Closed Bug 1176819 Opened 10 years ago Closed 10 years ago

Intermittent opacity-and-pattern-01.svg | application crashed [@ js::GCMarker::eagerlyMarkChildren(js::Shape*)]

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
normal

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: cbook, Assigned: terrence)

References

()

Details

(Keywords: crash, intermittent-failure)

Attachments

(1 file, 1 obsolete file)

https://treeherder.mozilla.org/logviewer.html#?job_id=11020006&repo=mozilla-inbound 08:43:49 WARNING - PROCESS-CRASH | file:///builds/slave/test/build/tests/reftest/tests/layout/reftests/svg/opacity-and-pattern-01.svg | application crashed [@ js::GCMarker::eagerlyMarkChildren(js::Shape*)] 08:43:49 INFO - Crash dump filename: /var/folders/tH/tH5OQZ3HE5O9E8+dHSg7aE+++-k/-Tmp-/tmpL08tvW.mozrunner/minidumps/F518DA93-BB05-4847-A3FA-5F2C8201AF91.dmp 08:43:49 INFO - Operating system: Mac OS X 08:43:49 INFO - 10.6.8 10K549 08:43:49 INFO - CPU: amd64 08:43:49 INFO - family 6 model 23 stepping 10 08:43:49 INFO - 2 CPUs 08:43:49 INFO - Crash reason: EXC_BAD_ACCESS / 0x0000000d 08:43:49 INFO - Crash address: 0x0 08:43:49 INFO - Thread 9 (crashed) 08:43:49 INFO - 0 XUL!js::GCMarker::eagerlyMarkChildren(js::Shape*) [Heap.h:4b47c3f074a3 : 928 + 0x0] 08:43:49 INFO - rbx = 0x0000020000000000 r12 = 0x000000011f9f4980 08:43:49 INFO - r13 = 0x000000011f9f4990 r14 = 0x000000010d511f60 08:43:49 INFO - r15 = 0x00000001306b6510 rip = 0x0000000104b34546 08:43:49 INFO - rsp = 0x000000011f9f4980 rbp = 0x000000011f9f49c0 08:43:49 INFO - Found by: given as instruction pointer in context 08:43:49 INFO - 1 XUL!js::TraceManuallyBarrieredGenericPointerEdge(JSTracer*, js::gc::Cell**, char const*) [Marking.cpp:4b47c3f074a3 : 565 + 0x4] 08:43:49 INFO - rbx = 0x000000012e311e68 r12 = 0x0000000000000000 08:43:49 INFO - r13 = 0x000000011f9f4ac0 r14 = 0x000000012e311e50 08:43:49 INFO - r15 = 0x0000000000000030 rip = 0x0000000104b1ab06 08:43:49 INFO - rsp = 0x000000011f9f49d0 rbp = 0x000000011f9f49f0 08:43:49 INFO - Found by: call frame info 08:43:49 INFO - 2 XUL!js::UnboxedLayout::~UnboxedLayout() [Heap.h:4b47c3f074a3 : 1459 + 0xb] 08:43:49 INFO - rbx = 0x000000012e311e68 r12 = 0x0000000000000000 08:43:49 INFO - r13 = 0x000000011f9f4ac0 r14 = 0x000000012e311e50 08:43:49 INFO - r15 = 0x0000000000000030 rip = 0x0000000104c20d7b 08:43:49 INFO - rsp = 0x000000011f9f4a00 rbp = 0x000000011f9f4a20 08:43:49 INFO - Found by: call frame info 08:43:49 INFO - 3 XUL!js::ObjectGroup::finalize(js::FreeOp*) [UnboxedObject.h:4b47c3f074a3 : 120 + 0x7] 08:43:49 INFO - rbx = 0x000000012e311e50 r12 = 0x0000000000000000 08:43:49 INFO - r13 = 0x000000011f9f4ac0 r14 = 0x000000012d7ed760 08:43:49 INFO - r15 = 0x0000000000000030 rip = 0x0000000104ba5ec5 08:43:49 INFO - rsp = 0x000000011f9f4a30 rbp = 0x000000011f9f4a50 08:43:49 INFO - Found by: call frame info 08:43:49 INFO - 4 XUL!unsigned long js::gc::Arena::finalize<js::ObjectGroup>(js::FreeOp*, js::gc::AllocKind, unsigned long) [jsgc.cpp:4b47c3f074a3 : 506 + 0xb] 08:43:49 INFO - rbx = 0x000000012d7ed760 r12 = 0x0000000000000000 08:43:49 INFO - r13 = 0x000000011f9f4ac0 r14 = 0xfffc4b4b4b4b4b4b 08:43:49 INFO - r15 = 0x0000000000000030 rip = 0x0000000104f32269 08:43:49 INFO - rsp = 0x000000011f9f4a60 rbp = 0x000000011f9f4b00 08:43:49 INFO - Found by: call frame info 08:43:49 INFO - 5 XUL!FinalizeArenas [jsgc.cpp:4b47c3f074a3 : 566 + 0x14] 08:43:49 INFO - rbx = 0x000000012d7ed000 r12 = 0x8000000000000000 08:43:49 INFO - r13 = 0x000000011f9f5d50 r14 = 0x0000000000000001 08:43:49 INFO - r15 = 0x000000011f9f4cb8 rip = 0x0000000104ecaab3 08:43:49 INFO - rsp = 0x000000011f9f4b10 rbp = 0x000000011f9f4c90 08:43:49 INFO - Found by: call frame info 08:43:49 INFO - 6 XUL!js::gc::ArenaLists::backgroundFinalize(js::FreeOp*, js::gc::ArenaHeader*, js::gc::ArenaHeader**) [jsgc.cpp:4b47c3f074a3 : 2847 + 0x10] 08:43:49 INFO - rbx = 0x0000000000000003 r12 = 0x000000011f9f5d80 08:43:49 INFO - r13 = 0x000000012a899000 r14 = 0x000000011f9f5d50 08:43:49 INFO - r15 = 0x0000000000000013 rip = 0x0000000104ec9738 08:43:49 INFO - rsp = 0x000000011f9f4ca0 rbp = 0x000000011f9f5d00 08:43:49 INFO - Found by: call frame info 08:43:49 INFO - 7 XUL!js::gc::GCRuntime::sweepBackgroundThings(js::gc::ZoneList&, js::LifoAlloc&, js::ThreadType) [jsgc.cpp:4b47c3f074a3 : 3265 + 0xa] 08:43:49 INFO - rbx = 0x0000000000000003 r12 = 0x000000011f9f5d50 08:43:49 INFO - r13 = 0x000000011f9f5d80 r14 = 0x0000000105c5682c 08:43:49 INFO - r15 = 0x000000012a899000 rip = 0x0000000104ecd0bb 08:43:49 INFO - rsp = 0x000000011f9f5d10 rbp = 0x000000011f9f5db0 08:43:49 INFO - Found by: call frame info 08:43:49 INFO - 8 XUL!js::GCHelperState::doSweep(js::AutoLockGC&) [jsgc.cpp:4b47c3f074a3 : 3508 + 0x19] 08:43:49 INFO - rbx = 0x000000010d512370 r12 = 0x000000011f9f5dc0 08:43:49 INFO - r13 = 0x0000000000002118 r14 = 0x000000011f9f5e60 08:43:49 INFO - r15 = 0x000000011f9f5df8 rip = 0x0000000104ecd5b1 08:43:49 INFO - rsp = 0x000000011f9f5dc0 rbp = 0x000000011f9f5e30 08:43:49 INFO - Found by: call frame info 08:43:49 INFO - 9 XUL!js::GCHelperState::work() [jsgc.cpp:4b47c3f074a3 : 3391 + 0x7] 08:43:49 INFO - rbx = 0x000000012154e2c0 r12 = 0x0000000000000000 08:43:49 INFO - r13 = 0x00000001003a8330 r14 = 0x000000010d512370 08:43:49 INFO - r15 = 0x0000000000000000 rip = 0x0000000104ecd4ac 08:43:49 INFO - rsp = 0x000000011f9f5e40 rbp = 0x000000011f9f5e80 08:43:49 INFO - Found by: call frame info 08:43:49 INFO - 10 XUL!js::HelperThread::threadLoop() [HelperThreads.cpp:4b47c3f074a3 : 1371 + 0xb] 08:43:49 INFO - rbx = 0x000000010032bb20 r12 = 0x0000000000000000 08:43:49 INFO - r13 = 0x00000001003a8330 r14 = 0x000000010036dd00 08:43:49 INFO - r15 = 0x0000000000000000 rip = 0x0000000104b5d6eb 08:43:49 INFO - rsp = 0x000000011f9f5e90 rbp = 0x000000011f9f5ee0 08:43:49 INFO - Found by: call frame info 08:43:49 INFO - 11 libnss3.dylib!_pt_root [ptthread.c:4b47c3f074a3 : 212 + 0x6] 08:43:49 INFO - rbx = 0x000000010032bb20 r12 = 0x0000000000000000 08:43:49 INFO - r13 = 0x0000000000004d03 r14 = 0x000000011f9f6000 08:43:49 INFO - r15 = 0x0000000000000000 rip = 0x0000000101a0748a 08:43:49 INFO - rsp = 0x000000011f9f5ef0 rbp = 0x000000011f9f5f10
I think this is the same problem we fixed recently by removing the pre-barrier call from the original HeapPtr destructor (bug 1165843). When finalizing off the main thread we don't want to call this because we can try to mark something that's already been finalized. Now we've replaced HeapPtr by what used to be RelocatablePtr this can happen again.
Flags: needinfo?(terrence)
Attached patch fix_omt_prebarrier-v0.diff (obsolete) — — Splinter Review
This should fix the crash. Not clear if it will be fast enough yet.
Assignee: nobody → terrence
Status: NEW → ASSIGNED
Flags: needinfo?(terrence)
Attachment #8625770 - Flags: review?(jcoppeard)
Attached patch fix_omt_prebarrier-v1 — — Splinter Review
Looks good, I updated the patch to move the check after the needsIncrementalBarrier() check and added an assert that this only happens when sweeping on a background thread.
Attachment #8625770 - Attachment is obsolete: true
Attachment #8625770 - Flags: review?(jcoppeard)
Attachment #8625815 - Flags: review?(terrence)
Comment on attachment 8625815 [details] [diff] [review] fix_omt_prebarrier-v1 Review of attachment 8625815 [details] [diff] [review]: ----------------------------------------------------------------- Nice! It seems my tentative low-battery testing was not sufficient. Later perf testing did find that this regresses windows shell a bit.
Attachment #8625815 - Flags: review?(terrence) → review+
[Mass Closure] Closing Intermittent as a one off
Status: ASSIGNED → RESOLVED
Closed: 10 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: