0000000109faf0f8 r12 = 0x000000010e69ede0
17:54:59 INFO - r13 = 0x0000000000006ed0 r14 = 0x000000010e69ee68
17:54:59 INFO - r15 = 0x000000010e69ee18 rip = 0x00000001040be412
17:54:59 INFO - rsp = 0x000000010e69ede0 rbp = 0x000000010e69ee50
17:54:59 INFO - Found by: call frame info
17:54:59 INFO - 2 XUL!js::GCHelperState::work() [jsgc.cpp:4f830e8fb84b : 3589 + 0x7]
17:54:59 INFO - rbx = 0x0000000109faf0f8 r12 = 0x0000000109fbac80
17:54:59 INFO - r13 = 0x0000000002010000 r14 = 0x0000000000000120
17:54:59 INFO - r15 = 0x000508b94c9b1900 rip = 0x00000001040be31c
17:54:59 INFO - rsp = 0x000000010e69ee60 rbp = 0x000000010e69ee80
17:54:59 INFO - Found by: call frame info
17:54:59 INFO - 3 XUL!js::HelperThread::threadLoop() [HelperThreads.cpp:4f830e8fb84b : 1309 + 0xc]
17:54:59 INFO - rbx = 0x00007fff5fbfcba0 r12 = 0x0000000109fbac80
17:54:59 INFO - r13 = 0x0000000002010000 r14 = 0x0000000000000120
17:54:59 INFO - r15 = 0x000508b94c9b1900 rip = 0x000000010418463d
17:54:59 INFO - rsp = 0x000000010e69ee90 rbp = 0x000000010e69eee0
17:54:59 INFO - Found by: call frame info
17:54:59 INFO - 4 libnss3.dylib!_pt_root [ptthread.c:4f830e8fb84b : 212 + 0x6]
17:54:59 INFO - rbx = 0x000000010055e370 r12 = 0x0000000000004e03
17:54:59 INFO - r13 = 0x000000000201002a r14 = 0x000000010e69f000
17:54:59 INFO - r15 = 0x0000000000000000 rip = 0x0000000101206f7a
17:54:59 INFO - rsp = 0x000000010e69eef0 rbp = 0x000000010e69ef10
17:54:59 INFO - Found by: call frame info
17:54:59 INFO - 5 libsystem_c.dylib + 0x14781
17:54:59 INFO - rbx = 0x000000010e69f000 r12 = 0x0000000000004e03
17:54:59 INFO - r13 = 0x000000000201002a r14 = 0x000000010055e370
17:54:59 INFO - r15 = 0x0000000101206ea0 rip = 0x00007fff85827782
17:54:59 INFO - rsp = 0x000000010e69ef20 rbp = 0x000000010e69ef50
17:54:59 INFO - Found by: call frame info
17:54:59 INFO - 6 libsystem_c.dylib + 0x11c0
17:54:59 INFO - rip = 0x00007fff858141c1 rsp = 0x000000010e69ef60
17:54:59 INFO - rbp = 0x000000010e69ef78
17:54:59 INFO - Found by: stack scanning
17:54:59 INFO - 7 libnss3.dylib + 0x206e9f
17:54:59 INFO - rip = 0x0000000101206ea0 rsp = 0x000000010e69f050
17:54:59 INFO - Found by: stack scanning
17:54:59 INFO - Thread 0
17:54:59 INFO - 0 XUL!js::SweepScriptData(JSRuntime*) [HashTable.h:4f830e8fb84b : 956 + 0x4]
17:54:59 INFO - rbx = 0x0000000121d506d0 r12 = 0x0000000109fa8000
17:54:59 INFO - r13 = 0x0000000109fa8300 r14 = 0x0000000121d5e000
17:54:59 INFO - r15 = 0x0000000121d5e000 rip = 0x00000001040c4a95
17:54:59 INFO - rsp = 0x00007fff5fbfb2f0 rbp = 0x00007fff5fbfb330
17:54:59 INFO - Found by: given as instruction pointer in context
17:54:59 INFO - 1 XUL!js::gc::GCRuntime::endSweepPhase(bool) [jsgc.cpp:4f830e8fb84b : 5490 + 0x8]
17:54:59 INFO - rbx = 0x00007fff5fbfb4f0 r12 = 0x0000000109fa8000
17:54:59 INFO - r13 = 0x0000000109fa8300 r14 = 0x0000000109fae498
17:54:59 INFO - r15 = 0x0000000109fae498 rip = 0x00000001040c4648
17:54:59 INFO - rsp = 0x00007fff5fbfb340 rbp = 0x00007fff5fbfb3c0
17:54:59 INFO - Found by: call frame info
17:54:59 INFO - 2 XUL!js::gc::GCRuntime::incrementalCollectSlice(js::SliceBudget&, JS::gcreason::Reason) [jsgc.cpp:4f830e8fb84b : 5980 + 0xa]
17:54:59 INFO - rbx = 0x00007fff5fbfb4f0 r12 = 0x0000000109fa8000
17:54:59 INFO - r13 = 0x0000000109faec01 r14 = 0x0000000109fa8300
17:54:59 INFO - r15 = 0x0000000109fae498 rip = 0x00000001040c5c24
17:54:59 INFO - rsp = 0x00007fff5fbfb3d0 rbp = 0x00007fff5fbfb420
17:54:59 INFO - Found by: call frame info
17:54:59 INFO - 3 XUL!js::gc::GCRuntime::gcCycle(bool, js::SliceBudget&, js::JSGCInvocationKind, JS::gcreason::Reason) [jsgc.cpp:4f830e8fb84b : 6169 + 0xd]
17:54:59 INFO - rbx = 0x0000000000000000 r12 = 0x0000000109fa8300
17:54:59 INFO - r13 = 0x00007fff5fbfb4f0 r14 = 0x0000000109fae498
17:54:59 INFO - r15 = 0x0000000109fa8000 rip = 0x00000001040c62cc
17:54:59 INFO - rsp = 0x00007fff5fbfb430 rbp = 0x00007fff5fbfb480
17:54:59 INFO - Found by: call frame info
17:54:59 INFO - 4 XUL!js::gc::GCRuntime::collect(bool, js::SliceBudget&, js::JSGCInvocationKind, JS::gcreason::Reason) [jsgc.cpp:4f830e8fb84b : 6296 + 0x1a]
17:54:59 INFO - rbx = 0x0000000000000000 r12 = 0x0000000109fa8300
17:54:59 INFO - r13 = 0x0000000000000022 r14 = 0x0000000000000000
17:54:59 INFO - r15 = 0x0000000109fae498 rip = 0x00000001040c6736
17:54:59 INFO - rsp = 0x00007fff5fbfb490 rbp = 0x00007fff5fbfb4e0
17:54:59 INFO - Found by: call frame info
17:54:59 INFO - 5 XUL!JS::GCForReason(JSRuntime*, JS::gcreason::Reason) [jsgc.cpp:4f830e8fb84b : 6342 + 0x7]
17:54:59 INFO - rbx = 0x0000000109fa8000 r12 = 0x000000010052a308
17:54:59 INFO - r13 = 0x000000010fabf358 r14 = 0x0000000000000000
17:54:59 INFO - r15 = 0x0000000100519300 rip = 0x00000001040a9ca3
17:54:59 INFO - rsp = 0x00007fff5fbfb4f0 rbp = 0x00007fff5fbfb500
17:54:59 INFO - Found by: call frame info
17:54:59 INFO - 6 XUL!nsXPCComponents_Utils::ForceGC() [XPCComponents.cpp:4f830e8fb84b : 2811 + 0xc]
17:54:59 INFO - rbx = 0x0000000109fa8000 r12 = 0x000000010052a308
17:54:59 INFO - r13 = 0x000000010fabf358 r14 = 0x0000000000000000
17:54:59 INFO - r15 = 0x0000000100519300 rip = 0x0000000101a93ba4
17:54:59 INFO - rsp = 0x00007fff5fbfb510 rbp = 0x00007fff5fbfb520
17:54:59 INFO - Found by: call frame info
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Reporter | ||
Updated•11 years ago
|
Flags: needinfo?(terrence)
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Reporter | ||
Updated•11 years ago
|
Flags: needinfo?(jcoppeard)
| Assignee | ||
Comment 9•11 years ago
|
||
I'm looking into this. Likely caused by bug 989390.
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Assignee | ||
Comment 19•11 years ago
|
||
decoder seems to have triggered the same issue:
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x000000000077b6e5 in js::gc::GCRuntime::sweepBackgroundThings (
this=0x21d6240, zones=...,
threadType=threadType@entry=js::BackgroundThread)
at /srv/repos/mozilla-central/js/src/jsgc.cpp:3458
3458 ArenaHeader *arenas = zone->allocator.arenas.arenaListsToSweep[kind];
To enable execution of this file add
add-auto-load-safe-path /srv/repos/mozilla-central/js/src/shell/js-gdb.gdb
line to your configuration file "/home/decoder/.gdbinit".
To completely disable this security protection add
set auto-load safe-path /
line to your configuration file "/home/decoder/.gdbinit".
For more information about this security protection see the
"Auto-loading safe path" section in the GDB manual. E.g., run from the shell:
info "(gdb)Auto-loading safe path"
#0 0x000000000077b6e5 in js::gc::GCRuntime::sweepBackgroundThings (this=0x21d6240, zones=..., threadType=threadType@entry=js::BackgroundThread) at /srv/repos/mozilla-central/js/src/jsgc.cpp:3458
#1 0x000000000077b8ae in js::GCHelperState::doSweep (this=this@entry=0x21dd080, lock=...) at /srv/repos/mozilla-central/js/src/jsgc.cpp:3703
#2 0x000000000077b97b in js::GCHelperState::work (this=0x21dd080) at /srv/repos/mozilla-central/js/src/jsgc.cpp:3589
#3 0x0000000000821371 in js::HelperThread::handleGCHelperWorkload (this=this@entry=0x21e89e0) at /srv/repos/mozilla-central/js/src/vm/HelperThreads.cpp:1309
#4 0x000000000082a9f3 in js::HelperThread::threadLoop (this=0x21e89e0) at /srv/repos/mozilla-central/js/src/vm/HelperThreads.cpp:1367
#5 0x0000000000882a29 in nspr::Thread::ThreadRoutine (arg=0x21eac60) at /srv/repos/mozilla-central/js/src/vm/PosixNSPR.cpp:45
#6 0x00007f32bd5c8182 in start_thread (arg=0x7f32bd8d6700) at pthread_create.c:312
#7 0x00007f32bc6b7fbd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111
rax 0x167d0a0 23580832
rbx 0x6 6
rcx 0x0 0
rdx 0x1 1
rsi 0x0 0
rdi 0x7f32bd8d5e00 139855905250816
rbp 0xb22200 <BackgroundPhaseObjects>
rsp 0x7f32bd8d5d50 139855905250640
r8 0x0 0
r9 0x7f32bd8d4d18 139855905246488
r10 0x1 1
r11 0x0 0
r12 0x1 1
r13 0x7f32bd8d5d90 139855905250704
r14 0x7f32bd8d5d78 139855905250680
r15 0x0 0
rip 0x77b6e5 <js::gc::GCRuntime::sweepBackgroundThings(js::gc::ZoneList&, js::ThreadType)+165>
=> 0x77b6e5 <js::gc::GCRuntime::sweepBackgroundThings(js::gc::ZoneList&, js::ThreadType)+165>: mov 0x378(%r12,%rdx,8),%rsi
0x77b6ed <js::gc::GCRuntime::sweepBackgroundThings(js::gc::ZoneList&, js::ThreadType)+173>: test %rsi,%rsi
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Assignee | ||
Comment 22•11 years ago
|
||
It appears what is happening is that a zone with a next pointer of Zone::NotOnList is appearing on the background sweep list, which should not be possible. This is a pointer value of 1 which is why we are crashing at these low values of 0x381 or 0x1f1 depending on the platform.
This is not a fix, but it refactors ZoneList and adds assertions. In particular zones added to a list must be transferred to another list or removed with removeFront() and all lists must empty when they die.
Assignee: nobody → jcoppeard
Flags: needinfo?(terrence)
Flags: needinfo?(jcoppeard)
Attachment #8532040 -
Flags: review?(terrence)
| Assignee | ||
Updated•11 years ago
|
Keywords: leave-open
Comment 23•11 years ago
|
||
Comment on attachment 8532040 [details] [diff] [review]
bug1105123-add-assertions
Review of attachment 8532040 [details] [diff] [review]:
-----------------------------------------------------------------
Yup, that should be a more robust interface.
Attachment #8532040 -
Flags: review?(terrence) → review+
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Assignee | ||
Comment 26•11 years ago
|
||
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
Updated•11 years ago
|
status-firefox36:
--- → affected
status-firefox37:
--- → affected
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
Comment 32•11 years ago
|
||
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
Comment 57•11 years ago
|
||
It may be too early to really tell, but it looks like bug 1108836 fixed this.
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Reporter | ||
Comment 60•11 years ago
|
||
All the latest have been on Aurora, so I guess that bodes well.
Status: NEW → RESOLVED
Closed: 11 years ago
status-firefox35:
--- → unaffected
status-firefox-esr31:
--- → unaffected
Keywords: leave-open
Resolution: --- → FIXED
Target Milestone: --- → mozilla37
| Reporter | ||
Updated•11 years ago
|
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
You need to log in
before you can comment on or make changes to this bug.
Description
•