1187921 - application crashed [@ mozilla::dom::Registry::cycleCollection::Traverse(void*, nsCycleCollectionTraversalCallback&)]

Status: RESOLVED WORKSFORME

(Core :: DOM: Core & HTML, defect)

Description

[Jean-Yves Avenard [:jya]]

I wanted to debug something totally unrelated, so I enabled extra debugging and disabled some mochitests to reduce the verbosity...

And I hit the jackpot:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=adb589480eb4

Every single runs crashed with a 
dom/html/test/test_audio_wakelock.html | application crashed [@ mozilla::dom::Registry::cycleCollection::Traverse(void*, nsCycleCollectionTraversalCallback&)]

or similar....

07:08:37     INFO -  Crash reason:  EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
07:08:37     INFO -  Crash address: 0x10
07:08:37     INFO -  Thread 0 (crashed)
07:08:37     INFO -   0  XUL!mozilla::dom::Registry::cycleCollection::Traverse(void*, nsCycleCollectionTraversalCallback&) [Maybe.h:adb589480eb4 : 155 + 0x0]
07:08:37     INFO -      rbx = 0x00007fff5fbfccb8   r12 = 0x0000000000000000
07:08:37     INFO -      r13 = 0x0000000111664200   r14 = 0x0000000105713de8
07:08:37     INFO -      r15 = 0x00000001056f6dd0   rip = 0x0000000102400b6a
07:08:37     INFO -      rsp = 0x00007fff5fbfcc90   rbp = 0x00007fff5fbfcd10
07:08:37     INFO -      Found by: given as instruction pointer in context
07:08:37     INFO -   1  XUL!CCGraphBuilder::BuildGraph(js::SliceBudget&) [nsCycleCollector.cpp:adb589480eb4 : 2238 + 0xa]
07:08:37     INFO -      rbx = 0x0000000111664200   r12 = 0x00000001056f6dd0
07:08:37     INFO -      r13 = 0x0000000105713de8   r14 = 0x00007fff5fbfce70
07:08:37     INFO -      r15 = 0x0000000000000001   rip = 0x000000010147ddbf
07:08:37     INFO -      rsp = 0x00007fff5fbfcd20   rbp = 0x00007fff5fbfcd50
07:08:37     INFO -      Found by: call frame info
07:08:37     INFO -   2  XUL!nsCycleCollector::MarkRoots(js::SliceBudget&) [nsCycleCollector.cpp:adb589480eb4 : 2843 + 0x7]
07:08:37     INFO -      rbx = 0x0000000109439000   r12 = 0x00007fff5fbfce70
07:08:37     INFO -      r13 = 0x00000001014821b4   r14 = 0x00007fff5fbfce70
07:08:37     INFO -      r15 = 0x0000000000000000   rip = 0x000000010147f9bb
07:08:37     INFO -      rsp = 0x00007fff5fbfcd60   rbp = 0x00007fff5fbfcd80
07:08:37     INFO -      Found by: call frame info
07:08:37     INFO -   3  XUL!nsCycleCollector::Collect(ccType, js::SliceBudget&, nsICycleCollectorListener*, bool) [nsCycleCollector.cpp:adb589480eb4 : 3612 + 0xa]
07:08:37     INFO -      rbx = 0x0000000109439000   r12 = 0x00007fff5fbfce70
07:08:37     INFO -      r13 = 0x00000001014821b4   r14 = 0x00007fff5fbfce01
07:08:37     INFO -      r15 = 0x0000000000000000   rip = 0x0000000101481ebf
07:08:37     INFO -      rsp = 0x00007fff5fbfcd90   rbp = 0x00007fff5fbfcdf0
07:08:37     INFO -      Found by: call frame info
07:08:37     INFO -   4  XUL!nsCycleCollector_collectSlice(js::SliceBudget&, bool) [nsCycleCollector.cpp:adb589480eb4 : 4123 + 0xf]
07:08:37     INFO -      rbx = 0x00000001003069d0   r12 = 0x00000001129b61c0
07:08:37     INFO -      r13 = 0x0000000100331602   r14 = 0x00007fff5fbfce70
07:08:37     INFO -      r15 = 0x0000000000000000   rip = 0x0000000101483e19
07:08:37     INFO -      rsp = 0x00007fff5fbfce00   rbp = 0x00007fff5fbfce20
07:08:37     INFO -      Found by: call frame info
07:08:37     INFO -   5  XUL!nsJSContext::RunCycleCollectorSlice() [nsJSEnvironment.cpp:adb589480eb4 : 1573 + 0xf]
07:08:37     INFO -      rbx = 0x000000c906885db7   r12 = 0x00000001129b61c0
07:08:37     INFO -      r13 = 0x0000000100331602   r14 = 0x0000000000008000
07:08:37     INFO -      r15 = 0x00000001129b61e8   rip = 0x000000010249873c
07:08:37     INFO -      rsp = 0x00007fff5fbfce30   rbp = 0x00007fff5fbfcec0
07:08:37     INFO -      Found by: call frame info
07:08:37     INFO -   6  XUL!nsTimerImpl::Fire() [nsTimerImpl.cpp:adb589480eb4 : 613 + 0x9]
07:08:37     INFO -      rbx = 0x0000000102498a30   r12 = 0x00000001129b61c0
07:08:37     INFO -      r13 = 0x0000000100331602   r14 = 0x0000000000008000
07:08:37     INFO -      r15 = 0x00000001129b61e8   rip = 0x0000000101504a07
07:08:37     INFO -      rsp = 0x00007fff5fbfced0   rbp = 0x00007fff5fbfcf20
07:08:37     INFO -      Found by: call frame info
07:08:37     INFO -   7  XUL!nsTimerEvent::Run() [nsTimerImpl.cpp:adb589480eb4 : 700 + 0x4]
07:08:37     INFO -      rbx = 0x0000000113774590   r12 = 0x00000001003316d0
07:08:37     INFO -      r13 = 0x00000001003316d0   r14 = 0x0000000000008066
07:08:37     INFO -      r15 = 0x00000000000d2ca6   rip = 0x0000000101504d6f
07:08:37     INFO -      rsp = 0x00007fff5fbfcf30   rbp = 0x00007fff5fbfcf50
07:08:37     INFO -      Found by: call frame info
07:08:37     INFO -   8  XUL!nsThread::ProcessNextEvent(bool, bool*) [nsThread.cpp:adb589480eb4 : 867 + 0x5]
07:08:37     INFO -      rbx = 0x0000000000000000   r12 = 0x00000001003316d0
07:08:37     INFO -      r13 = 0x00000001003316d0   r14 = 0x0000000000000000
07:08:37     INFO -      r15 = 0x00000000000d2ca6   rip = 0x00000001014ffe55
07:08:37     INFO -      rsp = 0x00007fff5fbfcf60   rbp = 0x00007fff5fbfd030
07:08:37     INFO -      Found by: call frame info
07:08:37     INFO -   9  XUL!NS_ProcessPendingEvents(nsIThread*, unsigned int) [nsThreadUtils.cpp:adb589480eb4 : 219 + 0xe]
07:08:37     INFO -      rbx = 0x0000000100309f60   r12 = 0x00000001003316d0
07:08:37     INFO -      r13 = 0x00007fff5fbfd047   r14 = 0x0000000000000014
07:08:37     INFO -      r15 = 0x00000000000d2ca6   rip = 0x0000000101534e73
07:08:37     INFO -      rsp = 0x00007fff5fbfd040   rbp = 0x00007fff5fbfd070
07:08:37     INFO -      Found by: call frame info
07:08:37     INFO -  10  XUL!nsBaseAppShell::NativeEventCallback() [nsBaseAppShell.cpp:adb589480eb4 : 99 + 0xe]
07:08:37     INFO -      rbx = 0x0000000100309f60   r12 = 0x0000000000000000
07:08:37     INFO -      r13 = 0x0000000000001803   r14 = 0x00000001003316d0
07:08:37     INFO -      r15 = 0x0000000100309f00   rip = 0x00000001038d7d67
07:08:37     INFO -      rsp = 0x00007fff5fbfd080   rbp = 0x00007fff5fbfd0a0
07:08:37     INFO -      Found by: call frame info
07:08:37     INFO -  11  XUL!nsAppShell::ProcessGeckoEvents(void*) [nsAppShell.mm:adb589480eb4 : 378 + 0x7]
07:08:37     INFO -      rbx = 0x00000001006004d0   r12 = 0x000000010012ec50
07:08:37     INFO -      r13 = 0x0000000000001803   r14 = 0x000000010012ec68
07:08:37     INFO -      r15 = 0x0000000100309f60   rip = 0x000000010392a67e
07:08:37     INFO -      rsp = 0x00007fff5fbfd0b0   rbp = 0x00007fff5fbfd0f0
07:08:37     INFO -      Found by: call frame info
07:08:37     INFO -  12  CoreFoundation + 0x80680
07:08:37     INFO -      rbx = 0x00000001006004d0   r12 = 0x000000010012ec50
07:08:37     INFO -      r13 = 0x0000000000001803   r14 = 0x000000010012ec68
07:08:37     INFO -      r15 = 0x0000000100600188   rip = 0x00007fff894e9681
07:08:37     INFO -      rsp = 0x00007fff5fbfd100   rbp = 0x00007fff5fbfd100
07:08:37     INFO -      Found by: call frame info
07:08:37     INFO -  13  CoreFoundation + 0x7280c
07:08:37     INFO -      rip = 0x00007fff894db80d   rsp = 0x00007fff5fbfd110
07:08:37     INFO -      rbp = 0x00007fff5fbfd160
07:08:37     INFO -      Found by: stack scanning
07:08:37     INFO -  14  CoreFoundation + 0x71e3e
07:08:37     INFO -      rip = 0x00007fff894dae3f   rsp = 0x00007fff5fbfd170
07:08:37     INFO -      rbp = 0x00007fff5fbfde40
07:08:37     INFO -      Found by: stack scanning
07:08:37     INFO -  15  HIToolbox + 0x5ed5
07:08:37     INFO -      rip = 0x00007fff8ee98ed6   rsp = 0x00007fff5fbfd180
07:08:37     INFO -      rbp = 0x00007fff5fbfde40
07:08:37     INFO -      Found by: stack scanning

Comment 1

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

The patch that caused this was backed out, you just need to pull.

(You should probably develop against mozilla-central rather than mozilla-inbound so that you're not affected by these sorts of things).