1216776 - Crash in cycle collector while tracing GC thing (generic JS heap corruption)

Status: NEW

(Core :: Cycle Collector, defect, P3)

Description

[[:philipp]]

This bug was filed from the Socorro interface and is 
report bp-9ee2ab4e-1d12-43ba-84e7-80a512151020.
=============================================================
Crashing Thread
Frame 	Module 	Signature 	Source
0 	xul.dll 	JSObject::traceChildren(JSTracer*) 	js/src/jsobj.cpp
1 	xul.dll 	js::gc::CallTyped<TraceChildrenFunctor, JSTracer*&, void*&>(TraceChildrenFunctor, JS::TraceKind, JSTracer*&, void*&) 	js/src/jsgc.h
2 	xul.dll 	mozilla::JSGCThingParticipant::Traverse(void*, nsCycleCollectionTraversalCallback&) 	xpcom/base/CycleCollectedJSRuntime.cpp
3 	xul.dll 	CCGraphBuilder::BuildGraph(js::SliceBudget&) 	xpcom/base/nsCycleCollector.cpp
4 	xul.dll 	nsCycleCollector::MarkRoots(js::SliceBudget&) 	xpcom/base/nsCycleCollector.cpp
5 	xul.dll 	nsCycleCollector::Collect(ccType, js::SliceBudget&, nsICycleCollectorListener*, bool) 	xpcom/base/nsCycleCollector.cpp
6 	xul.dll 	nsCycleCollector_collectSlice(js::SliceBudget&, bool) 	xpcom/base/nsCycleCollector.cpp
7 	xul.dll 	mozilla::Vector<js::gcstats::Phase, 0, mozilla::MallocAllocPolicy>::`default constructor closure'() 	
8 		@0x12f70f 	
9 	xul.dll 	nsTimerImpl::Fire() 	xpcom/threads/nsTimerImpl.cpp
10 	user32.dll 	GetShellWindow 	
11 	xul.dll 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp
12 	xul.dll 	NS_ProcessNextEvent(nsIThread*, bool) 	xpcom/glue/nsThreadUtils.cpp
13 	xul.dll 	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
14 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc
15 	xul.dll 	nsThreadManager::QueryInterface(nsID const&, void**) 	xpcom/threads/nsThreadManager.cpp
16 	xul.dll 	nsAppShell::Run() 	widget/windows/nsAppShell.cpp
17 	xul.dll 	XREMain::XRE_mainRun() 	toolkit/xre/nsAppRunner.cpp
18 	xul.dll 	XREMain::XRE_main(int, char** const, nsXREAppData const*) 	toolkit/xre/nsAppRunner.cpp
19 	xul.dll 	XRE_main 	toolkit/xre/nsAppRunner.cpp
20 	kernel32.dll 	GetProcessPriorityBoost 	
21 	kernel32.dll 	GetLocaleInfoA 	
22 	xul.dll 	base::LinearHistogram::FactoryGet(std::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, int, int, unsigned int, base::Histogram::Flags) 	ipc/chromium/src/base/histogram.cc
23 	xul.dll 	`anonymous namespace'::HistogramGet(char const*, char const*, unsigned int, unsigned int, unsigned int, unsigned int, bool, base::Histogram**) 	toolkit/components/telemetry/Telemetry.cpp
24 	xul.dll 	base::Histogram::SampleSet::Accumulate(int, int, unsigned int) 	ipc/chromium/src/base/histogram.cc
25 	xul.dll 	base::Histogram::Add(int) 	ipc/chromium/src/base/histogram.cc
26 	xul.dll 	mozilla::Telemetry::Accumulate(mozilla::Telemetry::ID, unsigned int) 	toolkit/components/telemetry/Telemetry.cpp
27 	firefox.exe 	NS_internal_main(int, char**) 	browser/app/nsBrowserApp.cpp
28 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp
29 	firefox.exe 	__tmainCRTStartup 	f:/dd/vctools/crt/crtw32/startup/crt0.c:255
30 	kernel32.dll 	BaseProcessStart

this is a cross-platform signature that seems to have been introduced in firefox 40 builds for the first time. it isn't taking up much volume in crash stat data though:
https://crash-stats.mozilla.com/search/?signature=~JSObject%3A%3AtraceChildren&date=%3E2015-01-01&_facets=signature&_facets=version&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#facet-version

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'JSObject::traceChildren':
 - nightly(version 50):6 crashes from 2016-06-06.
 - aurora (version 49):20 crashes from 2016-06-07.
 - beta   (version 48):326 crashes from 2016-06-06.
 - release(version 47):96 crashes from 2016-05-31.
 - esr    (version 45):15 crashes from 2016-04-07.

Crash volume on the last weeks:
            W. N-1  W. N-2  W. N-3  W. N-4  W. N-5  W. N-6  W. N-7
 - nightly       0       0       1       2       2       0       0
 - aurora        3       4       3       2       4       2       2
 - beta         48      55      56      34      51      40      28
 - release      13       9      20       6      25      12       8
 - esr           0       1       1       2       3       3       2

Affected platforms: Windows, Mac OS X, Linux

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'JSObject::traceChildren':
 - nightly (version 51): 5 crashes from 2016-08-01.
 - aurora  (version 50): 6 crashes from 2016-08-01.
 - beta    (version 49): 133 crashes from 2016-08-02.
 - release (version 48): 189 crashes from 2016-07-25.
 - esr     (version 45): 15 crashes from 2016-05-02.

Crash volume on the last weeks (Week N is from 08-22 to 08-28):
            W. N-1  W. N-2  W. N-3
 - nightly       0       3       1
 - aurora        3       3       0
 - beta         45      45      22
 - release      52      63      36
 - esr           1       0       2

Affected platforms: Windows, Mac OS X, Linux

Crash rank on the last 7 days:
           Browser   Content     Plugin
 - nightly           #358
 - aurora  #960      #485
 - beta    #463      #466
 - release #461      #451
 - esr

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'JSObject::traceChildren':
 - nightly (version 52): 1 crash from 2016-09-19.
 - aurora  (version 51): 2 crashes from 2016-09-19.
 - beta    (version 50): 85 crashes from 2016-09-20.
 - release (version 49): 442 crashes from 2016-09-05.
 - esr     (version 45): 7 crashes from 2016-07-25.

Crash volume on the last weeks (Week N is from 10-17 to 10-23):
            W. N-1  W. N-2  W. N-3  W. N-4
 - nightly       0       0       0       1
 - aurora        0       1       0       0
 - beta         17      24      29       7
 - release     136     132     114      27
 - esr           1       0       0       1

Affected platforms: Windows, Mac OS X, Linux

Crash rank on the last 7 days:
           Browser   Content     Plugin
 - nightly
 - aurora  #1120     #586
 - beta    #1107     #418
 - release #679      #280
 - esr     #3849

Comment 4

[Andrew Overholt [:overholt]]

Andrew/Olli, seems CC-related but a quick look doesn't indicate OOMs. Any thoughts?

Comment 5

[Andrew McCreight [:mccr8]]

We're probably touching bad memory in the CC. The crash volume looks really low. #679 for browser crashes? I wouldn't worry about this unless it gets worse. It is not very actionable.

Comment 6

[Andrew Overholt [:overholt]]

A present for you when you return, Nathan :)

Comment 7

[Andrew McCreight [:mccr8]]

This is a cycle collector issue, so nothing Nathan can really help with. This just looks like a generic JS heap corruption issue.

Comment 10

[Wayne Mery (:wsmwk)]

Thunderbird crashed @ js::gc::detail::CellIsMarkedGrayIfKnown resuming laptop from sleep bp-00261654-74d0-4ccc-9d63-a6a9b0170707
I do this 1-3 times per day, but never crashed before today.
Thunderbird 52.2.1 is crashing at same rate as Firefox 54.0.1

Comment 11

[Sylvestre Ledru [:Sylvestre]]

Still impacts every version of fx.

Comment 12

[Liz Henry (:lizzard) (relman/hg->git project)]

Looks like around 300 crashes per week on release. 58 is affected but in low volume on nightly.

Comment 13

[Mike Taylor [:miketaylr]]

Let's stop tracking as a regression since this bug is so old.

Comment 14

[Andrew Overholt [:overholt]]

I forgot to say that mccr8 and I spoke about this and he said "this is a crash where the CC runs and it touches corrupted memory. There's no way to know what corrupted it."

Comment 15

[BugBot [:suhaib / :marco/ :calixte]]

Since the crash volume is low (less than 15 per week), the severity is downgraded to S3. Feel free to change it back if you think the bug is still critical.

For more information, please visit auto_nag documentation.