Closed Bug 1313897 Opened 3 years ago Closed 3 years ago

Intermittent test_quit_restart.py TestQuitRestart.test_in_app_restart_with_callback | application crashed [@ mozilla::LinkedList<js::UnboxedLayout>::~LinkedList<js::UnboxedLayout>() | JSCompartment::~JSCompartment()]

Categories

(Core :: JavaScript: GC, defect, critical)

defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla54
Tracking Status
firefox52 --- fixed
firefox53 --- fixed
firefox54 --- fixed

People

(Reporter: intermittent-bug-filer, Assigned: jonco)

References

(Depends on 1 open bug)

Details

(Keywords: crash, intermittent-failure)

Crash Data

Attachments

(1 file)

Excerpt from gecko.log:

22:11:38     INFO -  Operating system: Windows NT
22:11:38     INFO -                    6.1.7601 Service Pack 1
22:11:38     INFO -  CPU: x86
22:11:38     INFO -       GenuineIntel family 6 model 62 stepping 4
22:11:38     INFO -       8 CPUs
22:11:38     INFO -  GPU: UNKNOWN
22:11:38     INFO -  Crash reason:  EXCEPTION_BREAKPOINT
22:11:38     INFO -  Crash address: 0x5c6be750
22:11:38     INFO -  Process uptime: 10 seconds
22:11:38     INFO -  Thread 0 (crashed)
22:11:38     INFO -   0  xul.dll!mozilla::LinkedList<js::UnboxedLayout>::~LinkedList<js::UnboxedLayout>() [LinkedList.h:bed4b65bc236 : 360 + 0x9d]
22:11:38     INFO -      eip = 0x5c6be750   esp = 0x0029f76c   ebp = 0x0029f7a8   ebx = 0x73f5310c
22:11:38     INFO -      esi = 0x68d0cf70   edi = 0x0fb0f800   eax = 0x00000000   ecx = 0x68d006ef
22:11:38     INFO -      edx = 0x00000060   efl = 0x00200206
22:11:38     INFO -      Found by: given as instruction pointer in context
22:11:38     INFO -   1  xul.dll!JSCompartment::~JSCompartment() [jscompartment.cpp:bed4b65bc236 : 118 + 0x5f]
22:11:38     INFO -      eip = 0x5c6c0231   esp = 0x0029f774   ebp = 0x0029f7a8
22:11:38     INFO -      Found by: call frame info
22:11:38     INFO -   2  xul.dll!JS::Zone::sweepCompartments(js::FreeOp *,bool,bool) [jsgc.cpp:bed4b65bc236 : 3490 + 0x16]
22:11:38     INFO -      eip = 0x5c61d854   esp = 0x0029f784   ebp = 0x0029f7a8
22:11:38     INFO -      Found by: call frame info
22:11:38     INFO -   3  xul.dll!js::gc::GCRuntime::sweepZones(js::FreeOp *,bool) [jsgc.cpp:bed4b65bc236 : 3546 + 0xf]
22:11:38     INFO -      eip = 0x5c61e764   esp = 0x0029f7b0   ebp = 0x0029f7dc
22:11:38     INFO -      Found by: call frame info
22:11:38     INFO -   4  xul.dll!js::gc::GCRuntime::incrementalCollectSlice(js::SliceBudget &,JS::gcreason::Reason,js::AutoLockForExclusiveAccess &) [jsgc.cpp:bed4b65bc236 : 5945 + 0xe]
22:11:38     INFO -      eip = 0x5c601328   esp = 0x0029f7e4   ebp = 0x0029f8b0
22:11:38     INFO -      Found by: call frame info
22:11:38     INFO -   5  xul.dll!js::gc::GCRuntime::gcCycle(bool,js::SliceBudget &,JS::gcreason::Reason) [jsgc.cpp:bed4b65bc236 : 6188 + 0xf]
22:11:38     INFO -      eip = 0x5c5f99ff   esp = 0x0029f8b8   ebp = 0x0029f93c
22:11:38     INFO -      Found by: call frame info
22:11:38     INFO -   6  xul.dll!js::gc::GCRuntime::collect(bool,js::SliceBudget,JS::gcreason::Reason) [jsgc.cpp:bed4b65bc236 : 6326 + 0x16]
22:11:38     INFO -      eip = 0x5c5ec1a6   esp = 0x0029f944   ebp = 0x0029f9d8
22:11:38     INFO -      Found by: call frame info
22:11:38     INFO -   7  xul.dll!js::gc::GCRuntime::gc(JSGCInvocationKind,JS::gcreason::Reason) [jsgc.cpp:bed4b65bc236 : 6394 + 0x4f]
22:11:38     INFO -      eip = 0x5c5f9722   esp = 0x0029f9e0   ebp = 0x0029fa08
22:11:38     INFO -      Found by: call frame info
22:11:38     INFO -   8  xul.dll!JSRuntime::destroyRuntime() [Runtime.cpp:bed4b65bc236 : 409 + 0xf]
22:11:38     INFO -      eip = 0x5c7fe266   esp = 0x0029fa10   ebp = 0x0029fa30
22:11:38     INFO -      Found by: call frame info
22:11:38     INFO -   9  xul.dll!JSContext::~JSContext() [jscntxt.cpp:bed4b65bc236 : 902 + 0xb]
22:11:38     INFO -      eip = 0x5c6c0370   esp = 0x0029fa38   ebp = 0x0029fa70
22:11:38     INFO -      Found by: call frame info
22:11:38     INFO -  10  xul.dll!js::DestroyContext(JSContext *) [jscntxt.cpp:bed4b65bc236 : 135 + 0x18]
22:11:38     INFO -      eip = 0x5c6c38ab   esp = 0x0029fa48   ebp = 0x0029fa70
22:11:38     INFO -      Found by: call frame info

This looks closely related to bug 1260375 which we discovered earlier via Firefox-UI tests. Lets mark it dependent.
Severity: normal → critical
Crash Signature: [@ mozilla::LinkedList<js::UnboxedLayout>::~LinkedList<js::UnboxedLayout>() | JSCompartment::~JSCompartment()]
Depends on: 1260375
Keywords: crash
Summary: Intermittent test_quit_restart.py TestQuitRestart.test_in_app_restart_with_callback | application crashed [@ mozilla::LinkedList<js::UnboxedLayout>::~LinkedList<js::UnboxedLayout>()] → Intermittent test_quit_restart.py TestQuitRestart.test_in_app_restart_with_callback | application crashed [@ mozilla::LinkedList<js::UnboxedLayout>::~LinkedList<js::UnboxedLayout>() | JSCompartment::~JSCompartment()]
Component: Marionette → JavaScript: GC
Product: Testing → Core
Version: Version 3 → Trunk
Duplicate of this bug: 1321715
Duplicate of this bug: 1321187
Duplicate of this bug: 1321940
Duplicate of this bug: 1322268
Duplicate of this bug: 1323245
Duplicate of this bug: 1323026
Duplicate of this bug: 1322807
Duplicate of this bug: 1322596
Duplicate of this bug: 1322242
Duplicate of this bug: 1321709
Duplicate of this bug: 1321381
Duplicate of this bug: 1321201
Duplicate of this bug: 1308569
Andrew, it looks like this crash increased a lot in the last couple of days. It seems to happen for a larger set of test suites. Do you know if there is someone who could have a look at it? Thanks.
Flags: needinfo?(continuation)
Flags: needinfo?(continuation) → needinfo?(jcoppeard)
this is occurring across many different test suites (assuming the orange factor data is correct) on e10s/debug primarily.  Linux is the most common failure here.

I see it is common for this assertion to be hit, then we crash:
 07:01:19     INFO - Assertion failure: isEmpty() (failing this assertion means this LinkedList's creator is buggy: it should have removed all this list's elements before the list's destruction), at /builds/slave/autoland-lx-d-0000000000000000/build/src/obj-firefox/dist/include/mozilla/LinkedList.h:453

:waldo, I see that you wrote the code for the assertion which is firing (not to say that is the cause- maybe you could help uncover more data as to why we are hitting this?
Flags: needinfo?(jwalden+bmo)
it has been ~4 weeks with no response on this bug- any chance we can get an update?
This is probably caused by a browser leak.  The LinkedList data structure expects to be empty when it is destroyed and asserts if it is not.

Maybe the best way forward is to suppress this assertion if we detect there is a leak.  The rest of the system will go on to report the leak in the normal way.
Flags: needinfo?(jcoppeard)
Suppress the assertion if we know we leaked GC things.
Assignee: nobody → jcoppeard
Attachment #8830733 - Flags: review?(sphink)
Comment on attachment 8830733 [details] [diff] [review]
bug1313897-unboxed-layout-list

Review of attachment 8830733 [details] [diff] [review]:
-----------------------------------------------------------------

:-(
Attachment #8830733 - Flags: review?(sphink) → review+
Pushed by jcoppeard@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/2622687b9a9c
Suppress assertion about non-empty UnboxedLayout list if GC cells were leaked at shutdown r=sfink
https://hg.mozilla.org/mozilla-central/rev/2622687b9a9c
Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla54
Flags: needinfo?(jwalden+bmo)
See Also: → 1499525
You need to log in before you can comment on or make changes to this bug.