Closed Bug 1309448 Opened 9 years ago Closed 9 years ago

Intermittent Main app process exited normally | application crashed [@ js::gc::GCRuntime::checkAllocatorState<(js::AllowGC)1u>] after Assertion failure: !isInsideUnsafeRegion() ([AutoAssertOnGC] possible GC in GC-unsafe region)

Categories

(Core :: JavaScript: GC, defect)

Product:
Core
Component:
JavaScript: GC
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1310014

People

(Reporter: intermittent-bug-filer, Unassigned)

References

Details

(Keywords: intermittent-failure)

Crash Data

Stacktrace: 0 libxul.so!js::gc::GCRuntime::checkAllocatorState<(js::AllowGC)1u> [GCRuntime.h:b01926251add : 741 + 0x0] 1 libxul.so!js::Allocate<js::Shape, (js::AllowGC)1u> [Allocator.cpp:b01926251add : 139 + 0x14] 2 libxul.so!js::EmptyShape::new_ [Shape.cpp:b01926251add : 1478 + 0x5] 3 libxul.so!js::EmptyShape::getInitialShape [Shape.cpp:b01926251add : 1513 + 0x8] 4 libxul.so!NewObject [jsobj.cpp:b01926251add : 646 + 0x12] 5 libxul.so!js::NewObjectWithGivenTaggedProto [jsobj.cpp:b01926251add : 711 + 0xe] 6 libxul.so!CreateBlankProto [jsobjinlines.h:b01926251add : 661 + 0x11] 7 libxul.so!js::GlobalObject::createBlankPrototypeInheriting [GlobalObject.cpp:b01926251add : 624 + 0x5] 8 libxul.so!js::GenericCreatePrototype [GlobalObject.h:b01926251add : 967 + 0x10] 9 libxul.so!js::GlobalObject::resolveConstructor [GlobalObject.cpp:b01926251add : 199 + 0xf] 10 libxul.so!js::SavedFrame::create [GlobalObject.h:b01926251add : 403 + 0xd] 11 libxul.so!js::SavedStacks::createFrameFromLookup [SavedStacks.cpp:b01926251add : 1492 + 0x5] 12 libxul.so!js::SavedStacks::getOrCreateSavedFrame [SavedStacks.cpp:b01926251add : 1479 + 0x12] 13 libxul.so!js::SavedStacks::insertFrames [SavedStacks.cpp:b01926251add : 1385 + 0x8] 14 libxul.so!js::SavedStacks::saveCurrentStack [SavedStacks.cpp:b01926251add : 1152 + 0x14] 15 libxul.so!JS::CaptureCurrentStack [jsapi.cpp:b01926251add : 6684 + 0x8] 16 libxul.so!mozilla::TimelineMarker::CaptureStack [TimelineMarker.cpp:b01926251add : 52 + 0x9] 17 libxul.so!mozilla::TimelineConsumers::AddMarkerForDocShell [UniquePtr.h:b01926251add : 680 + 0xe] 18 libxul.so!mozilla::dom::TabChild::DidRequestComposite [TabChild.cpp:b01926251add : 3161 + 0x18] 19 libxul.so!mozilla::layers::ClientLayerManager::ForwardTransaction [ClientLayerManager.cpp:b01926251add : 709 + 0x5] 20 libxul.so!mozilla::layers::ClientLayerManager::EndTransaction [ClientLayerManager.cpp:b01926251add : 363 + 0x12] 21 libxul.so!nsDisplayList::PaintRoot [nsDisplayList.cpp:b01926251add : 1942 + 0x13] 22 libxul.so!nsLayoutUtils::PaintFrame [nsLayoutUtils.cpp:b01926251add : 3638 + 0x16] 23 libxul.so!PresShell::Paint [nsPresShell.cpp:b01926251add : 6362 + 0x1a] 24 libxul.so!mozilla::dom::TabChild::RecvSetDocShellIsActive [TabChild.cpp:b01926251add : 2712 + 0x24] 25 libxul.so!mozilla::dom::TabChild::ForcePaint [TabChild.cpp:b01926251add : 3397 + 0x1d] 26 libxul.so!InterruptCallback [ProcessHangMonitor.cpp:b01926251add : 312 + 0xb] 27 libxul.so!InvokeInterruptCallback [Runtime.cpp:b01926251add : 539 + 0x5] 28 0x7fe7df8cdd20 29 0x7fe7df8ca888 30 libxul.so!EnterBaseline [BaselineJIT.cpp:b01926251add : 155 + 0x3] 31 libxul.so!js::jit::EnterBaselineMethod [BaselineJIT.cpp:b01926251add : 193 + 0xb] Looks like this is fallout from bug 1279086.
Blocks: 1279086
Flags: needinfo?(wmccloskey)
This is also showing up on Nightly. (TimelineMarker::CaptureStack() getting called during the interrupt callback.) bp-cff04703-87fe-4366-afb8-6087e2161013 bp-763cb9c5-cda3-41ff-90d8-638d72161013 bp-a73f1004-8e1b-494c-a86c-725002161013 etc., though only a handful of these crashes.
Crash Signature: [@ js::Shape* js::Allocate<T> ] [@ js::Shape* js::Allocate<T> ]
[@ js::gc::GCRuntime::verifyIsSafeToGC ] has a couple of crashes on Nightly that look like this. [@ js::gc::GCRuntime::checkAllocatorState<T> ] has two crashes on Nightly, one like this and one like the Font Fact one.
Crash Signature: [@ js::Shape* js::Allocate<T> ] [@ js::Shape* js::Allocate<T> ] → [@ js::Shape* js::Allocate<T> ] [@ js::Shape* js::Allocate<T> ] [@ js::gc::GCRuntime::verifyIsSafeToGC ]
See Also: → 1310014
Status: NEW → RESOLVED
Closed: 9 years ago
Flags: needinfo?(wmccloskey)
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.