1293088 - Deadlock in js::GCParallelTask::joinWithLockHeld / mozilla::ipc::MessageChannel::WaitForSyncNotify

Status: RESOLVED WORKSFORME

(Core :: JavaScript: GC, defect, P3)

Description

[dx]

Attachment: content process: info threads, thread apply all bt

This bug was filed from the Socorro interface and is 
report bp-5dec0322-b0d2-47c1-809f-5ba1e2160807.
=============================================================

No idea how this happened, woke up to find it like that.

I have coredumps of both main and content processes, and a copy of all the binaries.

Sending SIGABRT to the content process seemed to recover the main process, and I was able to submit the crash report for the tab:

https://crash-stats.mozilla.com/report/index/5dec0322-b0d2-47c1-809f-5ba1e2160807

It says "libpthread-2.23.so (deleted)" because I ran a full system upgrade while firefox was running. Disregard that.

Not directly related to the deadlock but but worth mentioning: After that point, switching to other tabs didn't seem to work, showing a dotted outline when clicking them: http://dump.dequis.org/hQfQC.png (using tree style tabs addon)

When closing firefox the crash reported opened because of a "Shutdown too long". That one is:

https://crash-stats.mozilla.com/report/index/fa83958b-4b4d-45b1-9a66-e7bb52160807

Backtrace of main thread of content process at the moment of the deadlock:

#0  0x00007ff0068190af in pthread_cond_wait@@GLIBC_2.3.2 () from /usr/lib/libpthread.so.0
#1  0x00007ff00444a14a in js::ConditionVariable::wait (lock=..., this=0x7feff3e0db70) at /builds/slave/m-aurora-l64-ntly-000000000000/build/src/js/src/threading/posix/ConditionVariable.cpp:117
#2  js::ConditionVariable::wait_for (this=0x7feff3e0db70, lock=..., a_rel_time=...) at /builds/slave/m-aurora-l64-ntly-000000000000/build/src/js/src/threading/posix/ConditionVariable.cpp:133
#3  0x00007ff004325331 in js::GlobalHelperThreadState::wait (timeout=..., which=js::GlobalHelperThreadState::CONSUMER, locked=..., this=<optimized out>)
    at /builds/slave/m-aurora-l64-ntly-000000000000/build/src/js/src/vm/HelperThreads.cpp:704
#4  js::GCParallelTask::joinWithLockHeld (locked=..., this=0x7feff0d36ae8) at /builds/slave/m-aurora-l64-ntly-000000000000/build/src/js/src/vm/HelperThreads.cpp:1051
#5  js::GCParallelTask::join (this=this@entry=0x7feff0d36ae8) at /builds/slave/m-aurora-l64-ntly-000000000000/build/src/js/src/vm/HelperThreads.cpp:1060
#6  0x00007ff00497e8cf in js::gc::GCRuntime::incrementalCollectSlice (this=this@entry=0x7feff0d345c0, budget=..., reason=reason@entry=JS::gcreason::INTER_SLICE_GC, lock=...)
    at /builds/slave/m-aurora-l64-ntly-000000000000/build/src/js/src/jsgc.cpp:5984
#7  0x00007ff0042be613 in js::gc::GCRuntime::gcCycle (this=this@entry=0x7feff0d345c0, nonincrementalByAPI=nonincrementalByAPI@entry=false, budget=..., reason=reason@entry=JS::gcreason::INTER_SLICE_GC)
    at /builds/slave/m-aurora-l64-ntly-000000000000/build/src/js/src/jsgc.cpp:6157
#8  0x00007ff0042bead5 in js::gc::GCRuntime::collect (this=this@entry=0x7feff0d345c0, nonincrementalByAPI=nonincrementalByAPI@entry=false, budget=..., reason=reason@entry=JS::gcreason::INTER_SLICE_GC)
    at /builds/slave/m-aurora-l64-ntly-000000000000/build/src/js/src/jsgc.cpp:6267
#9  0x00007ff00497eebd in js::gc::GCRuntime::gcSlice (this=0x7feff0d345c0, reason=reason@entry=JS::gcreason::INTER_SLICE_GC, millis=millis@entry=40) at /builds/slave/m-aurora-l64-ntly-000000000000/build/src/js/src/jsgc.cpp:6347
#10 0x00007ff00497eedc in JS::IncrementalGCSlice (cx=<optimized out>, reason=reason@entry=JS::gcreason::INTER_SLICE_GC, millis=millis@entry=40) at /builds/slave/m-aurora-l64-ntly-000000000000/build/src/js/src/jsgc.cpp:7212
#11 0x00007ff00469aaa8 in nsJSContext::GarbageCollectNow (aReason=JS::gcreason::INTER_SLICE_GC, aIncremental=nsJSContext::IncrementalGC, aShrinking=nsJSContext::NonShrinkingGC, aSliceMillis=40)
    at /builds/slave/m-aurora-l64-ntly-000000000000/build/src/dom/base/nsJSEnvironment.cpp:1206
#12 0x00007ff003c4a0c5 in nsTimerImpl::Fire (this=0x7fef8cc09b00) at /builds/slave/m-aurora-l64-ntly-000000000000/build/src/xpcom/threads/nsTimerImpl.cpp:524
#13 0x00007ff003c49050 in nsTimerEvent::Run (this=0x7fefcf5ea3b0) at /builds/slave/m-aurora-l64-ntly-000000000000/build/src/xpcom/threads/TimerThread.cpp:286
#14 0x00007ff003c4929b in nsThread::ProcessNextEvent (this=0x7feff3e7df80, aMayWait=<optimized out>, aResult=0x7ffc7c885420) at /builds/slave/m-aurora-l64-ntly-000000000000/build/src/xpcom/threads/nsThread.cpp:1068
#15 0x00007ff003c5a4f9 in NS_ProcessNextEvent (aThread=aThread@entry=0x7feff3e7df80, aMayWait=aMayWait@entry=false) at /builds/slave/m-aurora-l64-ntly-000000000000/build/src/xpcom/glue/nsThreadUtils.cpp:290
#16 0x00007ff003cac06a in mozilla::ipc::MessagePump::Run (this=0x7feff3e4cf10, aDelegate=0x7ffc7c885610) at /builds/slave/m-aurora-l64-ntly-000000000000/build/src/ipc/glue/MessagePump.cpp:100
[...]

Backtrace of main thread of main process:

#0  0x00007fdba349f458 in pthread_cond_timedwait@@GLIBC_2.3.2 () from /usr/lib/libpthread.so.0
#1  0x00007fdba1feb13b in pt_TimedWait (timeout=<optimized out>, ml=0x7fdb80c610e0, cv=0x7fdb802f75c8) at /builds/slave/m-aurora-l64-ntly-000000000000/build/src/nsprpub/pr/src/pthreads/ptsynch.c:264
#2  PR_WaitCondVar (cvar=0x7fdb802f75c0, timeout=<optimized out>) at /builds/slave/m-aurora-l64-ntly-000000000000/build/src/nsprpub/pr/src/pthreads/ptsynch.c:398
#3  0x00007fdb942fe93e in mozilla::CondVar::Wait (this=0x7fdb7a325048, aInterval=250) at /builds/slave/m-aurora-l64-ntly-000000000000/build/src/obj-firefox/dist/include/mozilla/CondVar.h:79
#4  mozilla::Monitor::Wait (aInterval=250, this=0x7fdb7a325040) at /builds/slave/m-aurora-l64-ntly-000000000000/build/src/obj-firefox/dist/include/mozilla/Monitor.h:40
#5  mozilla::ipc::MessageChannel::WaitForSyncNotify (this=0x7fdb69fd6068) at /builds/slave/m-aurora-l64-ntly-000000000000/build/src/ipc/glue/MessageChannel.cpp:1873
#6  mozilla::ipc::MessageChannel::Send (this=0x7fdb69fd6068, aMsg=aMsg@entry=0x7fdb49e84820, aReply=aReply@entry=0x7ffe1ba2e3b0) at /builds/slave/m-aurora-l64-ntly-000000000000/build/src/ipc/glue/MessageChannel.cpp:1189
#7  0x00007fdb9280f1a8 in mozilla::jsipc::PJavaScriptParent::SendGet (this=0x7fdb81769298, objId=@0x7ffe1ba2e468: 46452, receiver=..., id=..., rs=0x7ffe1ba2e570, result=0x7ffe1ba2e540)
    at /builds/slave/m-aurora-l64-ntly-000000000000/build/src/obj-firefox/ipc/ipdl/PJavaScriptParent.cpp:495
#8  0x00007fdb9299d482 in mozilla::jsipc::JavaScriptBase<mozilla::jsipc::PJavaScriptParent>::SendGet (this=<optimized out>, objId=..., receiverVar=..., id=..., rs=<optimized out>, result=<optimized out>)
    at /builds/slave/m-aurora-l64-ntly-000000000000/build/src/js/ipc/JavaScriptBase.h:166
#9  0x00007fdb929a25b5 in mozilla::jsipc::WrapperOwner::get (this=this@entry=0x7fdb81769280, cx=cx@entry=0x7fdb8d978000, proxy=..., proxy@entry=..., receiver=..., receiver@entry=..., id=..., id@entry=..., vp=..., vp@entry=...)
    at /builds/slave/m-aurora-l64-ntly-000000000000/build/src/js/ipc/WrapperOwner.cpp:500
#10 0x00007fdb929a2845 in CPOWProxyHandler::get (this=<optimized out>, cx=0x7fdb8d978000, proxy=..., receiver=..., id=..., vp=...) at /builds/slave/m-aurora-l64-ntly-000000000000/build/src/js/ipc/WrapperOwner.cpp:355
#11 0x00007fdb9495b846 in js::Proxy::get (vp=..., id=..., receiver_=..., proxy=..., cx=0x7fdb8d978000) at /builds/slave/m-aurora-l64-ntly-000000000000/build/src/js/src/proxy/Proxy.cpp:310
#12 js::proxy_GetProperty (cx=0x7fdb8d978000, obj=..., receiver=..., id=..., vp=...) at /builds/slave/m-aurora-l64-ntly-000000000000/build/src/js/src/proxy/Proxy.cpp:583
#13 0x00007fdb9496ba39 in js::GetProperty (vp=..., id=..., receiver=..., obj=..., cx=0x7fdb8d978000) at /builds/slave/m-aurora-l64-ntly-000000000000/build/src/js/src/vm/NativeObject.h:1477
#14 js::Wrapper::get (this=this@entry=0x7fdb9674fe80 <js::CrossCompartmentWrapper::singleton>, cx=cx@entry=0x7fdb8d978000, proxy=..., proxy@entry=..., receiver=..., id=..., id@entry=..., vp=..., vp@entry=...)
    at /builds/slave/m-aurora-l64-ntly-000000000000/build/src/js/src/proxy/Wrapper.cpp:143
#15 0x00007fdb9495b4f4 in js::CrossCompartmentWrapper::get (vp=..., id=..., receiver=..., wrapper=..., cx=0x7fdb8d978000, this=0x7fdb9674fe80 <js::CrossCompartmentWrapper::singleton>)
    at /builds/slave/m-aurora-l64-ntly-000000000000/build/src/js/src/proxy/CrossCompartmentWrapper.cpp:205
#16 js::Proxy::get (vp=..., id=..., receiver_=..., proxy=..., cx=0x7fdb8d978000, cx@entry=0x7fdb9674fe80 <js::CrossCompartmentWrapper::singleton>) at /builds/slave/m-aurora-l64-ntly-000000000000/build/src/js/src/proxy/Proxy.cpp:310
[...]

Full backtraces of all threads attached.

Comment 1

[dx]

Attachment: main process: info threads, thread apply all bt

Comment 2

[Emil Pasca [:emilpasca]]

I am assigning a component to this issue in order to involve the development team and get an opinion on this.

Comment 3

[Andrei Purice]

Closing this issue as Resolved > Worksforme since no crashes with this Signature were reported in the last 6 months.