1192448 - Crash in JSCompartment destructor

Status: RESOLVED FIXED

(Core :: JavaScript: GC, defect)

Description

[Dave Hylands [:dhylands]]

Every time I launch B2G-desktop it immediately crashes with the following backtrace:

> (gdb) bt
> #0  0x00007f6600c89f3d in nanosleep () at ../sysdeps/unix/syscall-template.S:81
> #1  0x00007f6600c89dd4 in __sleep (seconds=0) at ../sysdeps/unix/sysv/linux/sleep.c:137
> #2  0x00007f65f54ed2ae in ah_crap_handler (signum=11) at /home/work/B2G-desktop/mozilla-central/toolkit/xre/nsSigHandlers.cpp:103
> #3  0x00007f65f54e02c0 in nsProfileLock::FatalSignalHandler (signo=11, info=0x7ffc51adcd30, context=0x7ffc51adcc00) at /home/work/B2G-desktop/mozilla-central/toolkit/profile/nsProfileLock.cpp:195
> #4  0x00007f65f5b14351 in AsmJSFaultHandler (signum=<optimized out>, info=0x7ffc51adcd30, context=0x7ffc51adcc00) at /home/work/B2G-desktop/mozilla-central/js/src/asmjs/AsmJSSignalHandlers.cpp:1135
> #5  <signal handler called>
> #6  0x00007f65f60b33c2 in ~LinkedList (this=0x7f65d75efba8, __in_chrg=<optimized out>) at ../../dist/include/mozilla/LinkedList.h:308
> #7  JSCompartment::~JSCompartment (this=0x7f65d75ef800, __in_chrg=<optimized out>) at /home/work/B2G-desktop/mozilla-central/js/src/jscompartment.cpp:90
> #8  0x00007f65f61320b7 in js_delete<JSCompartment> (p=0x7f65d75ef800) at ../../dist/include/js/Utility.h:254
> #9  sweepCompartments (keepAtleastOne=false, destroyingRuntime=false, fop=0x7ffc51add3f0, this=0x7f65d75ea000) at /home/work/B2G-desktop/mozilla-central/js/src/jsgc.cpp:3604
> #10 js::gc::GCRuntime::sweepZones (this=0x7f65ee3d43d8, fop=0x7ffc51add3f0, destroyingRuntime=false) at /home/work/B2G-desktop/mozilla-central/js/src/jsgc.cpp:3645
> #11 0x00007f65f614feee in js::gc::GCRuntime::endSweepPhase (this=this@entry=0x7f65ee3d43d8, destroyingRuntime=destroyingRuntime@entry=false)
>     at /home/work/B2G-desktop/mozilla-central/js/src/jsgc.cpp:5369
> #12 0x00007f65f616d249 in js::gc::GCRuntime::incrementalCollectSlice (this=this@entry=0x7f65ee3d43d8, budget=..., reason=reason@entry=JS::gcreason::INTER_SLICE_GC)
>     at /home/work/B2G-desktop/mozilla-central/js/src/jsgc.cpp:5883
> #13 0x00007f65f616e202 in js::gc::GCRuntime::gcCycle (this=this@entry=0x7f65ee3d43d8, incremental=incremental@entry=true, budget=..., reason=reason@entry=JS::gcreason::INTER_SLICE_GC)
>     at /home/work/B2G-desktop/mozilla-central/js/src/jsgc.cpp:6063
> #14 0x00007f65f616e65a in js::gc::GCRuntime::collect (this=0x7f65ee3d43d8, incremental=incremental@entry=true, budget=..., reason=reason@entry=JS::gcreason::INTER_SLICE_GC)
>     at /home/work/B2G-desktop/mozilla-central/js/src/jsgc.cpp:6177
> #15 0x00007f65f616eca4 in js::gc::GCRuntime::gcSlice (this=<optimized out>, reason=JS::gcreason::INTER_SLICE_GC, millis=<optimized out>) at /home/work/B2G-desktop/mozilla-central/js/src/jsgc.cpp:6253
> #16 0x00007f65f407af74 in nsJSContext::GarbageCollectNow (aReason=JS::gcreason::INTER_SLICE_GC, aIncremental=nsJSContext::IncrementalGC, aShrinking=nsJSContext::NonShrinkingGC, aSliceMillis=40)
>     at /home/work/B2G-desktop/mozilla-central/dom/base/nsJSEnvironment.cpp:1325
> #17 0x00007f65f35e04c0 in nsTimerImpl::Fire (this=0x7f65cac23800) at /home/work/B2G-desktop/mozilla-central/xpcom/threads/nsTimerImpl.cpp:437
> #18 0x00007f65f35e065c in nsTimerEvent::Run (this=0x7f65dd1422c0) at /home/work/B2G-desktop/mozilla-central/xpcom/threads/TimerThread.cpp:268
> #19 0x00007f65f35dd5a7 in nsThread::ProcessNextEvent (this=0x7f660096ec70, aMayWait=<optimized out>, aResult=0x7ffc51add95f) at /home/work/B2G-desktop/mozilla-central/xpcom/threads/nsThread.cpp:867
> #20 0x00007f65f3606f4f in NS_ProcessNextEvent (aThread=<optimized out>, aMayWait=<optimized out>) at /home/work/B2G-desktop/mozilla-central/xpcom/glue/nsThreadUtils.cpp:277
> #21 0x00007f65f384bfc7 in mozilla::ipc::MessagePump::Run (this=0x7f65f0986f00, aDelegate=0x7f6600973200) at /home/work/B2G-desktop/mozilla-central/ipc/glue/MessagePump.cpp:127
> #22 0x00007f65f38239a9 in MessageLoop::RunInternal (this=this@entry=0x7f6600973200) at /home/work/B2G-desktop/mozilla-central/ipc/chromium/src/base/message_loop.cc:234
> #23 0x00007f65f38239da in RunHandler (this=0x7f6600973200) at /home/work/B2G-desktop/mozilla-central/ipc/chromium/src/base/message_loop.cc:227
> #24 MessageLoop::Run (this=0x7f6600973200) at /home/work/B2G-desktop/mozilla-central/ipc/chromium/src/base/message_loop.cc:201
> #25 0x00007f65f4e61f83 in nsBaseAppShell::Run (this=0x7f65ec4cfa80) at /home/work/B2G-desktop/mozilla-central/widget/nsBaseAppShell.cpp:165
> #26 0x00007f65f5495196 in nsAppStartup::Run (this=0x7f65eb832150) at /home/work/B2G-desktop/mozilla-central/toolkit/components/startup/nsAppStartup.cpp:280
> #27 0x00007f65f54ea8fe in XREMain::XRE_mainRun (this=this@entry=0x7ffc51addcb0) at /home/work/B2G-desktop/mozilla-central/toolkit/xre/nsAppRunner.cpp:4288
> #28 0x00007f65f54eae0a in XREMain::XRE_main (this=this@entry=0x7ffc51addcb0, argc=argc@entry=4, argv=argv@entry=0x7f66009b4fa0, aAppData=aAppData@entry=0x4369d0 <sAppData>)
>     at /home/work/B2G-desktop/mozilla-central/toolkit/xre/nsAppRunner.cpp:4385
> #29 0x00007f65f54eb0be in XRE_main (argc=4, argv=0x7f66009b4fa0, aAppData=0x4369d0 <sAppData>, aFlags=<optimized out>) at /home/work/B2G-desktop/mozilla-central/toolkit/xre/nsAppRunner.cpp:4474
> #30 0x00000000004051a7 in do_main (argv=0x7f66009b4fa0, argc=4) at /home/work/B2G-desktop/mozilla-central/b2g/app/nsBrowserApp.cpp:167
> #31 main (argc=4, argv=<optimized out>) at /home/work/B2G-desktop/mozilla-central/b2g/app/nsBrowserApp.cpp:299

Comment 1

[Dave Hylands [:dhylands]]

It seems to be hitting:

Assertion failure: isEmpty(), at ../../dist/include/mozilla/LinkedList.h:308

Comment 2

[Jeff Walden [:Waldo]]

That assertion generally indicates misuse: someone's trying to destroy a LinkedList without emptying it first.  The only LinkedList in JSCompartment appears to be for UnboxedLayouts: paging bhackett.

Knowing when this arose might also be helpful to know -- any regression range, even a hazy one?

Comment 3

[Dave Hylands [:dhylands]]

I started to do a bisection and got this far:

changeset 256479:888019c4ff5b fails
changeset 256165:a4baa2a12eef fails
changeset 256008:b28d496da7bf fails
changeset 255851:51672b103c61 works

Comment 4

[Dave Hylands [:dhylands]]

Continuing the bisection I get:

changeset 256479:888019c4ff5b fails
changeset 256165:a4baa2a12eef fails
changeset 256008:b28d496da7bf fails
changeset 255988:579d50cc0ca7 fails
changeset 255968:4e05c3afe0e0 fails

changeset 255967:2f16fb18314a fails - This seems to be the culprit

changeset 255966:8ad982618f06 works
changeset 255963:502c196722eb works
changeset 255958:d1288e84b4a0 works
changeset 255948:0ebb7da63ced works
changeset 255929:c2b099fa12ee works
changeset 255851:51672b103c61 works

I'm not sure why this changeset would cause the problem:

changeset:   255967:2f16fb18314a
user:        Boris Zbarsky <[e-mail]>
date:        Mon Aug 03 11:51:57 2015 -0400
summary:     Bug 1181908.  The CompileOptions constructor should properly copy the introducerFilename and isRunOnce state.  r=luke


Perhaps its exposing a race?

ni'ing luke (since he reviewed it - bz is on PTO until 8/24)

Comment 5

[Luke Wagner [:luke]]

That's pretty bizarre.  I don't have time to dig into this, so probably just need to back out.  But before that, Terrence, any idea what this could be?

Comment 6

[Andrew McCreight [:mccr8]]

That's already been backed out for causing bug 1191465.

Comment 7

[Boris Zbarsky [:bzbarsky]]

This is fixed by https://hg.mozilla.org/integration/mozilla-inbound/rev/8cd6dd07c27a