Closed Bug 1277833 Opened 9 years ago Closed 8 years ago

[e10s] Assertion failure: typeDescrObjects.empty(), at js/src/gc/Zone.cpp:61 | runner.py | application crashed [@ JS::Zone::~Zone()]

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED
mozilla51
Tracking Status
e10s + ---
firefox49 --- wontfix
firefox50 --- fixed
firefox51 --- fixed

People

(Reporter: cbook, Assigned: mconley)

References

(Blocks 1 open bug, )

Details

(Keywords: assertion, crash, intermittent-failure)

Crash Data

https://treeherder.mozilla.org/logviewer.html#?job_id=29408604&repo=mozilla-inbound#L1385 ERROR - PROCESS-CRASH | runner.py | application crashed [@ XUL + 0x4be504d] 03:32:33 INFO - Crash dump filename: /var/folders/q3/qr1dz7h156sc9qr571g_8l4r00000w/T/tmpBwg_wH.mozrunner/minidumps/75820195-FC74-4EB2-A6FF-099A3847A3A6.dmp 03:32:33 INFO - Operating system: Mac OS X 03:32:33 INFO - 10.10.5 14F27 03:32:33 INFO - CPU: amd64 03:32:33 INFO - family 6 model 69 stepping 1 03:32:33 INFO - 4 CPUs 03:32:33 INFO - Crash reason: EXC_BAD_ACCESS / KERN_INVALID_ADDRESS 03:32:33 INFO - Crash address: 0x0 03:32:33 INFO - Process uptime: 85 seconds 03:32:33 INFO - Thread 0 (crashed) 03:32:33 INFO - 0 XUL + 0x4be504d 03:32:33 INFO - rax = 0x0000000000000000 rdx = 0x00007fff7b35a1f8 03:32:33 INFO - rcx = 0x0000000000000000 rbx = 0x00007fff7b35ac50 03:32:33 INFO - rsi = 0x00524e0000524e00 rdi = 0x00524d0000524e03 03:32:33 INFO - rbp = 0x00007fff54dbdf20 rsp = 0x00007fff54dbdf00 03:32:33 INFO - r8 = 0x00007fff54dbdeb0 r9 = 0x00007fff7af80300 03:32:33 INFO - r10 = 0x0000000000000000 r11 = 0x0000000000000246 03:32:33 INFO - r12 = 0x000000011ee580f0 r13 = 0x000000010be32390 03:32:33 INFO - r14 = 0x00000000000000d4 r15 = 0x000000010be32390 03:32:33 INFO - rip = 0x000000010fef204d 03:32:33 INFO - Found by: given as instruction pointer in context 03:32:33 INFO - 1 XUL + 0x4773ab7 03:32:33 INFO - rbp = 0x00007fff54dbdf90 rsp = 0x00007fff54dbdf30 03:32:33 INFO - rip = 0x000000010fa80ab7 03:32:33 INFO - Found by: previous frame's frame pointer 03:32:33 INFO - 2 XUL + 0x47848ed 03:32:33 INFO - rbp = 0x00007fff54dbe070 rsp = 0x00007fff54dbdfa0 03:32:33 INFO - rip = 0x000000010fa918ed 03:32:33 INFO - Found by: previous frame's frame pointer 03:32:33 INFO - 3 XUL + 0x47855a3 03:32:33 INFO - rbp = 0x00007fff54dbe0e0 rsp = 0x00007fff54dbe080 03:32:33 INFO - rip = 0x000000010fa925a3 03:32:33 INFO - Found by: previous frame's frame pointer 03:32:33 INFO - 4 XUL + 0x4785f0b 03:32:33 INFO - rbp = 0x00007fff54dbe1f0 rsp = 0x00007fff54dbe0f0 03:32:33 INFO - rip = 0x000000010fa92f0b 03:32:33 INFO - Found by: previous frame's frame pointer 03:32:33 INFO - 5 XUL + 0x4770bc6 03:32:33 INFO - rbp = 0x00007fff54dbe240 rsp = 0x00007fff54dbe200 03:32:33 INFO - rip = 0x000000010fa7dbc6 03:32:33 INFO - Found by: previous frame's frame pointer 03:32:33 INFO - 6 XUL + 0x499072a 03:32:33 INFO - rbp = 0x00007fff54dbe2d0 rsp = 0x00007fff54dbe250 03:32:33 INFO - rip = 0x000000010fc9d72a 03:32:33 INFO - Found by: previous frame's frame pointer 03:32:33 INFO - 7 XUL + 0x46f0066 03:32:33 INFO - rbp = 0x00007fff54dbe2f0 rsp = 0x00007fff54dbe2e0 03:32:33 INFO - rip = 0x000000010f9fd066 03:32:33 INFO - Found by: previous frame's frame pointer 03:32:33 INFO -
Looks like this crash happens mostly with e10s enabled only.
tracking-e10s: --- → ?
Maybe the assertion we get is related here: https://treeherder.mozilla.org/logviewer.html#?job_id=30650102&repo=mozilla-inbound#L22287 [..] 23:44:17 INFO - ERROR: GC found live Cell 0x7fb05632f418 of kind STRING at shutdown 23:44:17 INFO - ERROR: GC found live Cell 0x7fb05632f4f0 of kind STRING at shutdown 23:44:17 INFO - ERROR: GC found live Cell 0x7fb05632f610 of kind STRING at shutdown 23:44:17 INFO - ERROR: GC found live Cell 0x7fb05632f658 of kind STRING at shutdown Assertion failure: typeDescrObjects.empty(), at /home/worker/workspace/build/src/js/src/gc/Zone.cpp:61 Maybe this makes it a JS engine related crash.
Component: General → JavaScript Engine
Keywords: assertion
Summary: Intermittent runner.py | application crashed [@ XUL + 0x4be504d] → [e10s] Assertion failure: typeDescrObjects.empty(), at /home/worker/workspace/build/src/js/src/gc/Zone.cpp:61 | runner.py | application crashed [@ XUL + 0x4be504d]
See Also: → 1282113
Probably a dupe of bug 1285075 with broken symbolification (recently fixed).
Summary: [e10s] Assertion failure: typeDescrObjects.empty(), at /home/worker/workspace/build/src/js/src/gc/Zone.cpp:61 | runner.py | application crashed [@ XUL + 0x4be504d] → [e10s] Assertion failure: typeDescrObjects.empty(), at js/src/gc/Zone.cpp:61 | runner.py | application crashed [@ XUL + 0x4be504d]
Yes it is but I would dupe the other way around given that this bug has way more information.
Crash Signature: [@ JS::Zone::~Zone()]
Summary: [e10s] Assertion failure: typeDescrObjects.empty(), at js/src/gc/Zone.cpp:61 | runner.py | application crashed [@ XUL + 0x4be504d] → [e10s] Assertion failure: typeDescrObjects.empty(), at js/src/gc/Zone.cpp:61 | runner.py | application crashed [@ JS::Zone::~Zone()]
Depends on: 1290567
This went away after bug 1290567 landed.
Assignee: nobody → mconley
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla51
You need to log in before you can comment on or make changes to this bug.