1115755 - Intermittent browser_perwindow_privateBrowsing.js | application crashed [@ xul.dll + 0x293373c][@ JSScript::maybeSweepTypes(js::types::AutoClearTypeInferenceStateOnOOM *)]

Status: RESOLVED WORKSFORME

(Core :: JavaScript: GC, defect)

Description

[Ryan VanderMeulen [:RyanVM]]

07:35:33 INFO - TEST-INFO | Main app process: exit status 1
07:35:33 WARNING - TEST-UNEXPECTED-FAIL | ShutdownLeaks | process() called before end of test suite
07:35:33 INFO - 198 INFO checking window state
07:35:33 INFO - 199 ERROR TEST-UNEXPECTED-FAIL | dom/indexedDB/test/browser_perwindow_privateBrowsing.js | application terminated with exit code 1
07:35:33 INFO - runtests.py | Application ran for: 0:00:15.890000
07:35:33 INFO - zombiecheck | Reading PID log: c:\docume~1\cltbld~1.t-x\locals~1\temp\tmphha39vpidlog
07:35:42 INFO - mozcrash Saved minidump as C:\slave\test\build\blobber_upload_dir\89b6188f-c8ab-4c27-a06c-bcd76e7f0d40.dmp
07:35:42 INFO - mozcrash Saved app info as C:\slave\test\build\blobber_upload_dir\89b6188f-c8ab-4c27-a06c-bcd76e7f0d40.extra
07:35:42 WARNING - PROCESS-CRASH | dom/indexedDB/test/browser_perwindow_privateBrowsing.js | application crashed [@ xul.dll + 0x293373c]
07:35:42 INFO - Crash dump filename: c:\docume~1\cltbld~1.t-x\locals~1\temp\tmpf04yn3.mozrunner\minidumps\89b6188f-c8ab-4c27-a06c-bcd76e7f0d40.dmp
07:35:42 INFO - Operating system: Windows NT
07:35:42 INFO - 5.1.2600 Service Pack 3
07:35:42 INFO - CPU: x86
07:35:42 INFO - GenuineIntel family 6 model 30 stepping 5
07:35:42 INFO - 8 CPUs
07:35:42 INFO - Crash reason: EXCEPTION_ACCESS_VIOLATION_EXEC
07:35:42 INFO - Crash address: 0x37f373c
07:35:42 INFO - Thread 0 (crashed)
07:35:42 INFO - 0 xul.dll + 0x293373c
07:35:42 INFO - eip = 0x037f373c esp = 0x0012cacc ebp = 0x0012caf8 ebx = 0x0db4eecc
07:35:42 INFO - esi = 0x14ca7270 edi = 0x14ca53a8 eax = 0x037f373c ecx = 0x14ca7270
07:35:42 INFO - edx = 0x00000400 efl = 0x00010206
07:35:42 INFO - Found by: given as instruction pointer in context
07:35:42 INFO - 1 xul.dll!JSScript::maybeSweepTypes(js::types::AutoClearTypeInferenceStateOnOOM *) [jsinfer.cpp:f1ba8432414d : 5038 + 0x11]
07:35:42 INFO - eip = 0x0310b1f2 esp = 0x0012cb00 ebp = 0x0012cb30
07:35:42 INFO - Found by: previous frame's frame pointer
07:35:42 INFO - 2 xul.dll!js::gc::GCRuntime::sweepPhase(js::SliceBudget &) [jsgc.cpp:f1ba8432414d : 5331 + 0xa]
07:35:42 INFO - eip = 0x0312c863 esp = 0x0012cb38 ebp = 0x0012cc58
07:35:42 INFO - Found by: call frame info
07:35:42 INFO - 3 xul.dll!js::gc::GCRuntime::incrementalCollectSlice(js::SliceBudget &,JS::gcreason::Reason) [jsgc.cpp:f1ba8432414d : 5969 + 0x7]
07:35:42 INFO - eip = 0x030f3350 esp = 0x0012cc60 ebp = 0x0012cc80
07:35:42 INFO - Found by: call frame info
07:35:42 INFO - 4 xul.dll!js::gc::GCRuntime::gcCycle(bool,js::SliceBudget &,js::JSGCInvocationKind,JS::gcreason::Reason) [jsgc.cpp:f1ba8432414d : 6156 + 0xa]
07:35:42 INFO - eip = 0x030e559d esp = 0x0012cc88 ebp = 0x0012ccd0
07:35:42 INFO - Found by: call frame info
07:35:42 INFO - 5 xul.dll!js::gc::GCRuntime::collect(bool,js::SliceBudget &,js::JSGCInvocationKind,JS::gcreason::Reason) [jsgc.cpp:f1ba8432414d : 6281 + 0x17]
07:35:42 INFO - eip = 0x030cd326 esp = 0x0012ccd8 ebp = 0x0012cd60
07:35:42 INFO - Found by: call frame info
07:35:42 INFO - 6 xul.dll!JS::ShrinkingGC(JSRuntime *,JS::gcreason::Reason) [jsfriendapi.cpp:f1ba8432414d : 207 + 0x2d]
07:35:42 INFO - eip = 0x030b5304 esp = 0x0012cd68 ebp = 0x0012cd88
07:35:42 INFO - Found by: call frame info
07:35:42 INFO - 7 xul.dll!nsJSContext::GarbageCollectNow(JS::gcreason::Reason,nsJSContext::IsIncremental,nsJSContext::IsShrinking,__int64) [nsJSEnvironment.cpp:f1ba8432414d : 1477 + 0x12]
07:35:42 INFO - eip = 0x01992781 esp = 0x0012cd90 ebp = 0x0012cda4
07:35:42 INFO - Found by: call frame info
07:35:42 INFO - 8 xul.dll!nsJSEnvironmentObserver::Observe(nsISupports *,char const *,wchar_t const *) [nsJSEnvironment.cpp:f1ba8432414d : 279 + 0xd]
07:35:42 INFO - eip = 0x0199c054 esp = 0x0012cdac ebp = 0x0012cddc
07:35:42 INFO - Found by: call frame info
07:35:42 INFO - 9 xul.dll!nsObserverList::NotifyObservers(nsISupports *,char const *,wchar_t const *) [nsObserverList.cpp:f1ba8432414d : 100 + 0x19]
07:35:42 INFO - eip = 0x00f83694 esp = 0x0012cde4 ebp = 0x0012cdfc
07:35:42 INFO - Found by: call frame info
07:35:42 INFO - 10 xul.dll!nsObserverService::NotifyObservers(nsISupports *,char const *,wchar_t const *) [nsObserverService.cpp:f1ba8432414d : 329 + 0xd]
07:35:42 INFO - eip = 0x00f8377c esp = 0x0012ce04 ebp = 0x0012ce18
07:35:42 INFO - Found by: call frame info

Comment 1

[Legacy TBPL/Treeherder Robot]

submit_timestamp: 2014-12-26T12:00:06
log: https://treeherder.mozilla.org/ui/logviewer.html#?repo=mozilla-inbound&job_id=4956904
repository: mozilla-inbound
who: rvandermeulen[at]mozilla[dot]com
machine: t-xp32-ix-099
buildname: Windows XP 32-bit mozilla-inbound debug test mochitest-browser-chrome-2
revision: f1ba8432414d

TEST-UNEXPECTED-FAIL | ShutdownLeaks | process() called before end of test suite
199 ERROR TEST-UNEXPECTED-FAIL | dom/indexedDB/test/browser_perwindow_privateBrowsing.js | application terminated with exit code 1
PROCESS-CRASH | dom/indexedDB/test/browser_perwindow_privateBrowsing.js | application crashed [@ xul.dll + 0x293373c]
TEST-UNEXPECTED-FAIL | leakcheck | default process: missing output line for total leaks!
Return code: 1

Comment 2

[Legacy TBPL/Treeherder Robot]

log: https://treeherder.mozilla.org/logviewer.html#?repo=try&job_id=4399996
repository: try
start_time: 2015-01-22T07:16:13
who: bowen[at]mozilla[dot]com
machine: t-xp32-ix-056
buildname: Windows XP 32-bit try debug test mochitest-browser-chrome-2
revision: 7c53dd3a18ba

185 ERROR TEST-UNEXPECTED-FAIL | dom/indexedDB/test/browser_perwindow_privateBrowsing.js | application terminated with exit code 1
PROCESS-CRASH | dom/indexedDB/test/browser_perwindow_privateBrowsing.js | application crashed [@ nsStandardURL::~nsStandardURL()]
TEST-UNEXPECTED-FAIL | leakcheck | default process: missing output line for total leaks!
Return code: 1

Comment 3

[Legacy TBPL/Treeherder Robot]

log: https://treeherder.mozilla.org/logviewer.html#?repo=mozilla-inbound&job_id=5816253
repository: mozilla-inbound
start_time: 2015-01-23T03:15:10
who: tomcat[at]mozilla[dot]com
machine: t-xp32-ix-115
buildname: Windows XP 32-bit mozilla-inbound debug test mochitest-browser-chrome-2
revision: 4b6c10b02156

185 ERROR TEST-UNEXPECTED-FAIL | dom/indexedDB/test/browser_perwindow_privateBrowsing.js | application terminated with exit code 1
PROCESS-CRASH | dom/indexedDB/test/browser_perwindow_privateBrowsing.js | application crashed [@ nsStandardURL::~nsStandardURL()]
TEST-UNEXPECTED-FAIL | leakcheck | default process: missing output line for total leaks!
Return code: 1

Comment 4

[Legacy TBPL/Treeherder Robot]

log: https://treeherder.mozilla.org/logviewer.html#?repo=mozilla-inbound&job_id=5981154
repository: mozilla-inbound
start_time: 2015-01-27T10:46:12
who: rvandermeulen[at]mozilla[dot]com
machine: t-w732-ix-122
buildname: Windows 7 32-bit mozilla-inbound debug test mochitest-browser-chrome-2
revision: e3d924b6797f

TEST-UNEXPECTED-FAIL | ShutdownLeaks | process() called before end of test suite
179 ERROR TEST-UNEXPECTED-FAIL | dom/indexedDB/test/browser_perwindow_privateBrowsing.js | application terminated with exit code 1
PROCESS-CRASH | dom/indexedDB/test/browser_perwindow_privateBrowsing.js | application crashed [@ xul.dll + 0x2a451dc]
TEST-UNEXPECTED-FAIL | leakcheck | default process: missing output line for total leaks!
Return code: 1

Comment 5

[Ryan VanderMeulen [:RyanVM]]

Between this and the See Alsos, it looks like we're having Win7 OOM issues?

Comment 6

[Terrence Cole [:terrence]]

The actual crash site is in jsinfer.cpp, last touched by the incremental type sweeping change:
   bhackett1024 5a443ae5cf22 Wed Oct 22 07:57:33 2014 -0700:     StackTypeSet *typeArray = types_->typeArray();
   bhackett1024 5a443ae5cf22 Wed Oct 22 07:57:33 2014 -0700:
   bhackett1024 5a443ae5cf22 Wed Oct 22 07:57:33 2014 -0700:     // Remove constraints and references to dead objects from stack type sets.
   bhackett1024 554045e04d89 Thu Sep 01 12:20:30 2011 -0700:     for (unsigned i = 0; i < num; i++)
   bhackett1024 5a443ae5cf22 Wed Oct 22 07:57:33 2014 -0700:         typeArray[i].sweep(zone(), *oom);

Brian, could you take a look?

Comment 7

[Brian Hackett [Laid off!]]

(In reply to Terrence Cole [:terrence] from comment #6)
> The actual crash site is in jsinfer.cpp, last touched by the incremental
> type sweeping change:
>    bhackett1024 5a443ae5cf22 Wed Oct 22 07:57:33 2014 -0700:    
> StackTypeSet *typeArray = types_->typeArray();
>    bhackett1024 5a443ae5cf22 Wed Oct 22 07:57:33 2014 -0700:
>    bhackett1024 5a443ae5cf22 Wed Oct 22 07:57:33 2014 -0700:     // Remove
> constraints and references to dead objects from stack type sets.
>    bhackett1024 554045e04d89 Thu Sep 01 12:20:30 2011 -0700:     for
> (unsigned i = 0; i < num; i++)
>    bhackett1024 5a443ae5cf22 Wed Oct 22 07:57:33 2014 -0700:        
> typeArray[i].sweep(zone(), *oom);
> 
> Brian, could you take a look?

Well, the script's TypeScript is a member whose allocation / management strategy hasn't changed in years.  We allocate it for a script, sometimes free it and null it out, and free it when destroying the script.  All this happens on the main thread.  Incremental sweeping changed when we look at the contents of this structure while sweeping, but it still happens before foreground finalization would free the structure.

Comment 8

[Legacy TBPL/Treeherder Robot]

log: https://treeherder.mozilla.org/logviewer.html#?repo=fx-team&job_id=2065376
repository: fx-team
start_time: 2015-02-22T13:25:45
who: rvandermeulen[at]mozilla[dot]com
machine: t-w732-ix-073
buildname: Windows 7 32-bit fx-team debug test mochitest-browser-chrome-2
revision: 66cf24f275b7

TEST-UNEXPECTED-FAIL | ShutdownLeaks | process() called before end of test suite
220 ERROR TEST-UNEXPECTED-FAIL | dom/indexedDB/test/browser_perwindow_privateBrowsing.js | application terminated with exit code 1
PROCESS-CRASH | dom/indexedDB/test/browser_perwindow_privateBrowsing.js | application crashed [@ 0x8]
TEST-UNEXPECTED-FAIL | leakcheck | default process: missing output line for total leaks!
Return code: 1

Comment 9

[Legacy TBPL/Treeherder Robot]

log: https://treeherder.mozilla.org/logviewer.html#?repo=mozilla-inbound&job_id=7268560
repository: mozilla-inbound
start_time: 2015-03-05T11:59:00
who: rvandermeulen[at]mozilla[dot]com
machine: t-xp32-ix-046
buildname: Windows XP 32-bit mozilla-inbound debug test mochitest-2
revision: 08a5abd9d252

1052 ERROR TEST-UNEXPECTED-FAIL | dom/html/test/test_bug95530.html | application terminated with exit code 1
PROCESS-CRASH | dom/html/test/test_bug95530.html | application crashed [@ xul.dll + 0x2b2de04]
TEST-UNEXPECTED-FAIL | leakcheck | default process: missing output line for total leaks!
Return code: 1
No tests run or test summary not found

Comment 10

[Legacy TBPL/Treeherder Robot]

log: https://treeherder.mozilla.org/logviewer.html#?repo=mozilla-inbound&job_id=7305832
repository: mozilla-inbound
start_time: 2015-03-06T11:56:15
who: rvandermeulen[at]mozilla[dot]com
machine: talos-mtnlion-r5-002
buildname: Rev5 MacOSX Mountain Lion 10.8 mozilla-inbound debug test mochitest-2
revision: 1e4b76918021

467 ERROR TEST-UNEXPECTED-FAIL | dom/html/test/forms/test_meter_pseudo-classes.html | application terminated with exit code 1
PROCESS-CRASH | dom/html/test/forms/test_meter_pseudo-classes.html | application crashed [@ js::ConstraintTypeSet::sweep(JS::Zone*, js::AutoClearTypeInferenceStateOnOOM&)]
TEST-UNEXPECTED-FAIL | leakcheck | default process: missing output line for total leaks!
Return code: 1
No tests run or test summary not found

Comment 11

[Ed Morley [:emorley]]

Inactive; closing (see bug 1180138).