Closed Bug 1293057 Opened 9 years ago Closed 8 years ago

Intermittent WebCryptoAPI/generateKey/test_failures_AES-CTR.html,test_promise.html | application crashed [@ js::HeapSlot::post] after Assertion failure: preconditionForWriteBarrierPost(owner, kind, slot, target)

Categories

(Core :: JavaScript: GC, defect, P3)

Product:
Core
Component:
JavaScript: GC
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla51
Tracking Flags:
Tracking Status
firefox50 --- fixed
firefox51 --- fixed

People

(Reporter: intermittent-bug-filer, Assigned: jonco)

References

Details

(Keywords: assertion, intermittent-failure)

Attachments

(1 file)

check-promise-api
4.69 KB, patch
till
: review+
Details | Diff | Splinter Review
Keywords: assertion
Looks like that assertion caught something!
Summary: Intermittent /WebCryptoAPI/generateKey/test_failures_AES-CTR.html | application crashed [@ js::HeapSlot::post] after Assertion failure: preconditionForWriteBarrierPost(owner, kind, slot, target) → Intermittent /WebCryptoAPI/generateKey/test_failures_AES-CTR.html,test_promise.html | application crashed [@ js::HeapSlot::post] after Assertion failure: preconditionForWriteBarrierPost(owner, kind, slot, target)
These crashes are coming from within the JS promise implementation: 05:45:42 INFO - Thread 0 (crashed) 05:45:42 INFO - 0 libxul.so!js::HeapSlot::post [Barrier.h:5a3b356bd3fb : 704 + 0x18] 05:45:42 INFO - eip = 0xb114e9b0 esp = 0xbfe5c300 ebp = 0xbfe5c318 ebx = 0xb60b3cb8 05:45:42 INFO - esi = 0x00000001 edi = 0x93cdede8 eax = 0x00000000 ecx = 0xb757d8ac 05:45:42 INFO - edx = 0x00000000 efl = 0x00210286 05:45:42 INFO - Found by: given as instruction pointer in context 05:45:42 INFO - 1 libxul.so!js::NativeObject::setDenseElement [NativeObject.h:5a3b356bd3fb : 1011 + 0xd] 05:45:42 INFO - eip = 0xb3dab553 esp = 0xbfe5c320 ebp = 0xbfe5c368 ebx = 0xb60b3cb8 05:45:42 INFO - esi = 0x00000001 edi = 0x93cdede8 05:45:42 INFO - Found by: call frame info 05:45:42 INFO - 2 libxul.so!js::EnqueuePromiseReactionJob [Promise.cpp:5a3b356bd3fb : 588 + 0x11] 05:45:42 INFO - eip = 0xb441158b esp = 0xbfe5c370 ebp = 0xbfe5c458 ebx = 0xb60b3cb8 05:45:42 INFO - esi = 0xbfe5c3b8 edi = 0xbfe5c3c8 05:45:42 INFO - Found by: call frame info 05:45:42 INFO - 3 libxul.so!intrinsic_EnqueuePromiseReactionJob [SelfHosting.cpp:5a3b356bd3fb : 1830 + 0x2b] 05:45:42 INFO - eip = 0xb4319ca2 esp = 0xbfe5c460 ebp = 0xbfe5c518 ebx = 0xb60b3cb8 05:45:42 INFO - esi = 0xbfe5c548 edi = 0xbfe5c4d4 05:45:42 INFO - Found by: call frame info 05:45:42 INFO - 4 0xa1deff76 05:45:42 INFO - eip = 0xa1deff76 esp = 0xbfe5c520 ebp = 0xa44e6c40 ebx = 0xbfe5c548 05:45:42 INFO - esi = 0xa44e6c70 edi = 0xaa426000 The assertion is probably caused by trying to write an objected that is marked gray into the slot of a black object.
As a first step, let's add compartment checking assertions to public promise API functions. These will assert when gray objects pass through the API and will move the assertion failures to somewhere that should make it more obvious what's going wrong.
Assignee: nobody → jcoppeard
Attachment #8784320 - Flags: review?(till)
Comment on attachment 8784320 [details] [diff] [review] check-promise-api Review of attachment 8784320 [details] [diff] [review]: ----------------------------------------------------------------- Makes sense. Thank you for investigating this - I'd be quite lost, I'm afraid.
Attachment #8784320 - Flags: review?(till) → review+
Pushed by jcoppeard@mozilla.com: https://hg.mozilla.org/integration/mozilla-inbound/rev/dfc92970fcef Add compartment checking assertions to promise API r=till
Keywords: leave-open
Bulk assigning P3 to all open intermittent bugs without a priority set in Firefox components per bug 1298978.
Priority: -- → P3
Very oddly, the AES-CTR wpt crashes starred under this bug went away around the time of this: https://hg.mozilla.org/mozilla-central/pushloghtml?changeset=78b89cc4c3d3 Which says is very odd, but the trends on the different trees all point at it.
status-firefox50: --- → affected
status-firefox51: --- → fixed
Keywords: leave-open
Summary: Intermittent /WebCryptoAPI/generateKey/test_failures_AES-CTR.html,test_promise.html | application crashed [@ js::HeapSlot::post] after Assertion failure: preconditionForWriteBarrierPost(owner, kind, slot, target) → Intermittent WebCryptoAPI/generateKey/test_failures_AES-CTR.html,test_promise.html | application crashed [@ js::HeapSlot::post] after Assertion failure: preconditionForWriteBarrierPost(owner, kind, slot, target)
Target Milestone: --- → mozilla51
After taking a long hard look at OrangeFactor, it became apparent that *something* made this go away on trunk in late August. I was able to narrow it down to a push from Jon: https://hg.mozilla.org/mozilla-central/pushloghtml?changeset=78b89cc4c3d3 Terrence was unconvinced that any of those patches should have had any effect on this, but the evidence on Treeherder was pretty hard to ignore. I went ahead and pushed the patches one-by-one on top of Beta to Try to narrow it down. Turns out, bug 1296639 is what apparently made these failures go away. https://treeherder.mozilla.org/#/jobs?repo=try&revision=a646ff97dbeefe65b623e1d54dcc376841a1d69a Jon, does that make any sense? Are we just wallpapering or something? Regardless, can we uplift it to Beta to at least make the permafail go away? :)
Flags: needinfo?(jcoppeard)
(In reply to Ryan VanderMeulen [:RyanVM] from comment #23) I guess that changing the timing or pattern of GCs has swept this under the carpet, because that surely doesn't fix the underlying issue. Nevertheless, I'll request an uplift.
Flags: needinfo?(jcoppeard)
"Fixed" by bug 1296639.
Status: NEW → RESOLVED
Closed: 8 years ago
status-firefox50: affected → fixed
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: