Intermittent test_quit_restart.py TestQuitRestart.test_in_app_restart_with_callback | application crashed [@ mozilla::LinkedList<js::UnboxedLayout>::~LinkedList<js::UnboxedLayout>() | JSCompartment::~JSCompartment()]

RESOLVED FIXED in Firefox 52

Status

()

Core
JavaScript: GC
--
critical
RESOLVED FIXED
2 years ago
a year ago

People

(Reporter: Treeherder Bug Filer, Assigned: jonco)

Tracking

(Depends on: 1 bug, {crash, intermittent-failure})

Trunk
mozilla54
crash, intermittent-failure
Points:
---
Bug Flags:
in-testsuite -

Firefox Tracking Flags

(firefox52 fixed, firefox53 fixed, firefox54 fixed)

Details

(crash signature)

Attachments

(1 attachment)

Excerpt from gecko.log:

22:11:38     INFO -  Operating system: Windows NT
22:11:38     INFO -                    6.1.7601 Service Pack 1
22:11:38     INFO -  CPU: x86
22:11:38     INFO -       GenuineIntel family 6 model 62 stepping 4
22:11:38     INFO -       8 CPUs
22:11:38     INFO -  GPU: UNKNOWN
22:11:38     INFO -  Crash reason:  EXCEPTION_BREAKPOINT
22:11:38     INFO -  Crash address: 0x5c6be750
22:11:38     INFO -  Process uptime: 10 seconds
22:11:38     INFO -  Thread 0 (crashed)
22:11:38     INFO -   0  xul.dll!mozilla::LinkedList<js::UnboxedLayout>::~LinkedList<js::UnboxedLayout>() [LinkedList.h:bed4b65bc236 : 360 + 0x9d]
22:11:38     INFO -      eip = 0x5c6be750   esp = 0x0029f76c   ebp = 0x0029f7a8   ebx = 0x73f5310c
22:11:38     INFO -      esi = 0x68d0cf70   edi = 0x0fb0f800   eax = 0x00000000   ecx = 0x68d006ef
22:11:38     INFO -      edx = 0x00000060   efl = 0x00200206
22:11:38     INFO -      Found by: given as instruction pointer in context
22:11:38     INFO -   1  xul.dll!JSCompartment::~JSCompartment() [jscompartment.cpp:bed4b65bc236 : 118 + 0x5f]
22:11:38     INFO -      eip = 0x5c6c0231   esp = 0x0029f774   ebp = 0x0029f7a8
22:11:38     INFO -      Found by: call frame info
22:11:38     INFO -   2  xul.dll!JS::Zone::sweepCompartments(js::FreeOp *,bool,bool) [jsgc.cpp:bed4b65bc236 : 3490 + 0x16]
22:11:38     INFO -      eip = 0x5c61d854   esp = 0x0029f784   ebp = 0x0029f7a8
22:11:38     INFO -      Found by: call frame info
22:11:38     INFO -   3  xul.dll!js::gc::GCRuntime::sweepZones(js::FreeOp *,bool) [jsgc.cpp:bed4b65bc236 : 3546 + 0xf]
22:11:38     INFO -      eip = 0x5c61e764   esp = 0x0029f7b0   ebp = 0x0029f7dc
22:11:38     INFO -      Found by: call frame info
22:11:38     INFO -   4  xul.dll!js::gc::GCRuntime::incrementalCollectSlice(js::SliceBudget &,JS::gcreason::Reason,js::AutoLockForExclusiveAccess &) [jsgc.cpp:bed4b65bc236 : 5945 + 0xe]
22:11:38     INFO -      eip = 0x5c601328   esp = 0x0029f7e4   ebp = 0x0029f8b0
22:11:38     INFO -      Found by: call frame info
22:11:38     INFO -   5  xul.dll!js::gc::GCRuntime::gcCycle(bool,js::SliceBudget &,JS::gcreason::Reason) [jsgc.cpp:bed4b65bc236 : 6188 + 0xf]
22:11:38     INFO -      eip = 0x5c5f99ff   esp = 0x0029f8b8   ebp = 0x0029f93c
22:11:38     INFO -      Found by: call frame info
22:11:38     INFO -   6  xul.dll!js::gc::GCRuntime::collect(bool,js::SliceBudget,JS::gcreason::Reason) [jsgc.cpp:bed4b65bc236 : 6326 + 0x16]
22:11:38     INFO -      eip = 0x5c5ec1a6   esp = 0x0029f944   ebp = 0x0029f9d8
22:11:38     INFO -      Found by: call frame info
22:11:38     INFO -   7  xul.dll!js::gc::GCRuntime::gc(JSGCInvocationKind,JS::gcreason::Reason) [jsgc.cpp:bed4b65bc236 : 6394 + 0x4f]
22:11:38     INFO -      eip = 0x5c5f9722   esp = 0x0029f9e0   ebp = 0x0029fa08
22:11:38     INFO -      Found by: call frame info
22:11:38     INFO -   8  xul.dll!JSRuntime::destroyRuntime() [Runtime.cpp:bed4b65bc236 : 409 + 0xf]
22:11:38     INFO -      eip = 0x5c7fe266   esp = 0x0029fa10   ebp = 0x0029fa30
22:11:38     INFO -      Found by: call frame info
22:11:38     INFO -   9  xul.dll!JSContext::~JSContext() [jscntxt.cpp:bed4b65bc236 : 902 + 0xb]
22:11:38     INFO -      eip = 0x5c6c0370   esp = 0x0029fa38   ebp = 0x0029fa70
22:11:38     INFO -      Found by: call frame info
22:11:38     INFO -  10  xul.dll!js::DestroyContext(JSContext *) [jscntxt.cpp:bed4b65bc236 : 135 + 0x18]
22:11:38     INFO -      eip = 0x5c6c38ab   esp = 0x0029fa48   ebp = 0x0029fa70
22:11:38     INFO -      Found by: call frame info

This looks closely related to bug 1260375 which we discovered earlier via Firefox-UI tests. Lets mark it dependent.
Severity: normal → critical
Crash Signature: [@ mozilla::LinkedList<js::UnboxedLayout>::~LinkedList<js::UnboxedLayout>() | JSCompartment::~JSCompartment()]
Depends on: 1260375
Keywords: crash
Summary: Intermittent test_quit_restart.py TestQuitRestart.test_in_app_restart_with_callback | application crashed [@ mozilla::LinkedList<js::UnboxedLayout>::~LinkedList<js::UnboxedLayout>()] → Intermittent test_quit_restart.py TestQuitRestart.test_in_app_restart_with_callback | application crashed [@ mozilla::LinkedList<js::UnboxedLayout>::~LinkedList<js::UnboxedLayout>() | JSCompartment::~JSCompartment()]
Component: Marionette → JavaScript: GC
Product: Testing → Core
Version: Version 3 → Trunk

Updated

2 years ago
Duplicate of this bug: 1321715

Comment 3

2 years ago
5 failures in 694 pushes (0.007 failures/push) were associated with this bug in the last 7 days.  

Repository breakdown:
* mozilla-aurora: 2
* mozilla-inbound: 1
* mozilla-central: 1
* autoland: 1

Platform breakdown:
* windows8-64: 4
* windows7-32-vm: 1

For more details, see:
https://brasstacks.mozilla.com/orangefactor/?display=Bug&bugid=1313897&startday=2016-11-28&endday=2016-12-04&tree=all
Duplicate of this bug: 1321187
Duplicate of this bug: 1321940
Duplicate of this bug: 1322268
Duplicate of this bug: 1323245
Duplicate of this bug: 1323026
Duplicate of this bug: 1322807
Duplicate of this bug: 1322596
Duplicate of this bug: 1322242
Duplicate of this bug: 1321709
Duplicate of this bug: 1321381
Duplicate of this bug: 1321201
Duplicate of this bug: 1308569
Andrew, it looks like this crash increased a lot in the last couple of days. It seems to happen for a larger set of test suites. Do you know if there is someone who could have a look at it? Thanks.
Flags: needinfo?(continuation)
Flags: needinfo?(continuation) → needinfo?(jcoppeard)
10 failures in 526 pushes (0.019 failures/push) were associated with this bug in the last 7 days.  

Repository breakdown:
* mozilla-inbound: 4
* autoland: 4
* mozilla-central: 2

Platform breakdown:
* linux64: 4
* linux32: 4
* windows7-32-vm: 2

For more details, see:
https://brasstacks.mozilla.com/orangefactor/?display=Bug&bugid=1313897&startday=2016-12-12&endday=2016-12-18&tree=all
28 failures in 609 pushes (0.046 failures/push) were associated with this bug in the last 7 days. 

This is the #33 most frequent failure this week. 

Repository breakdown:
* autoland: 14
* mozilla-inbound: 9
* mozilla-central: 5

Platform breakdown:
* linux64: 11
* linux32: 8
* windows7-32-vm: 6
* windows8-64: 3

For more details, see:
https://brasstacks.mozilla.com/orangefactor/?display=Bug&bugid=1313897&startday=2016-12-19&endday=2016-12-25&tree=all
this is occurring across many different test suites (assuming the orange factor data is correct) on e10s/debug primarily.  Linux is the most common failure here.

I see it is common for this assertion to be hit, then we crash:
 07:01:19     INFO - Assertion failure: isEmpty() (failing this assertion means this LinkedList's creator is buggy: it should have removed all this list's elements before the list's destruction), at /builds/slave/autoland-lx-d-0000000000000000/build/src/obj-firefox/dist/include/mozilla/LinkedList.h:453

:waldo, I see that you wrote the code for the assertion which is firing (not to say that is the cause- maybe you could help uncover more data as to why we are hitting this?
Flags: needinfo?(jwalden+bmo)
5 failures in 305 pushes (0.016 failures/push) were associated with this bug in the last 7 days.  

Repository breakdown:
* autoland: 4
* mozilla-inbound: 1

Platform breakdown:
* linux32: 4
* linux64: 1

For more details, see:
https://brasstacks.mozilla.com/orangefactor/?display=Bug&bugid=1313897&startday=2016-12-26&endday=2017-01-01&tree=all
19 failures in 563 pushes (0.034 failures/push) were associated with this bug in the last 7 days.  

Repository breakdown:
* autoland: 11
* mozilla-inbound: 5
* mozilla-central: 3

Platform breakdown:
* linux64: 10
* linux32: 4
* windows8-64: 2
* osx-10-10: 2
* windows7-32-vm: 1

For more details, see:
https://brasstacks.mozilla.com/orangefactor/?display=Bug&bugid=1313897&startday=2017-01-02&endday=2017-01-08&tree=all
25 failures in 722 pushes (0.035 failures/push) were associated with this bug in the last 7 days.  

Repository breakdown:
* mozilla-inbound: 10
* autoland: 9
* mozilla-central: 5
* graphics: 1

Platform breakdown:
* linux32: 10
* linux64: 9
* windows8-64: 3
* osx-10-10: 2
* windows7-32-vm: 1

For more details, see:
https://brasstacks.mozilla.com/orangefactor/?display=Bug&bugid=1313897&startday=2017-01-09&endday=2017-01-15&tree=all
20 failures in 690 pushes (0.029 failures/push) were associated with this bug in the last 7 days.  

Repository breakdown:
* mozilla-inbound: 14
* autoland: 5
* try: 1

Platform breakdown:
* linux32: 13
* windows7-32-vm: 4
* linux64: 3

For more details, see:
https://brasstacks.mozilla.com/orangefactor/?display=Bug&bugid=1313897&startday=2017-01-16&endday=2017-01-22&tree=all
it has been ~4 weeks with no response on this bug- any chance we can get an update?
(Assignee)

Comment 25

a year ago
This is probably caused by a browser leak.  The LinkedList data structure expects to be empty when it is destroyed and asserts if it is not.

Maybe the best way forward is to suppress this assertion if we detect there is a leak.  The rest of the system will go on to report the leak in the normal way.
Flags: needinfo?(jcoppeard)
(Assignee)

Comment 26

a year ago
Created attachment 8830733 [details] [diff] [review]
bug1313897-unboxed-layout-list

Suppress the assertion if we know we leaked GC things.
Assignee: nobody → jcoppeard
Attachment #8830733 - Flags: review?(sphink)
Comment on attachment 8830733 [details] [diff] [review]
bug1313897-unboxed-layout-list

Review of attachment 8830733 [details] [diff] [review]:
-----------------------------------------------------------------

:-(
Attachment #8830733 - Flags: review?(sphink) → review+

Comment 28

a year ago
Pushed by jcoppeard@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/2622687b9a9c
Suppress assertion about non-empty UnboxedLayout list if GC cells were leaked at shutdown r=sfink

Comment 29

a year ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/2622687b9a9c
Status: NEW → RESOLVED
Last Resolved: a year ago
status-firefox54: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla54

Comment 30

a year ago
bugherderuplift
https://hg.mozilla.org/releases/mozilla-aurora/rev/5cac4397780c
status-firefox53: --- → fixed
Flags: in-testsuite-

Comment 31

a year ago
bugherderuplift
https://hg.mozilla.org/releases/mozilla-beta/rev/23ca52f77b78
status-firefox52: --- → fixed

Updated

a year ago
Flags: needinfo?(jwalden+bmo)
You need to log in before you can comment on or make changes to this bug.