Closed Bug 1105123 Opened 11 years ago Closed 11 years ago

Intermittent webcam.html | application crashed [@ js::gc::GCRuntime::sweepBackgroundThings(js::gc::ZoneList&, js::ThreadType)]

Categories

(Core :: JavaScript: GC, defect)

x86_64
macOS
defect
Not set
normal

Tracking

()

RESOLVED FIXED
mozilla37
Tracking Status
firefox35 --- unaffected
firefox36 --- fixed
firefox37 --- fixed
firefox-esr31 --- unaffected

People

(Reporter: RyanVM, Assigned: jonco)

References

Details

(Keywords: crash, intermittent-failure)

Attachments

(1 file)

17:53:51 INFO - REFTEST TEST-START | file:///builds/slave/talos-slave/test/build/tests/reftest/tests/image/test/reftest/gif/webcam.html 17:53:51 INFO - REFTEST TEST-LOAD | http://localhost:49199/1416966768711/14/webcam.html | 511 / 11637 (4%) 17:54:03 WARNING - TEST-UNEXPECTED-FAIL | file:///builds/slave/talos-slave/test/build/tests/reftest/tests/image/test/reftest/gif/webcam.html | application terminated with exit code 1 17:54:03 INFO - mozcrash INFO | Downloading symbols from: https://ftp-ssl.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-inbound-macosx64/1416959074/firefox-36.0a1.en-US.mac.crashreporter-symbols.zip 17:54:59 INFO - mozcrash INFO | Saved minidump as /builds/slave/talos-slave/test/build/blobber_upload_dir/0FE8E441-2449-4EA1-8ACA-9E2CD95F02E1.dmp 17:54:59 INFO - mozcrash INFO | Saved app info as /builds/slave/talos-slave/test/build/blobber_upload_dir/0FE8E441-2449-4EA1-8ACA-9E2CD95F02E1.extra 17:54:59 WARNING - PROCESS-CRASH | file:///builds/slave/talos-slave/test/build/tests/reftest/tests/image/test/reftest/gif/webcam.html | application crashed [@ js::gc::GCRuntime::sweepBackgroundThings(js::gc::ZoneList&, js::ThreadType)] 17:54:59 INFO - Crash dump filename: /var/folders/qx/1_2zp9mx0v10zxphhmmvkxkm00000w/T/tmprpYcAC.mozrunner/minidumps/0FE8E441-2449-4EA1-8ACA-9E2CD95F02E1.dmp 17:54:59 INFO - Operating system: Mac OS X 17:54:59 INFO - 10.8.0 12A269 17:54:59 INFO - CPU: amd64 17:54:59 INFO - family 6 model 42 stepping 7 17:54:59 INFO - 8 CPUs 17:54:59 INFO - Crash reason: EXC_BAD_ACCESS / KERN_INVALID_ADDRESS 17:54:59 INFO - Crash address: 0x381 17:54:59 INFO - Thread 14 (crashed) 17:54:59 INFO - 0 XUL!js::gc::GCRuntime::sweepBackgroundThings(js::gc::ZoneList&, js::ThreadType) [jsgc.cpp:4f830e8fb84b : 3458 + 0x4] 17:54:59 INFO - rbx = 0x0000000000000000 r12 = 0x00000001046276c0 17:54:59 INFO - r13 = 0x000000010e69ed70 r14 = 0x0000000000000001 17:54:59 INFO - r15 = 0x0000000104627700 rip = 0x00000001040bdf44 17:54:59 INFO - rsp = 0x000000010e69ed60 rbp = 0x000000010e69edd0 17:54:59 INFO - Found by: given as instruction pointer in context 17:54:59 INFO - 1 XUL!js::GCHelperState::doSweep(js::AutoLockGC&) [jsgc.cpp:4f830e8fb84b : 3703 + 0x16] 17:54:59 INFO - rbx = 0x0000000109faf0f8 r12 = 0x000000010e69ede0 17:54:59 INFO - r13 = 0x0000000000006ed0 r14 = 0x000000010e69ee68 17:54:59 INFO - r15 = 0x000000010e69ee18 rip = 0x00000001040be412 17:54:59 INFO - rsp = 0x000000010e69ede0 rbp = 0x000000010e69ee50 17:54:59 INFO - Found by: call frame info 17:54:59 INFO - 2 XUL!js::GCHelperState::work() [jsgc.cpp:4f830e8fb84b : 3589 + 0x7] 17:54:59 INFO - rbx = 0x0000000109faf0f8 r12 = 0x0000000109fbac80 17:54:59 INFO - r13 = 0x0000000002010000 r14 = 0x0000000000000120 17:54:59 INFO - r15 = 0x000508b94c9b1900 rip = 0x00000001040be31c 17:54:59 INFO - rsp = 0x000000010e69ee60 rbp = 0x000000010e69ee80 17:54:59 INFO - Found by: call frame info 17:54:59 INFO - 3 XUL!js::HelperThread::threadLoop() [HelperThreads.cpp:4f830e8fb84b : 1309 + 0xc] 17:54:59 INFO - rbx = 0x00007fff5fbfcba0 r12 = 0x0000000109fbac80 17:54:59 INFO - r13 = 0x0000000002010000 r14 = 0x0000000000000120 17:54:59 INFO - r15 = 0x000508b94c9b1900 rip = 0x000000010418463d 17:54:59 INFO - rsp = 0x000000010e69ee90 rbp = 0x000000010e69eee0 17:54:59 INFO - Found by: call frame info 17:54:59 INFO - 4 libnss3.dylib!_pt_root [ptthread.c:4f830e8fb84b : 212 + 0x6] 17:54:59 INFO - rbx = 0x000000010055e370 r12 = 0x0000000000004e03 17:54:59 INFO - r13 = 0x000000000201002a r14 = 0x000000010e69f000 17:54:59 INFO - r15 = 0x0000000000000000 rip = 0x0000000101206f7a 17:54:59 INFO - rsp = 0x000000010e69eef0 rbp = 0x000000010e69ef10 17:54:59 INFO - Found by: call frame info 17:54:59 INFO - 5 libsystem_c.dylib + 0x14781 17:54:59 INFO - rbx = 0x000000010e69f000 r12 = 0x0000000000004e03 17:54:59 INFO - r13 = 0x000000000201002a r14 = 0x000000010055e370 17:54:59 INFO - r15 = 0x0000000101206ea0 rip = 0x00007fff85827782 17:54:59 INFO - rsp = 0x000000010e69ef20 rbp = 0x000000010e69ef50 17:54:59 INFO - Found by: call frame info 17:54:59 INFO - 6 libsystem_c.dylib + 0x11c0 17:54:59 INFO - rip = 0x00007fff858141c1 rsp = 0x000000010e69ef60 17:54:59 INFO - rbp = 0x000000010e69ef78 17:54:59 INFO - Found by: stack scanning 17:54:59 INFO - 7 libnss3.dylib + 0x206e9f 17:54:59 INFO - rip = 0x0000000101206ea0 rsp = 0x000000010e69f050 17:54:59 INFO - Found by: stack scanning 17:54:59 INFO - Thread 0 17:54:59 INFO - 0 XUL!js::SweepScriptData(JSRuntime*) [HashTable.h:4f830e8fb84b : 956 + 0x4] 17:54:59 INFO - rbx = 0x0000000121d506d0 r12 = 0x0000000109fa8000 17:54:59 INFO - r13 = 0x0000000109fa8300 r14 = 0x0000000121d5e000 17:54:59 INFO - r15 = 0x0000000121d5e000 rip = 0x00000001040c4a95 17:54:59 INFO - rsp = 0x00007fff5fbfb2f0 rbp = 0x00007fff5fbfb330 17:54:59 INFO - Found by: given as instruction pointer in context 17:54:59 INFO - 1 XUL!js::gc::GCRuntime::endSweepPhase(bool) [jsgc.cpp:4f830e8fb84b : 5490 + 0x8] 17:54:59 INFO - rbx = 0x00007fff5fbfb4f0 r12 = 0x0000000109fa8000 17:54:59 INFO - r13 = 0x0000000109fa8300 r14 = 0x0000000109fae498 17:54:59 INFO - r15 = 0x0000000109fae498 rip = 0x00000001040c4648 17:54:59 INFO - rsp = 0x00007fff5fbfb340 rbp = 0x00007fff5fbfb3c0 17:54:59 INFO - Found by: call frame info 17:54:59 INFO - 2 XUL!js::gc::GCRuntime::incrementalCollectSlice(js::SliceBudget&, JS::gcreason::Reason) [jsgc.cpp:4f830e8fb84b : 5980 + 0xa] 17:54:59 INFO - rbx = 0x00007fff5fbfb4f0 r12 = 0x0000000109fa8000 17:54:59 INFO - r13 = 0x0000000109faec01 r14 = 0x0000000109fa8300 17:54:59 INFO - r15 = 0x0000000109fae498 rip = 0x00000001040c5c24 17:54:59 INFO - rsp = 0x00007fff5fbfb3d0 rbp = 0x00007fff5fbfb420 17:54:59 INFO - Found by: call frame info 17:54:59 INFO - 3 XUL!js::gc::GCRuntime::gcCycle(bool, js::SliceBudget&, js::JSGCInvocationKind, JS::gcreason::Reason) [jsgc.cpp:4f830e8fb84b : 6169 + 0xd] 17:54:59 INFO - rbx = 0x0000000000000000 r12 = 0x0000000109fa8300 17:54:59 INFO - r13 = 0x00007fff5fbfb4f0 r14 = 0x0000000109fae498 17:54:59 INFO - r15 = 0x0000000109fa8000 rip = 0x00000001040c62cc 17:54:59 INFO - rsp = 0x00007fff5fbfb430 rbp = 0x00007fff5fbfb480 17:54:59 INFO - Found by: call frame info 17:54:59 INFO - 4 XUL!js::gc::GCRuntime::collect(bool, js::SliceBudget&, js::JSGCInvocationKind, JS::gcreason::Reason) [jsgc.cpp:4f830e8fb84b : 6296 + 0x1a] 17:54:59 INFO - rbx = 0x0000000000000000 r12 = 0x0000000109fa8300 17:54:59 INFO - r13 = 0x0000000000000022 r14 = 0x0000000000000000 17:54:59 INFO - r15 = 0x0000000109fae498 rip = 0x00000001040c6736 17:54:59 INFO - rsp = 0x00007fff5fbfb490 rbp = 0x00007fff5fbfb4e0 17:54:59 INFO - Found by: call frame info 17:54:59 INFO - 5 XUL!JS::GCForReason(JSRuntime*, JS::gcreason::Reason) [jsgc.cpp:4f830e8fb84b : 6342 + 0x7] 17:54:59 INFO - rbx = 0x0000000109fa8000 r12 = 0x000000010052a308 17:54:59 INFO - r13 = 0x000000010fabf358 r14 = 0x0000000000000000 17:54:59 INFO - r15 = 0x0000000100519300 rip = 0x00000001040a9ca3 17:54:59 INFO - rsp = 0x00007fff5fbfb4f0 rbp = 0x00007fff5fbfb500 17:54:59 INFO - Found by: call frame info 17:54:59 INFO - 6 XUL!nsXPCComponents_Utils::ForceGC() [XPCComponents.cpp:4f830e8fb84b : 2811 + 0xc] 17:54:59 INFO - rbx = 0x0000000109fa8000 r12 = 0x000000010052a308 17:54:59 INFO - r13 = 0x000000010fabf358 r14 = 0x0000000000000000 17:54:59 INFO - r15 = 0x0000000100519300 rip = 0x0000000101a93ba4 17:54:59 INFO - rsp = 0x00007fff5fbfb510 rbp = 0x00007fff5fbfb520 17:54:59 INFO - Found by: call frame info
Flags: needinfo?(terrence)
Flags: needinfo?(jcoppeard)
I'm looking into this. Likely caused by bug 989390.
decoder seems to have triggered the same issue: Program terminated with signal SIGSEGV, Segmentation fault. #0 0x000000000077b6e5 in js::gc::GCRuntime::sweepBackgroundThings ( this=0x21d6240, zones=..., threadType=threadType@entry=js::BackgroundThread) at /srv/repos/mozilla-central/js/src/jsgc.cpp:3458 3458 ArenaHeader *arenas = zone->allocator.arenas.arenaListsToSweep[kind]; To enable execution of this file add add-auto-load-safe-path /srv/repos/mozilla-central/js/src/shell/js-gdb.gdb line to your configuration file "/home/decoder/.gdbinit". To completely disable this security protection add set auto-load safe-path / line to your configuration file "/home/decoder/.gdbinit". For more information about this security protection see the "Auto-loading safe path" section in the GDB manual. E.g., run from the shell: info "(gdb)Auto-loading safe path" #0 0x000000000077b6e5 in js::gc::GCRuntime::sweepBackgroundThings (this=0x21d6240, zones=..., threadType=threadType@entry=js::BackgroundThread) at /srv/repos/mozilla-central/js/src/jsgc.cpp:3458 #1 0x000000000077b8ae in js::GCHelperState::doSweep (this=this@entry=0x21dd080, lock=...) at /srv/repos/mozilla-central/js/src/jsgc.cpp:3703 #2 0x000000000077b97b in js::GCHelperState::work (this=0x21dd080) at /srv/repos/mozilla-central/js/src/jsgc.cpp:3589 #3 0x0000000000821371 in js::HelperThread::handleGCHelperWorkload (this=this@entry=0x21e89e0) at /srv/repos/mozilla-central/js/src/vm/HelperThreads.cpp:1309 #4 0x000000000082a9f3 in js::HelperThread::threadLoop (this=0x21e89e0) at /srv/repos/mozilla-central/js/src/vm/HelperThreads.cpp:1367 #5 0x0000000000882a29 in nspr::Thread::ThreadRoutine (arg=0x21eac60) at /srv/repos/mozilla-central/js/src/vm/PosixNSPR.cpp:45 #6 0x00007f32bd5c8182 in start_thread (arg=0x7f32bd8d6700) at pthread_create.c:312 #7 0x00007f32bc6b7fbd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111 rax 0x167d0a0 23580832 rbx 0x6 6 rcx 0x0 0 rdx 0x1 1 rsi 0x0 0 rdi 0x7f32bd8d5e00 139855905250816 rbp 0xb22200 <BackgroundPhaseObjects> rsp 0x7f32bd8d5d50 139855905250640 r8 0x0 0 r9 0x7f32bd8d4d18 139855905246488 r10 0x1 1 r11 0x0 0 r12 0x1 1 r13 0x7f32bd8d5d90 139855905250704 r14 0x7f32bd8d5d78 139855905250680 r15 0x0 0 rip 0x77b6e5 <js::gc::GCRuntime::sweepBackgroundThings(js::gc::ZoneList&, js::ThreadType)+165> => 0x77b6e5 <js::gc::GCRuntime::sweepBackgroundThings(js::gc::ZoneList&, js::ThreadType)+165>: mov 0x378(%r12,%rdx,8),%rsi 0x77b6ed <js::gc::GCRuntime::sweepBackgroundThings(js::gc::ZoneList&, js::ThreadType)+173>: test %rsi,%rsi
Attached patch bug1105123-add-assertions — — Splinter Review
It appears what is happening is that a zone with a next pointer of Zone::NotOnList is appearing on the background sweep list, which should not be possible. This is a pointer value of 1 which is why we are crashing at these low values of 0x381 or 0x1f1 depending on the platform. This is not a fix, but it refactors ZoneList and adds assertions. In particular zones added to a list must be transferred to another list or removed with removeFront() and all lists must empty when they die.
Assignee: nobody → jcoppeard
Flags: needinfo?(terrence)
Flags: needinfo?(jcoppeard)
Attachment #8532040 - Flags: review?(terrence)
Keywords: leave-open
Comment on attachment 8532040 [details] [diff] [review] bug1105123-add-assertions Review of attachment 8532040 [details] [diff] [review]: ----------------------------------------------------------------- Yup, that should be a more robust interface.
Attachment #8532040 - Flags: review?(terrence) → review+
Well, huh.
Flags: needinfo?(jcoppeard)
Blocks: 989390
Flags: needinfo?(jcoppeard)
Depends on: 1108836
It may be too early to really tell, but it looks like bug 1108836 fixed this.
All the latest have been on Aurora, so I guess that bodes well.
Status: NEW → RESOLVED
Closed: 11 years ago
Keywords: leave-open
Resolution: --- → FIXED
Target Milestone: --- → mozilla37
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: