Intermittent GECKO(1136) | Assertion failure: js::CheckGrayMarkingState(mJSRuntime), at z:/build/build/src/xpcom/base/CycleCollectedJSRuntime.cpp:1207
Categories
(Core :: JavaScript: GC, defect, P5)
Tracking
()
Tracking | Status | |
---|---|---|
firefox-esr60 | --- | unaffected |
firefox-esr68 | --- | unaffected |
firefox67 | --- | unaffected |
firefox68 | --- | unaffected |
firefox69 | --- | unaffected |
firefox70 | --- | unaffected |
firefox71 | --- | fixed |
People
(Reporter: intermittent-bug-filer, Assigned: jonco)
References
Details
(Keywords: intermittent-failure, Whiteboard: [stockwell unknown])
Attachments
(7 files)
5.88 KB,
patch
|
sfink
:
review+
|
Details | Diff | Splinter Review |
2.85 KB,
patch
|
sfink
:
review+
|
Details | Diff | Splinter Review |
2.19 KB,
patch
|
pbone
:
review+
|
Details | Diff | Splinter Review |
1.09 KB,
patch
|
sfink
:
review+
|
Details | Diff | Splinter Review |
3.12 KB,
patch
|
sfink
:
review+
|
Details | Diff | Splinter Review |
47 bytes,
text/x-phabricator-request
|
Details | Review | |
47 bytes,
text/x-phabricator-request
|
Details | Review |
Comment hidden (Intermittent Failures Robot) |
Assignee | ||
Comment 2•7 years ago
|
||
Assignee | ||
Comment 3•7 years ago
|
||
Assignee | ||
Updated•7 years ago
|
Updated•7 years ago
|
Updated•7 years ago
|
Comment 5•7 years ago
|
||
bugherder |
Assignee | ||
Comment 6•7 years ago
|
||
Comment hidden (Intermittent Failures Robot) |
Comment hidden (Intermittent Failures Robot) |
Comment hidden (Intermittent Failures Robot) |
Comment hidden (Intermittent Failures Robot) |
Comment hidden (Intermittent Failures Robot) |
Assignee | ||
Comment 12•7 years ago
|
||
Comment 13•7 years ago
|
||
Comment 14•7 years ago
|
||
Comment 15•7 years ago
|
||
bugherder |
Comment hidden (Intermittent Failures Robot) |
Comment hidden (Intermittent Failures Robot) |
Comment hidden (Intermittent Failures Robot) |
Comment hidden (Intermittent Failures Robot) |
Comment hidden (Intermittent Failures Robot) |
Assignee | ||
Comment 26•7 years ago
|
||
Updated•7 years ago
|
Comment hidden (Intermittent Failures Robot) |
Comment 28•7 years ago
|
||
Comment 29•7 years ago
|
||
bugherder |
Comment hidden (Intermittent Failures Robot) |
Comment hidden (Intermittent Failures Robot) |
Comment hidden (Intermittent Failures Robot) |
Comment hidden (Intermittent Failures Robot) |
Comment hidden (Intermittent Failures Robot) |
Comment hidden (Intermittent Failures Robot) |
Comment 42•7 years ago
|
||
Assignee | ||
Comment 43•7 years ago
|
||
Comment hidden (Intermittent Failures Robot) |
Comment hidden (Intermittent Failures Robot) |
Assignee | ||
Comment 46•7 years ago
|
||
Updated•7 years ago
|
Comment 47•7 years ago
|
||
Comment 48•7 years ago
|
||
bugherder |
Comment hidden (Intermittent Failures Robot) |
Assignee | ||
Comment 50•7 years ago
|
||
Comment hidden (Intermittent Failures Robot) |
Comment hidden (Intermittent Failures Robot) |
Comment hidden (Intermittent Failures Robot) |
Comment hidden (Intermittent Failures Robot) |
Comment hidden (Intermittent Failures Robot) |
Comment hidden (Intermittent Failures Robot) |
Comment hidden (Intermittent Failures Robot) |
Comment hidden (Intermittent Failures Robot) |
Updated•6 years ago
|
Comment hidden (Intermittent Failures Robot) |
Comment hidden (Intermittent Failures Robot) |
Comment hidden (Intermittent Failures Robot) |
Comment hidden (Intermittent Failures Robot) |
Comment hidden (Intermittent Failures Robot) |
Comment hidden (Intermittent Failures Robot) |
Comment hidden (Intermittent Failures Robot) |
Comment hidden (Intermittent Failures Robot) |
Comment 69•6 years ago
|
||
Recent failure log:
https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=225652005&repo=autoland&lineNumber=20772
06:53:59 INFO - GECKO(1076) | Assertion failure: js::CheckGrayMarkingState(mJSRuntime), at /builds/worker/workspace/build/src/xpcom/base/CycleCollectedJSRuntime.cpp:1119
21680 06:55:49 INFO - PROCESS-CRASH | Main app process exited normally | application crashed [@ mozilla::CycleCollectedJSRuntime::CheckGrayBits() const]
24917 06:55:50 INFO - TEST-UNEXPECTED-FAIL | leakcheck | tab missing output line for total leaks!
33236 07:04:13 ERROR - Return code: 1
33237 07:04:13 ERROR - Got 1 unexpected crashes
33282 [taskcluster:error] exit status 1
Comment hidden (Intermittent Failures Robot) |
Comment hidden (Intermittent Failures Robot) |
Comment hidden (Intermittent Failures Robot) |
Comment hidden (Intermittent Failures Robot) |
Comment hidden (Intermittent Failures Robot) |
Comment hidden (Intermittent Failures Robot) |
Comment 76•5 years ago
|
||
There are 20 total failures in the last 7 days: https://treeherder.mozilla.org/intermittent-failures.html#/bugdetails?startday=2019-09-29&endday=2019-10-06&tree=trunk&bug=1399866
Recent failure log: https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=269846152&repo=mozilla-central&lineNumber=15196
Comment hidden (Intermittent Failures Robot) |
Comment hidden (Intermittent Failures Robot) |
Comment 79•5 years ago
|
||
Jon, can you redirect this to someone who can look into it?
Assignee | ||
Comment 80•5 years ago
•
|
||
The recent failures all look like this:
Found black to gray edge to gray JS Object Window 0x2b51ece5f060 (compartment 0x7f6b3097c8e0)
from black JS ObjectGroup 0x298433092040 group_global edge
from gray JS Object Proxy 0x2984330d8040 (compartment 0x7f6b3097c8e0) group edge
from gray JS Object LexicalEnvironment 0x2b51ece61040 (compartment 0x7f6b3097c8e0) object slot edge
from gray JS Object Function 0x2b51ece67470 (compartment 0x7f6b3097c8e0) fun_environment edge
...
So it's complaining that we have a black object group whose global is gray, which should not be possible.
Assignee | ||
Comment 81•5 years ago
|
||
Not a fix. This patch adds some assertions that we don't ever set the realm of an ObjectGroup such that it points to a gray global object. We have these asserts already for other types of edge but this one is indirect because we store a pointer to the Realm, and get the global from that.
Comment 82•5 years ago
|
||
Comment 83•5 years ago
|
||
Backed out for assertion failures on GC.cpp
Backout link: https://hg.mozilla.org/integration/autoland/rev/e3dc5cfd4d368d281ff8938f5a232f0bf92fe6b6
Log link: https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=271361424&repo=autoland&lineNumber=21640
Assignee | ||
Comment 84•5 years ago
|
||
(In reply to Narcis Beleuzu [:NarcisB] from comment #83)
Great news, this may have found the problem.
Updated•5 years ago
|
Assignee | ||
Comment 85•5 years ago
|
||
When remapping wrappers the embedding can call this to create a new proxy object while in a realm whose global is gray. This breaks the JS API invariants and can cause black to gray GC edges to be creaated. Fix this by triggering the global's read barrier here.
Comment 86•5 years ago
|
||
Comment 87•5 years ago
|
||
bugherder |
Comment hidden (Intermittent Failures Robot) |
Assignee | ||
Comment 89•5 years ago
|
||
Closing as there are no failures since the last patches landed. If this starts happening again please file a new bug.
Updated•5 years ago
|
Comment hidden (Intermittent Failures Robot) |
Description
•