1508155 - Intermittent AddressSanitizer: access-violation z:\build\build\src\js\src\gc\Barrier.h:269 in js::InternalBarrierMethods<class JSObject *>::postBarrier(class JSObject * *,class JSObject *,class JSObject *)

Status: RESOLVED DUPLICATE of bug 1508102

(Core :: JavaScript: GC, defect)

Description

[Natalia Csoregi [:nataliaCs]]

Push with failure: https://treeherder.mozilla.org/#/jobs?repo=mozilla-central&selectedJob=212498391&revision=b3ceae83e290925f754544cff4d30ef4de9ab399&searchStr=windows%2C10%2Cx64%2Casan%2Cmochitests%2Ctest-windows10-64-asan%2Fopt-mochitest-chrome-3%2Cm%28c3%29

task details: https://tools.taskcluster.net/groups/M3Hak7IETsmy5kZv8XLTKQ/tasks/TB6T7ZZlTgWf0S5hDNU36Q/details

failure log: https://treeherder.mozilla.org/logviewer.html#?job_id=212498391&repo=mozilla-central&lineNumber=3600

13:16:31     INFO - TEST-START | Shutdown
13:16:31     INFO - Passed:  286
13:16:31     INFO - Failed:  0
13:16:31     INFO - Todo:    0
13:16:31     INFO - Mode:    non-e10s
13:16:31     INFO - Slowest: 9984ms - chrome://mochitests/content/chrome/toolkit/components/url-classifier/tests/mochitest/test_fastblock_bug1477046.html
13:16:31     INFO - SimpleTest FINISHED
13:16:31     INFO - TEST-INFO | Ran 1 Loops
13:16:31     INFO - SimpleTest FINISHED
13:16:32     INFO - GECKO(2196) | 1542546992519	Marionette	DEBUG	Received observer notification xpcom-will-shutdown
13:16:32     INFO - GECKO(2196) | 1542546992519	Marionette	INFO	Stopped listening on port 2828
13:16:32     INFO - GECKO(2196) | 1542546992519	Marionette	DEBUG	Remote service is inactive
13:16:34     INFO - GECKO(2196) | =================================================================
13:16:34    ERROR - GECKO(2196) | ==7572==ERROR: AddressSanitizer: access-violation on unknown address 0x12507acffff0 (pc 0x7ffa6a58c831 bp 0x009cd33fe810 sp 0x009cd33fe780 T0)
13:16:34     INFO - GECKO(2196) | ==7572==The signal is caused by a READ memory access.
13:16:35     INFO - GECKO(2196) |     #0 0x7ffa6a58c830 in js::InternalBarrierMethods<class JSObject *>::postBarrier(class JSObject * *,class JSObject *,class JSObject *) z:\build\build\src\js\src\gc\Barrier.h:269
13:16:35     INFO - GECKO(2196) |     #1 0x7ffa5d69ebf4 in nsXPCWrappedJS::~nsXPCWrappedJS(void) z:\build\build\src\js\xpconnect\src\XPCWrappedJS.cpp:462
13:16:35     INFO - GECKO(2196) |     #2 0x7ffa5d6eb75f in nsXPCWrappedJS::`scalar deleting destructor'(unsigned int) z:\build\build\src\js\xpconnect\src\XPCWrappedJS.cpp:460
13:16:35     INFO - GECKO(2196) |     #3 0x7ffa5b800a83 in SnowWhiteKiller::~SnowWhiteKiller(void) z:\build\build\src\xpcom\base\nsCycleCollector.cpp:2740
13:16:35     INFO - GECKO(2196) |     #4 0x7ffa5b80a3a9 in nsCycleCollector::BeginCollection(enum ccType,class nsICycleCollectorListener *) z:\build\build\src\xpcom\base\nsCycleCollector.cpp:3999
13:16:35     INFO - GECKO(2196) |     #5 0x7ffa5b80950d in nsCycleCollector::Collect(enum ccType,class js::SliceBudget &,class nsICycleCollectorListener *,bool) z:\build\build\src\xpcom\base\nsCycleCollector.cpp:3820
13:16:35     INFO - GECKO(2196) |     #6 0x7ffa5b808d5b in nsCycleCollector::ShutdownCollect(void) z:\build\build\src\xpcom\base\nsCycleCollector.cpp:3760
13:16:35     INFO - GECKO(2196) |     #7 0x7ffa5b80b9a5 in nsCycleCollector::Shutdown(bool) z:\build\build\src\xpcom\base\nsCycleCollector.cpp:4064
13:16:35     INFO - GECKO(2196) |     #8 0x7ffa5b80f558 in nsCycleCollector_shutdown(bool) z:\build\build\src\xpcom\base\nsCycleCollector.cpp:4469
13:16:35     INFO - GECKO(2196) |     #9 0x7ffa5ba4cb47 in mozilla::ShutdownXPCOM(class nsIServiceManager *) z:\build\build\src\xpcom\build\XPCOMInit.cpp:1008
13:16:35     INFO - GECKO(2196) |     #10 0x7ffa69f41d2c in ScopedXPCOMStartup::~ScopedXPCOMStartup(void) z:\build\build\src\toolkit\xre\nsAppRunner.cpp:1431
13:16:35     INFO - GECKO(2196) |     #11 0x7ffa69f60095 in XREMain::XRE_main(int,char * * const,struct mozilla::BootstrapConfig const &) z:\build\build\src\toolkit\xre\nsAppRunner.cpp:4964
13:16:35     INFO - GECKO(2196) |     #12 0x7ffa69f62326 in XRE_main(int,char * * const,struct mozilla::BootstrapConfig const &) z:\build\build\src\toolkit\xre\nsAppRunner.cpp:5028
13:16:35     INFO - GECKO(2196) |     #13 0x7ff7e93e1d5d  (Z:\task_1542545962\build\application\firefox\firefox.exe+0x140001d5d)
13:16:35     INFO - GECKO(2196) |     #14 0x7ff7e93e14a1  (Z:\task_1542545962\build\application\firefox\firefox.exe+0x1400014a1)
13:16:35     INFO - GECKO(2196) |     #15 0x7ff7e94b954b  (Z:\task_1542545962\build\application\firefox\firefox.exe+0x1400d954b)
13:16:35     INFO - GECKO(2196) |     #16 0x7ffa9b952773  (C:\Windows\System32\KERNEL32.DLL+0x180012773)
13:16:35     INFO - GECKO(2196) |     #17 0x7ffa9e240d60  (C:\Windows\SYSTEM32\ntdll.dll+0x180070d60)
13:16:35     INFO - GECKO(2196) | AddressSanitizer can not provide additional info.
13:16:35     INFO - GECKO(2196) | SUMMARY: AddressSanitizer: access-violation z:\build\build\src\js\src\gc\Barrier.h:269 in js::InternalBarrierMethods<class JSObject *>::postBarrier(class JSObject * *,class JSObject *,class JSObject *)
13:16:35     INFO - GECKO(2196) | ==7572==ABORTING
13:16:35     INFO - TEST-INFO | Main app process: exit 1
13:16:35     INFO - Buffered messages finished
13:16:35    ERROR - TEST-UNEXPECTED-FAIL | Last test finished | application terminated with exit code 1

Comment 1

[Andrew McCreight [:mccr8]]

This seems like it could really be an XPConnect bug, because we're triggering a post barrier from the nsXPCWrappedJS dtor. Jon, do you have any idea what this error in a post barrier could mean?

Comment 3

[Andrew McCreight [:mccr8]]

I'll move my ni over to the other bug.