Closed
Bug 1309448
Opened 8 years ago
Closed 8 years ago
Intermittent Main app process exited normally | application crashed [@ js::gc::GCRuntime::checkAllocatorState<(js::AllowGC)1u>] after Assertion failure: !isInsideUnsafeRegion() ([AutoAssertOnGC] possible GC in GC-unsafe region)
Categories
(Core :: JavaScript: GC, defect)
Core
JavaScript: GC
Tracking
()
RESOLVED
DUPLICATE
of bug 1310014
People
(Reporter: intermittent-bug-filer, Unassigned)
References
Details
(Keywords: intermittent-failure)
Crash Data
Filed by: philringnalda [at] gmail.com https://treeherder.mozilla.org/logviewer.html#?job_id=4875392&repo=autoland https://queue.taskcluster.net/v1/task/a-_4jCIuR2Gz1ZlvmAb-3g/runs/0/artifacts/public%2Flogs%2Flive_backing.log
|
||
Comment 1•8 years ago
|
||
Stacktrace: 0 libxul.so!js::gc::GCRuntime::checkAllocatorState<(js::AllowGC)1u> [GCRuntime.h:b01926251add : 741 + 0x0] 1 libxul.so!js::Allocate<js::Shape, (js::AllowGC)1u> [Allocator.cpp:b01926251add : 139 + 0x14] 2 libxul.so!js::EmptyShape::new_ [Shape.cpp:b01926251add : 1478 + 0x5] 3 libxul.so!js::EmptyShape::getInitialShape [Shape.cpp:b01926251add : 1513 + 0x8] 4 libxul.so!NewObject [jsobj.cpp:b01926251add : 646 + 0x12] 5 libxul.so!js::NewObjectWithGivenTaggedProto [jsobj.cpp:b01926251add : 711 + 0xe] 6 libxul.so!CreateBlankProto [jsobjinlines.h:b01926251add : 661 + 0x11] 7 libxul.so!js::GlobalObject::createBlankPrototypeInheriting [GlobalObject.cpp:b01926251add : 624 + 0x5] 8 libxul.so!js::GenericCreatePrototype [GlobalObject.h:b01926251add : 967 + 0x10] 9 libxul.so!js::GlobalObject::resolveConstructor [GlobalObject.cpp:b01926251add : 199 + 0xf] 10 libxul.so!js::SavedFrame::create [GlobalObject.h:b01926251add : 403 + 0xd] 11 libxul.so!js::SavedStacks::createFrameFromLookup [SavedStacks.cpp:b01926251add : 1492 + 0x5] 12 libxul.so!js::SavedStacks::getOrCreateSavedFrame [SavedStacks.cpp:b01926251add : 1479 + 0x12] 13 libxul.so!js::SavedStacks::insertFrames [SavedStacks.cpp:b01926251add : 1385 + 0x8] 14 libxul.so!js::SavedStacks::saveCurrentStack [SavedStacks.cpp:b01926251add : 1152 + 0x14] 15 libxul.so!JS::CaptureCurrentStack [jsapi.cpp:b01926251add : 6684 + 0x8] 16 libxul.so!mozilla::TimelineMarker::CaptureStack [TimelineMarker.cpp:b01926251add : 52 + 0x9] 17 libxul.so!mozilla::TimelineConsumers::AddMarkerForDocShell [UniquePtr.h:b01926251add : 680 + 0xe] 18 libxul.so!mozilla::dom::TabChild::DidRequestComposite [TabChild.cpp:b01926251add : 3161 + 0x18] 19 libxul.so!mozilla::layers::ClientLayerManager::ForwardTransaction [ClientLayerManager.cpp:b01926251add : 709 + 0x5] 20 libxul.so!mozilla::layers::ClientLayerManager::EndTransaction [ClientLayerManager.cpp:b01926251add : 363 + 0x12] 21 libxul.so!nsDisplayList::PaintRoot [nsDisplayList.cpp:b01926251add : 1942 + 0x13] 22 libxul.so!nsLayoutUtils::PaintFrame [nsLayoutUtils.cpp:b01926251add : 3638 + 0x16] 23 libxul.so!PresShell::Paint [nsPresShell.cpp:b01926251add : 6362 + 0x1a] 24 libxul.so!mozilla::dom::TabChild::RecvSetDocShellIsActive [TabChild.cpp:b01926251add : 2712 + 0x24] 25 libxul.so!mozilla::dom::TabChild::ForcePaint [TabChild.cpp:b01926251add : 3397 + 0x1d] 26 libxul.so!InterruptCallback [ProcessHangMonitor.cpp:b01926251add : 312 + 0xb] 27 libxul.so!InvokeInterruptCallback [Runtime.cpp:b01926251add : 539 + 0x5] 28 0x7fe7df8cdd20 29 0x7fe7df8ca888 30 libxul.so!EnterBaseline [BaselineJIT.cpp:b01926251add : 155 + 0x3] 31 libxul.so!js::jit::EnterBaselineMethod [BaselineJIT.cpp:b01926251add : 193 + 0xb] Looks like this is fallout from bug 1279086.
Blocks: 1279086
Flags: needinfo?(wmccloskey)
|
||
Comment 2•8 years ago
|
||
This is also showing up on Nightly. (TimelineMarker::CaptureStack() getting called during the interrupt callback.) bp-cff04703-87fe-4366-afb8-6087e2161013 bp-763cb9c5-cda3-41ff-90d8-638d72161013 bp-a73f1004-8e1b-494c-a86c-725002161013 etc., though only a handful of these crashes.
Crash Signature: [@ js::Shape* js::Allocate<T> ] [@ js::Shape* js::Allocate<T> ]
|
|
||
Comment 3•8 years ago
|
||
[@ js::gc::GCRuntime::verifyIsSafeToGC ] has a couple of crashes on Nightly that look like this. [@ js::gc::GCRuntime::checkAllocatorState<T> ] has two crashes on Nightly, one like this and one like the Font Fact one.
Crash Signature: [@ js::Shape* js::Allocate<T> ] [@ js::Shape* js::Allocate<T> ] → [@ js::Shape* js::Allocate<T> ] [@ js::Shape* js::Allocate<T> ] [@ js::gc::GCRuntime::verifyIsSafeToGC ]
Status: NEW → RESOLVED
Closed: 8 years ago
Flags: needinfo?(wmccloskey)
Resolution: --- → DUPLICATE
| Comment hidden (Intermittent Failures Robot) |
You need to log in
before you can comment on or make changes to this bug.
Description
•