Closed Bug 1191259 Opened 4 years ago Closed 4 years ago

Assertion failure: isEmpty(), at dist\include\mozilla/LinkedList.h:308

Categories

(Core :: JavaScript: GC, defect)

defect
Not set

Tracking

()

RESOLVED DUPLICATE of bug 1191465

People

(Reporter: jya, Unassigned)

References

()

Details

Hitting this extremely often, simply using YouTube.

Started since yesterday's pull.
LinkedList.h hasn't changed since February. Look upwards the stack to find the actual culprit and reassign.
Got a crash in the main thread, while playing a YouTube video:
0   0x0000000107df5393 mozilla::LinkedList<js::UnboxedLayout>::~LinkedList() + 83
1   0x0000000107deba55 mozilla::LinkedList<js::UnboxedLayout>::~LinkedList() + 21
2   0x0000000107dc6d47 JSCompartment::~JSCompartment() + 199
3   0x0000000107dc7035 JSCompartment::~JSCompartment() + 21
4   0x0000000107e68043 void js_delete<JSCompartment>(JSCompartment*) + 35
5   0x0000000107e7058f JS::Zone::sweepCompartments(js::FreeOp*, bool, bool) + 431
6   0x0000000107e709a2 js::gc::GCRuntime::sweepZones(js::FreeOp*, bool) + 802
7   0x0000000107e77e7d js::gc::GCRuntime::endSweepPhase(bool) + 861
8   0x0000000107e7a096 js::gc::GCRuntime::incrementalCollectSlice(js::SliceBudget&, JS::gcreason::Reason) + 1078
9   0x0000000107e7a912 js::gc::GCRuntime::gcCycle(bool, js::SliceBudget&, JS::gcreason::Reason) + 626
10  0x0000000107e7b1c6 js::gc::GCRuntime::collect(bool, js::SliceBudget, JS::gcreason::Reason) + 1110
11  0x0000000107e7b665 js::gc::GCRuntime::gcSlice(JS::gcreason::Reason, long long) + 181
12  0x0000000107e57752 js::gc::GCRuntime::notifyDidPaint() + 258
13  0x0000000107e5763c JS::NotifyDidPaint(JSRuntime*) + 28
14  0x00000001026e6775 nsXPConnect::NotifyDidPaint() + 37
15  0x000000010567a32c nsRefreshDriver::Tick(long long, mozilla::TimeStamp) + 4604
16  0x0000000105682926 mozilla::RefreshDriverTimer::TickDriver(nsRefreshDriver*, long long, mozilla::TimeStamp) + 102
17  0x0000000105682815 mozilla::RefreshDriverTimer::Tick(long long, mozilla::TimeStamp) + 309
18  0x00000001056826cd mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::TimeStamp) + 125
19  0x000000010568263f mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::TimeStamp) + 207
20  0x00000001056830b4 void nsRunnableMethodArguments<mozilla::TimeStamp>::apply<mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver, void (mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::*)(mozilla::TimeStamp)>(mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver*, void (mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::*)(mozilla::TimeStamp)) + 164
21  0x0000000105682e6c nsRunnableMethodImpl<void (mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::*)(mozilla::TimeStamp), true, mozilla::TimeStamp>::Run() + 140
22  0x0000000101725af3 nsThread::ProcessNextEvent(bool, bool*) + 1971
23  0x0000000101798057 NS_ProcessPendingEvents(nsIThread*, unsigned int) + 151
24  0x000000010526da66 nsBaseAppShell::NativeEventCallback() + 198
25  0x00000001052e3c3d nsAppShell::ProcessGeckoEvents(void*) + 445
26  com.apple.CoreFoundation      	0x00007fff878d9a01 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17
27  com.apple.CoreFoundation      	0x00007fff878cbb8d __CFRunLoopDoSources0 + 269
28  com.apple.CoreFoundation      	0x00007fff878cb1bf __CFRunLoopRun + 927
29  com.apple.CoreFoundation      	0x00007fff878cabd8 CFRunLoopRunSpecific + 296
30  com.apple.HIToolbox           	0x00007fff8f09156f RunCurrentEventLoopInMode + 235
31  com.apple.HIToolbox           	0x00007fff8f0911ee ReceiveNextEventCommon + 179
32  com.apple.HIToolbox           	0x00007fff8f09112b _BlockUntilNextEventMatchingListInModeWithFilter + 71
33  com.apple.AppKit              	0x00007fff88a628ab _DPSNextEvent + 978
34  com.apple.AppKit              	0x00007fff88a61e58 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 346
35  0x00000001052e2707 -[GeckoNSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 119
36  com.apple.AppKit              	0x00007fff88a57af3 -[NSApplication run] + 594
37  0x00000001052e4631 nsAppShell::Run() + 177
38  0x0000000106331c91 nsAppStartup::Run() + 161
39  0x00000001063fca6b XREMain::XRE_mainRun() + 5963
40  0x00000001063fd38d XREMain::XRE_main(int, char**, nsXREAppData const*) + 989
41  0x00000001063fd832 XRE_main + 98
42  org.mozilla.nightlydebug      	0x00000001000029db do_main(int, char**, nsIFile*) + 1819
43  org.mozilla.nightlydebug      	0x0000000100001dbd main + 301
44  org.mozilla.nightlydebug      	0x0000000100001834 start + 52
Component: MFBT → JavaScript: GC
to reproduce, I open a youtube video like this one:

https://www.youtube.com/watch?v=eyU3bRy2x44

i change the resolution to say 480p.

with a debug build there's a great chance you'll hit the assert.

also letting a video finish and switch to another will likely cause the assert
I'm also hitting this a lot with flash games on Windows.
Couple of different stacks, which are common (or very similar) after js::gc::GCRuntime::gcSlice as in comment 2.
Duplicate of this bug: 1191788
Given the unboxed object stuff in the stack in comment 2, this is probably a dupe of bug 1191465.
Status: NEW → RESOLVED
Closed: 4 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 1191465
You need to log in before you can comment on or make changes to this bug.