Closed Bug 1521717 Opened 5 years ago Closed 5 years ago

Intermittent GECKO(1953) | Assertion failure: !tc->isMarkedGray(), at /builds/worker/workspace/build/src/js/src/gc/GC.cpp:9035

Tracking

()

Status:

RESOLVED FIXED

Milestone:

mozilla66

Tracking Flags:

Tracking

Status

firefox-esr60

---

wontfix

firefox64

---

wontfix

firefox65

---

wontfix

firefox66

---

fixed

People

(Reporter: intermittent-bug-filer, Assigned: jonco)

References

Details

(Keywords: assertion, intermittent-failure)

Attachments

(1 file)

bug1521717-transplant-unmarking 5 years ago Jon Coppeard (:jonco) 1.36 KB, patch	sfink : review+	Details \| Diff \| Splinter Review

Treeherder Bug Filer

Reporter

Description

•

5 years ago

treeherder

Filed by: cbrindusan [at] mozilla.com

https://treeherder.mozilla.org/logviewer.html#?job_id=223237937&repo=autoland

https://queue.taskcluster.net/v1/task/G-LSf0J7RZOAUTzEAXaQ0A/runs/0/artifacts/public/logs/live_backing.log

01:40:34 INFO - TEST-START | accessible/tests/mochitest/selectable/test_menu.xul
01:40:35 INFO - GECKO(1953) | ++DOMWINDOW == 168 (0x1312b7800) [pid = 1953] [serial = 498] [outer = 0x127edb400]
01:40:35 INFO - GECKO(1953) | Assertion failure: !tc->isMarkedGray(), at /builds/worker/workspace/build/src/js/src/gc/GC.cpp:9035
01:40:36 INFO - TEST-INFO | Main app process: exit 1
01:40:36 INFO - Buffered messages finished
01:40:36 ERROR - TEST-UNEXPECTED-FAIL | accessible/tests/mochitest/selectable/test_menu.xul | application terminated with exit code 1
01:40:36 INFO - runtests.py | Application ran for: 0:03:19.248648
01:40:36 INFO - zombiecheck | Reading PID log: /var/folders/6z/j8x1h9tn4tng_6f2b7t6h42r00000x/T/tmp6m6hizpidlog
01:40:36 INFO - ==> process 1953 launched child process 1959
01:40:36 INFO - ==> process 1953 launched child process 1965
01:40:36 INFO - zombiecheck | Checking for orphan process with PID: 1965
01:40:36 INFO - zombiecheck | Checking for orphan process with PID: 1959
01:40:36 INFO - mozcrash Copy/paste: /Users/cltbld/tasks/task_1548148458/build/macosx64-minidump_stackwalk /var/folders/6z/j8x1h9tn4tng_6f2b7t6h42r00000x/T/tmpjCwrlQ.mozrunner/minidumps/F3698C73-07A9-4D4E-859C-A730E9AD515F.dmp /Users/cltbld/tasks/task_1548148458/build/symbols
01:40:53 INFO - mozcrash Saved minidump as /Users/cltbld/tasks/task_1548148458/build/blobber_upload_dir/F3698C73-07A9-4D4E-859C-A730E9AD515F.dmp
01:40:53 INFO - mozcrash Saved app info as /Users/cltbld/tasks/task_1548148458/build/blobber_upload_dir/F3698C73-07A9-4D4E-859C-A730E9AD515F.extra
01:40:54 INFO - PROCESS-CRASH | accessible/tests/mochitest/selectable/test_menu.xul | application crashed [@ js::gc::detail::AssertCellIsNotGray(js::gc::Cell const*)]
01:40:54 INFO - Crash dump filename: /var/folders/6z/j8x1h9tn4tng_6f2b7t6h42r00000x/T/tmpjCwrlQ.mozrunner/minidumps/F3698C73-07A9-4D4E-859C-A730E9AD515F.dmp
01:40:54 INFO - Operating system: Mac OS X
01:40:54 INFO - 10.10.5 14F27
01:40:54 INFO - CPU: amd64
01:40:54 INFO - family 6 model 69 stepping 1
01:40:54 INFO - 4 CPUs
01:40:54 INFO -
01:40:54 INFO - GPU: UNKNOWN
01:40:54 INFO -
01:40:54 INFO - Crash reason: EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
01:40:54 INFO - Crash address: 0x0
01:40:54 INFO - Process uptime: 199 seconds
01:40:54 INFO -
01:40:54 INFO - Thread 0 (crashed)
01:40:54 INFO - 0 XUL!js::gc::detail::AssertCellIsNotGray(js::gc::Cell const*) [GC.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 9035 + 0x0]
01:40:54 INFO - rax = 0x000000010b0bbf67 rdx = 0x00007fff7de771f8
01:40:54 INFO - rcx = 0x00000001033116b0 rbx = 0x0000000114efc000
01:40:54 INFO - rsi = 0x00060a0000060a00 rdi = 0x0006090000060a03
01:40:54 INFO - rbp = 0x00007fff5c9323f0 rsp = 0x00007fff5c9323c0
01:40:54 INFO - r8 = 0x00007fff5c932370 r9 = 0x00007fff7db33300
01:40:54 INFO - r10 = 0x0000000000000064 r11 = 0x0000000000000202
01:40:54 INFO - r12 = 0x0000000114029000 r13 = 0xffff800000000000
01:40:54 INFO - r14 = 0x000032b0751b2ac0 r15 = 0x000000010c9806c0
01:40:54 INFO - rip = 0x00000001097cbf56
01:40:54 INFO - Found by: given as instruction pointer in context

Jon Coppeard (:jonco)

Assignee

Comment 1

•

5 years ago

 0  XUL!js::gc::detail::AssertCellIsNotGray(js::gc::Cell const*) [GC.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 9035 + 0x0]
 1  XUL!JS_TransplantObject(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>) [RootingAPI.h:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 375 + 0x8]
 2  XUL!xpc::TransplantObject(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>) [WrapperFactory.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 654 + 0xe]
 3  XUL!nsGlobalWindowOuter::SetNewDocument(mozilla::dom::Document*, nsISupports*, bool) [nsGlobalWindowOuter.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 2136 + 0xe]
 4  XUL!nsDocumentViewer::InitInternal(nsIWidget*, nsISupports*, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, bool, bool, bool) [nsDocumentViewer.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 967 + 0x12]
 5  XUL!nsDocumentViewer::Init(nsIWidget*, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) [nsDocumentViewer.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 714 + 0x1d]
 6  XUL!nsDocShell::SetupNewViewer(nsIContentViewer*) [nsDocShell.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 8358 + 0xd]
 7  XUL!nsDocShell::Embed(nsIContentViewer*, char const*, nsISupports*) [nsDocShell.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 6256 + 0xb]
 8  XUL!nsDocShell::CreateContentViewer(nsTSubstring<char> const&, nsIRequest*, nsIStreamListener**) [nsDocShell.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 8169 + 0x8]
 9  XUL!nsDSURIContentListener::DoContent(nsTSubstring<char> const&, bool, nsIRequest*, nsIStreamListener**, bool*) [nsDSURIContentListener.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 183 + 0x11]
10  XUL!nsDocumentOpenInfo::TryContentListener(nsIURIContentListener*, nsIChannel*) [nsURILoader.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 750 + 0x21]
11  XUL!nsDocumentOpenInfo::DispatchContent(nsIRequest*, nsISupports*) [nsURILoader.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 422 + 0x8]
12  XUL!nsDocumentOpenInfo::OnStartRequest(nsIRequest*, nsISupports*) [nsURILoader.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 299 + 0xb]
13  XUL!nsBaseChannel::OnStartRequest(nsIRequest*, nsISupports*) [nsBaseChannel.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 783 + 0x9]
14  XUL!nsInputStreamPump::OnStateStart() [nsInputStreamPump.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 488 + 0x9]
15  XUL!nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream*) [nsInputStreamPump.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 397 + 0x8]
16  XUL!non-virtual thunk to nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream*) [nsInputStreamPump.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 0 + 0x5]
17  XUL!nsInputStreamReadyEvent::Run() [nsStreamUtils.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 91 + 0x9]
18  XUL!nsThread::ProcessNextEvent(bool, bool*) [nsThread.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 1167 + 0x6]
19  XUL!NS_ProcessPendingEvents(nsIThread*, unsigned int) [nsThreadUtils.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 416 + 0xe]
20  XUL!nsBaseAppShell::NativeEventCallback() [nsBaseAppShell.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 87 + 0xa]
21  XUL!nsAppShell::ProcessGeckoEvents(void*) [nsAppShell.mm:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 465 + 0x8]
31  XUL!-[GeckoNSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] [nsAppShell.mm:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 180 + 0x2c]
33  XUL!nsAppShell::Run() [nsAppShell.mm:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 744 + 0x1a]
34  XUL!nsAppStartup::Run() [nsAppStartup.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 271 + 0x6]
35  XUL!XREMain::XRE_mainRun() [nsAppRunner.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 4388 + 0x6]
36  XUL!XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) [nsAppRunner.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 4526 + 0x8]
37  XUL!XRE_main(int, char**, mozilla::BootstrapConfig const&) [nsAppRunner.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 4610 + 0x10]

Jon Coppeard (:jonco)

Assignee

Comment 2

•

5 years ago

I think the fix in bug 1454940 was incomplete; we can return the original object so if we allow that to be gray the assertion that the returned object is not gray doesn't necessarily hold.

Assignee: nobody → jcoppeard

Blocks: 1454940

Jon Coppeard (:jonco)

Assignee

Comment 3

•

5 years ago

Attached patch bug1521717-transplant-unmarking — Details — Splinter Review

Attachment #9038194 - Flags: review?(sphink)

Steve Fink [:sfink] [:s:]

Updated

•

5 years ago

Attachment #9038194 - Flags: review?(sphink) → review+

Pulsebot

Comment 4

•

5 years ago

Pushed by jcoppeard@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/2ab90d1a0e61
Unmark original object if we are going to return it from JS_TransplantObject r=sfink

Narcis Beleuzu [:NarcisB]

Comment 5

•

5 years ago

bugherder

https://hg.mozilla.org/mozilla-central/rev/2ab90d1a0e61

Status: NEW → RESOLVED

Closed: 5 years ago

status-firefox66: --- → fixed

Resolution: --- → FIXED

Target Milestone: --- → mozilla66

Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)

Updated

•

5 years ago

Updated

•

5 years ago

status-firefox64: --- → wontfix

status-firefox65: --- → wontfix

status-firefox-esr60: --- → wontfix

Keywords: assertion

Comment hidden (Intermittent Failures Robot)

You need to log in before you can comment on or make changes to this bug.

Bugzilla

Quick Search

Intermittent GECKO(1953) | Assertion failure: !tc->isMarkedGray(), at /builds/worker/workspace/build/src/js/src/gc/GC.cpp:9035

Categories

(Core :: JavaScript: GC, defect, P5)

Tracking

()

People

(Reporter: intermittent-bug-filer, Assigned: jonco)

References

Details

(Keywords: assertion, intermittent-failure)

Crash Data

Security

(public)

User Story

Attachments

(1 file)

Description

Comment 1

Comment 2

Comment 3

Updated

Comment 4

Comment 5

Updated

Comment 6

Updated

Comment 7

Attachment

General

Description

File Name

Content Type