1191259 - Assertion failure: isEmpty(), at dist\include\mozilla/LinkedList.h:308

Status: RESOLVED DUPLICATE of bug 1191465

(Core :: JavaScript: GC, defect)

Description

[Jean-Yves Avenard [:jya]]

Hitting this extremely often, simply using YouTube.

Started since yesterday's pull.

Comment 1

[Mike Hommey [:glandium]]

LinkedList.h hasn't changed since February. Look upwards the stack to find the actual culprit and reassign.

Comment 2

[Gerald Squelart (he/him) (not at Mozilla since 2022-09-15)]

Got a crash in the main thread, while playing a YouTube video:
0   0x0000000107df5393 mozilla::LinkedList<js::UnboxedLayout>::~LinkedList() + 83
1   0x0000000107deba55 mozilla::LinkedList<js::UnboxedLayout>::~LinkedList() + 21
2   0x0000000107dc6d47 JSCompartment::~JSCompartment() + 199
3   0x0000000107dc7035 JSCompartment::~JSCompartment() + 21
4   0x0000000107e68043 void js_delete<JSCompartment>(JSCompartment*) + 35
5   0x0000000107e7058f JS::Zone::sweepCompartments(js::FreeOp*, bool, bool) + 431
6   0x0000000107e709a2 js::gc::GCRuntime::sweepZones(js::FreeOp*, bool) + 802
7   0x0000000107e77e7d js::gc::GCRuntime::endSweepPhase(bool) + 861
8   0x0000000107e7a096 js::gc::GCRuntime::incrementalCollectSlice(js::SliceBudget&, JS::gcreason::Reason) + 1078
9   0x0000000107e7a912 js::gc::GCRuntime::gcCycle(bool, js::SliceBudget&, JS::gcreason::Reason) + 626
10  0x0000000107e7b1c6 js::gc::GCRuntime::collect(bool, js::SliceBudget, JS::gcreason::Reason) + 1110
11  0x0000000107e7b665 js::gc::GCRuntime::gcSlice(JS::gcreason::Reason, long long) + 181
12  0x0000000107e57752 js::gc::GCRuntime::notifyDidPaint() + 258
13  0x0000000107e5763c JS::NotifyDidPaint(JSRuntime*) + 28
14  0x00000001026e6775 nsXPConnect::NotifyDidPaint() + 37
15  0x000000010567a32c nsRefreshDriver::Tick(long long, mozilla::TimeStamp) + 4604
16  0x0000000105682926 mozilla::RefreshDriverTimer::TickDriver(nsRefreshDriver*, long long, mozilla::TimeStamp) + 102
17  0x0000000105682815 mozilla::RefreshDriverTimer::Tick(long long, mozilla::TimeStamp) + 309
18  0x00000001056826cd mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::TimeStamp) + 125
19  0x000000010568263f mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::TimeStamp) + 207
20  0x00000001056830b4 void nsRunnableMethodArguments<mozilla::TimeStamp>::apply<mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver, void (mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::*)(mozilla::TimeStamp)>(mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver*, void (mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::*)(mozilla::TimeStamp)) + 164
21  0x0000000105682e6c nsRunnableMethodImpl<void (mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::*)(mozilla::TimeStamp), true, mozilla::TimeStamp>::Run() + 140
22  0x0000000101725af3 nsThread::ProcessNextEvent(bool, bool*) + 1971
23  0x0000000101798057 NS_ProcessPendingEvents(nsIThread*, unsigned int) + 151
24  0x000000010526da66 nsBaseAppShell::NativeEventCallback() + 198
25  0x00000001052e3c3d nsAppShell::ProcessGeckoEvents(void*) + 445
26  com.apple.CoreFoundation      	0x00007fff878d9a01 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17
27  com.apple.CoreFoundation      	0x00007fff878cbb8d __CFRunLoopDoSources0 + 269
28  com.apple.CoreFoundation      	0x00007fff878cb1bf __CFRunLoopRun + 927
29  com.apple.CoreFoundation      	0x00007fff878cabd8 CFRunLoopRunSpecific + 296
30  com.apple.HIToolbox           	0x00007fff8f09156f RunCurrentEventLoopInMode + 235
31  com.apple.HIToolbox           	0x00007fff8f0911ee ReceiveNextEventCommon + 179
32  com.apple.HIToolbox           	0x00007fff8f09112b _BlockUntilNextEventMatchingListInModeWithFilter + 71
33  com.apple.AppKit              	0x00007fff88a628ab _DPSNextEvent + 978
34  com.apple.AppKit              	0x00007fff88a61e58 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 346
35  0x00000001052e2707 -[GeckoNSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 119
36  com.apple.AppKit              	0x00007fff88a57af3 -[NSApplication run] + 594
37  0x00000001052e4631 nsAppShell::Run() + 177
38  0x0000000106331c91 nsAppStartup::Run() + 161
39  0x00000001063fca6b XREMain::XRE_mainRun() + 5963
40  0x00000001063fd38d XREMain::XRE_main(int, char**, nsXREAppData const*) + 989
41  0x00000001063fd832 XRE_main + 98
42  org.mozilla.nightlydebug      	0x00000001000029db do_main(int, char**, nsIFile*) + 1819
43  org.mozilla.nightlydebug      	0x0000000100001dbd main + 301
44  org.mozilla.nightlydebug      	0x0000000100001834 start + 52

Comment 3

[Jean-Yves Avenard [:jya]]

to reproduce, I open a youtube video like this one:

https://www.youtube.com/watch?v=eyU3bRy2x44

i change the resolution to say 480p.

with a debug build there's a great chance you'll hit the assert.

also letting a video finish and switch to another will likely cause the assert

Comment 4

[Bob Owen (:bobowen)]

I'm also hitting this a lot with flash games on Windows.
Couple of different stacks, which are common (or very similar) after js::gc::GCRuntime::gcSlice as in comment 2.

Comment 6

[Jeff Walden [:Waldo]]

http://www.profootballhof.com/hof/teams.aspx from the dup is reported to consistently crash.

Comment 7

[Andrew McCreight [:mccr8]]

Given the unboxed object stuff in the stack in comment 2, this is probably a dupe of bug 1191465.