Closed
Bug 1176819
Opened 10 years ago
Closed 10 years ago
Intermittent opacity-and-pattern-01.svg | application crashed [@ js::GCMarker::eagerlyMarkChildren(js::Shape*)]
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
WORKSFORME
People
(Reporter: cbook, Assigned: terrence)
References
()
Details
(Keywords: crash, intermittent-failure)
Attachments
(1 file, 1 obsolete file)
|
2.77 KB,
patch
|
terrence
:
review+
|
Details | Diff | Splinter Review |
https://treeherder.mozilla.org/logviewer.html#?job_id=11020006&repo=mozilla-inbound
08:43:49 WARNING - PROCESS-CRASH | file:///builds/slave/test/build/tests/reftest/tests/layout/reftests/svg/opacity-and-pattern-01.svg | application crashed [@ js::GCMarker::eagerlyMarkChildren(js::Shape*)]
08:43:49 INFO - Crash dump filename: /var/folders/tH/tH5OQZ3HE5O9E8+dHSg7aE+++-k/-Tmp-/tmpL08tvW.mozrunner/minidumps/F518DA93-BB05-4847-A3FA-5F2C8201AF91.dmp
08:43:49 INFO - Operating system: Mac OS X
08:43:49 INFO - 10.6.8 10K549
08:43:49 INFO - CPU: amd64
08:43:49 INFO - family 6 model 23 stepping 10
08:43:49 INFO - 2 CPUs
08:43:49 INFO - Crash reason: EXC_BAD_ACCESS / 0x0000000d
08:43:49 INFO - Crash address: 0x0
08:43:49 INFO - Thread 9 (crashed)
08:43:49 INFO - 0 XUL!js::GCMarker::eagerlyMarkChildren(js::Shape*) [Heap.h:4b47c3f074a3 : 928 + 0x0]
08:43:49 INFO - rbx = 0x0000020000000000 r12 = 0x000000011f9f4980
08:43:49 INFO - r13 = 0x000000011f9f4990 r14 = 0x000000010d511f60
08:43:49 INFO - r15 = 0x00000001306b6510 rip = 0x0000000104b34546
08:43:49 INFO - rsp = 0x000000011f9f4980 rbp = 0x000000011f9f49c0
08:43:49 INFO - Found by: given as instruction pointer in context
08:43:49 INFO - 1 XUL!js::TraceManuallyBarrieredGenericPointerEdge(JSTracer*, js::gc::Cell**, char const*) [Marking.cpp:4b47c3f074a3 : 565 + 0x4]
08:43:49 INFO - rbx = 0x000000012e311e68 r12 = 0x0000000000000000
08:43:49 INFO - r13 = 0x000000011f9f4ac0 r14 = 0x000000012e311e50
08:43:49 INFO - r15 = 0x0000000000000030 rip = 0x0000000104b1ab06
08:43:49 INFO - rsp = 0x000000011f9f49d0 rbp = 0x000000011f9f49f0
08:43:49 INFO - Found by: call frame info
08:43:49 INFO - 2 XUL!js::UnboxedLayout::~UnboxedLayout() [Heap.h:4b47c3f074a3 : 1459 + 0xb]
08:43:49 INFO - rbx = 0x000000012e311e68 r12 = 0x0000000000000000
08:43:49 INFO - r13 = 0x000000011f9f4ac0 r14 = 0x000000012e311e50
08:43:49 INFO - r15 = 0x0000000000000030 rip = 0x0000000104c20d7b
08:43:49 INFO - rsp = 0x000000011f9f4a00 rbp = 0x000000011f9f4a20
08:43:49 INFO - Found by: call frame info
08:43:49 INFO - 3 XUL!js::ObjectGroup::finalize(js::FreeOp*) [UnboxedObject.h:4b47c3f074a3 : 120 + 0x7]
08:43:49 INFO - rbx = 0x000000012e311e50 r12 = 0x0000000000000000
08:43:49 INFO - r13 = 0x000000011f9f4ac0 r14 = 0x000000012d7ed760
08:43:49 INFO - r15 = 0x0000000000000030 rip = 0x0000000104ba5ec5
08:43:49 INFO - rsp = 0x000000011f9f4a30 rbp = 0x000000011f9f4a50
08:43:49 INFO - Found by: call frame info
08:43:49 INFO - 4 XUL!unsigned long js::gc::Arena::finalize<js::ObjectGroup>(js::FreeOp*, js::gc::AllocKind, unsigned long) [jsgc.cpp:4b47c3f074a3 : 506 + 0xb]
08:43:49 INFO - rbx = 0x000000012d7ed760 r12 = 0x0000000000000000
08:43:49 INFO - r13 = 0x000000011f9f4ac0 r14 = 0xfffc4b4b4b4b4b4b
08:43:49 INFO - r15 = 0x0000000000000030 rip = 0x0000000104f32269
08:43:49 INFO - rsp = 0x000000011f9f4a60 rbp = 0x000000011f9f4b00
08:43:49 INFO - Found by: call frame info
08:43:49 INFO - 5 XUL!FinalizeArenas [jsgc.cpp:4b47c3f074a3 : 566 + 0x14]
08:43:49 INFO - rbx = 0x000000012d7ed000 r12 = 0x8000000000000000
08:43:49 INFO - r13 = 0x000000011f9f5d50 r14 = 0x0000000000000001
08:43:49 INFO - r15 = 0x000000011f9f4cb8 rip = 0x0000000104ecaab3
08:43:49 INFO - rsp = 0x000000011f9f4b10 rbp = 0x000000011f9f4c90
08:43:49 INFO - Found by: call frame info
08:43:49 INFO - 6 XUL!js::gc::ArenaLists::backgroundFinalize(js::FreeOp*, js::gc::ArenaHeader*, js::gc::ArenaHeader**) [jsgc.cpp:4b47c3f074a3 : 2847 + 0x10]
08:43:49 INFO - rbx = 0x0000000000000003 r12 = 0x000000011f9f5d80
08:43:49 INFO - r13 = 0x000000012a899000 r14 = 0x000000011f9f5d50
08:43:49 INFO - r15 = 0x0000000000000013 rip = 0x0000000104ec9738
08:43:49 INFO - rsp = 0x000000011f9f4ca0 rbp = 0x000000011f9f5d00
08:43:49 INFO - Found by: call frame info
08:43:49 INFO - 7 XUL!js::gc::GCRuntime::sweepBackgroundThings(js::gc::ZoneList&, js::LifoAlloc&, js::ThreadType) [jsgc.cpp:4b47c3f074a3 : 3265 + 0xa]
08:43:49 INFO - rbx = 0x0000000000000003 r12 = 0x000000011f9f5d50
08:43:49 INFO - r13 = 0x000000011f9f5d80 r14 = 0x0000000105c5682c
08:43:49 INFO - r15 = 0x000000012a899000 rip = 0x0000000104ecd0bb
08:43:49 INFO - rsp = 0x000000011f9f5d10 rbp = 0x000000011f9f5db0
08:43:49 INFO - Found by: call frame info
08:43:49 INFO - 8 XUL!js::GCHelperState::doSweep(js::AutoLockGC&) [jsgc.cpp:4b47c3f074a3 : 3508 + 0x19]
08:43:49 INFO - rbx = 0x000000010d512370 r12 = 0x000000011f9f5dc0
08:43:49 INFO - r13 = 0x0000000000002118 r14 = 0x000000011f9f5e60
08:43:49 INFO - r15 = 0x000000011f9f5df8 rip = 0x0000000104ecd5b1
08:43:49 INFO - rsp = 0x000000011f9f5dc0 rbp = 0x000000011f9f5e30
08:43:49 INFO - Found by: call frame info
08:43:49 INFO - 9 XUL!js::GCHelperState::work() [jsgc.cpp:4b47c3f074a3 : 3391 + 0x7]
08:43:49 INFO - rbx = 0x000000012154e2c0 r12 = 0x0000000000000000
08:43:49 INFO - r13 = 0x00000001003a8330 r14 = 0x000000010d512370
08:43:49 INFO - r15 = 0x0000000000000000 rip = 0x0000000104ecd4ac
08:43:49 INFO - rsp = 0x000000011f9f5e40 rbp = 0x000000011f9f5e80
08:43:49 INFO - Found by: call frame info
08:43:49 INFO - 10 XUL!js::HelperThread::threadLoop() [HelperThreads.cpp:4b47c3f074a3 : 1371 + 0xb]
08:43:49 INFO - rbx = 0x000000010032bb20 r12 = 0x0000000000000000
08:43:49 INFO - r13 = 0x00000001003a8330 r14 = 0x000000010036dd00
08:43:49 INFO - r15 = 0x0000000000000000 rip = 0x0000000104b5d6eb
08:43:49 INFO - rsp = 0x000000011f9f5e90 rbp = 0x000000011f9f5ee0
08:43:49 INFO - Found by: call frame info
08:43:49 INFO - 11 libnss3.dylib!_pt_root [ptthread.c:4b47c3f074a3 : 212 + 0x6]
08:43:49 INFO - rbx = 0x000000010032bb20 r12 = 0x0000000000000000
08:43:49 INFO - r13 = 0x0000000000004d03 r14 = 0x000000011f9f6000
08:43:49 INFO - r15 = 0x0000000000000000 rip = 0x0000000101a0748a
08:43:49 INFO - rsp = 0x000000011f9f5ef0 rbp = 0x000000011f9f5f10
| Comment hidden (Legacy TBPL/Treeherder Robot) |
Comment 2•10 years ago
|
||
I think this is the same problem we fixed recently by removing the pre-barrier call from the original HeapPtr destructor (bug 1165843). When finalizing off the main thread we don't want to call this because we can try to mark something that's already been finalized. Now we've replaced HeapPtr by what used to be RelocatablePtr this can happen again.
Flags: needinfo?(terrence)
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Assignee | ||
Comment 8•10 years ago
|
||
This should fix the crash. Not clear if it will be fast enough yet.
Assignee: nobody → terrence
Status: NEW → ASSIGNED
Flags: needinfo?(terrence)
Attachment #8625770 -
Flags: review?(jcoppeard)
Comment 9•10 years ago
|
||
Looks good, I updated the patch to move the check after the needsIncrementalBarrier() check and added an assert that this only happens when sweeping on a background thread.
Attachment #8625770 -
Attachment is obsolete: true
Attachment #8625770 -
Flags: review?(jcoppeard)
Attachment #8625815 -
Flags: review?(terrence)
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Assignee | ||
Comment 29•10 years ago
|
||
Comment on attachment 8625815 [details] [diff] [review]
fix_omt_prebarrier-v1
Review of attachment 8625815 [details] [diff] [review]:
-----------------------------------------------------------------
Nice! It seems my tentative low-battery testing was not sufficient. Later perf testing did find that this regresses windows shell a bit.
Attachment #8625815 -
Flags: review?(terrence) → review+
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
| Comment hidden (Legacy TBPL/Treeherder Robot) |
Comment 35•10 years ago
|
||
[Mass Closure] Closing Intermittent as a one off
Updated•10 years ago
|
Status: ASSIGNED → RESOLVED
Closed: 10 years ago
Resolution: --- → WORKSFORME
You need to log in
before you can comment on or make changes to this bug.
Description
•