Closed Bug 1521717 Opened Last year Closed Last year

Intermittent GECKO(1953) | Assertion failure: !tc->isMarkedGray(), at /builds/worker/workspace/build/src/js/src/gc/GC.cpp:9035

Categories

(Core :: JavaScript: GC, defect, P5)

defect

Tracking

()

RESOLVED FIXED
mozilla66
Tracking Status
firefox-esr60 --- wontfix
firefox64 --- wontfix
firefox65 --- wontfix
firefox66 --- fixed

People

(Reporter: intermittent-bug-filer, Assigned: jonco)

References

Details

(Keywords: assertion, intermittent-failure)

Attachments

(1 file)

Filed by: cbrindusan [at] mozilla.com

https://treeherder.mozilla.org/logviewer.html#?job_id=223237937&repo=autoland

https://queue.taskcluster.net/v1/task/G-LSf0J7RZOAUTzEAXaQ0A/runs/0/artifacts/public/logs/live_backing.log

01:40:34 INFO - TEST-START | accessible/tests/mochitest/selectable/test_menu.xul
01:40:35 INFO - GECKO(1953) | ++DOMWINDOW == 168 (0x1312b7800) [pid = 1953] [serial = 498] [outer = 0x127edb400]
01:40:35 INFO - GECKO(1953) | Assertion failure: !tc->isMarkedGray(), at /builds/worker/workspace/build/src/js/src/gc/GC.cpp:9035
01:40:36 INFO - TEST-INFO | Main app process: exit 1
01:40:36 INFO - Buffered messages finished
01:40:36 ERROR - TEST-UNEXPECTED-FAIL | accessible/tests/mochitest/selectable/test_menu.xul | application terminated with exit code 1
01:40:36 INFO - runtests.py | Application ran for: 0:03:19.248648
01:40:36 INFO - zombiecheck | Reading PID log: /var/folders/6z/j8x1h9tn4tng_6f2b7t6h42r00000x/T/tmp6m6hizpidlog
01:40:36 INFO - ==> process 1953 launched child process 1959
01:40:36 INFO - ==> process 1953 launched child process 1965
01:40:36 INFO - zombiecheck | Checking for orphan process with PID: 1965
01:40:36 INFO - zombiecheck | Checking for orphan process with PID: 1959
01:40:36 INFO - mozcrash Copy/paste: /Users/cltbld/tasks/task_1548148458/build/macosx64-minidump_stackwalk /var/folders/6z/j8x1h9tn4tng_6f2b7t6h42r00000x/T/tmpjCwrlQ.mozrunner/minidumps/F3698C73-07A9-4D4E-859C-A730E9AD515F.dmp /Users/cltbld/tasks/task_1548148458/build/symbols
01:40:53 INFO - mozcrash Saved minidump as /Users/cltbld/tasks/task_1548148458/build/blobber_upload_dir/F3698C73-07A9-4D4E-859C-A730E9AD515F.dmp
01:40:53 INFO - mozcrash Saved app info as /Users/cltbld/tasks/task_1548148458/build/blobber_upload_dir/F3698C73-07A9-4D4E-859C-A730E9AD515F.extra
01:40:54 INFO - PROCESS-CRASH | accessible/tests/mochitest/selectable/test_menu.xul | application crashed [@ js::gc::detail::AssertCellIsNotGray(js::gc::Cell const*)]
01:40:54 INFO - Crash dump filename: /var/folders/6z/j8x1h9tn4tng_6f2b7t6h42r00000x/T/tmpjCwrlQ.mozrunner/minidumps/F3698C73-07A9-4D4E-859C-A730E9AD515F.dmp
01:40:54 INFO - Operating system: Mac OS X
01:40:54 INFO - 10.10.5 14F27
01:40:54 INFO - CPU: amd64
01:40:54 INFO - family 6 model 69 stepping 1
01:40:54 INFO - 4 CPUs
01:40:54 INFO -
01:40:54 INFO - GPU: UNKNOWN
01:40:54 INFO -
01:40:54 INFO - Crash reason: EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
01:40:54 INFO - Crash address: 0x0
01:40:54 INFO - Process uptime: 199 seconds
01:40:54 INFO -
01:40:54 INFO - Thread 0 (crashed)
01:40:54 INFO - 0 XUL!js::gc::detail::AssertCellIsNotGray(js::gc::Cell const*) [GC.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 9035 + 0x0]
01:40:54 INFO - rax = 0x000000010b0bbf67 rdx = 0x00007fff7de771f8
01:40:54 INFO - rcx = 0x00000001033116b0 rbx = 0x0000000114efc000
01:40:54 INFO - rsi = 0x00060a0000060a00 rdi = 0x0006090000060a03
01:40:54 INFO - rbp = 0x00007fff5c9323f0 rsp = 0x00007fff5c9323c0
01:40:54 INFO - r8 = 0x00007fff5c932370 r9 = 0x00007fff7db33300
01:40:54 INFO - r10 = 0x0000000000000064 r11 = 0x0000000000000202
01:40:54 INFO - r12 = 0x0000000114029000 r13 = 0xffff800000000000
01:40:54 INFO - r14 = 0x000032b0751b2ac0 r15 = 0x000000010c9806c0
01:40:54 INFO - rip = 0x00000001097cbf56
01:40:54 INFO - Found by: given as instruction pointer in context

 0  XUL!js::gc::detail::AssertCellIsNotGray(js::gc::Cell const*) [GC.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 9035 + 0x0]
 1  XUL!JS_TransplantObject(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>) [RootingAPI.h:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 375 + 0x8]
 2  XUL!xpc::TransplantObject(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>) [WrapperFactory.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 654 + 0xe]
 3  XUL!nsGlobalWindowOuter::SetNewDocument(mozilla::dom::Document*, nsISupports*, bool) [nsGlobalWindowOuter.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 2136 + 0xe]
 4  XUL!nsDocumentViewer::InitInternal(nsIWidget*, nsISupports*, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, bool, bool, bool) [nsDocumentViewer.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 967 + 0x12]
 5  XUL!nsDocumentViewer::Init(nsIWidget*, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) [nsDocumentViewer.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 714 + 0x1d]
 6  XUL!nsDocShell::SetupNewViewer(nsIContentViewer*) [nsDocShell.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 8358 + 0xd]
 7  XUL!nsDocShell::Embed(nsIContentViewer*, char const*, nsISupports*) [nsDocShell.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 6256 + 0xb]
 8  XUL!nsDocShell::CreateContentViewer(nsTSubstring<char> const&, nsIRequest*, nsIStreamListener**) [nsDocShell.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 8169 + 0x8]
 9  XUL!nsDSURIContentListener::DoContent(nsTSubstring<char> const&, bool, nsIRequest*, nsIStreamListener**, bool*) [nsDSURIContentListener.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 183 + 0x11]
10  XUL!nsDocumentOpenInfo::TryContentListener(nsIURIContentListener*, nsIChannel*) [nsURILoader.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 750 + 0x21]
11  XUL!nsDocumentOpenInfo::DispatchContent(nsIRequest*, nsISupports*) [nsURILoader.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 422 + 0x8]
12  XUL!nsDocumentOpenInfo::OnStartRequest(nsIRequest*, nsISupports*) [nsURILoader.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 299 + 0xb]
13  XUL!nsBaseChannel::OnStartRequest(nsIRequest*, nsISupports*) [nsBaseChannel.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 783 + 0x9]
14  XUL!nsInputStreamPump::OnStateStart() [nsInputStreamPump.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 488 + 0x9]
15  XUL!nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream*) [nsInputStreamPump.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 397 + 0x8]
16  XUL!non-virtual thunk to nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream*) [nsInputStreamPump.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 0 + 0x5]
17  XUL!nsInputStreamReadyEvent::Run() [nsStreamUtils.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 91 + 0x9]
18  XUL!nsThread::ProcessNextEvent(bool, bool*) [nsThread.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 1167 + 0x6]
19  XUL!NS_ProcessPendingEvents(nsIThread*, unsigned int) [nsThreadUtils.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 416 + 0xe]
20  XUL!nsBaseAppShell::NativeEventCallback() [nsBaseAppShell.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 87 + 0xa]
21  XUL!nsAppShell::ProcessGeckoEvents(void*) [nsAppShell.mm:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 465 + 0x8]
31  XUL!-[GeckoNSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] [nsAppShell.mm:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 180 + 0x2c]
33  XUL!nsAppShell::Run() [nsAppShell.mm:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 744 + 0x1a]
34  XUL!nsAppStartup::Run() [nsAppStartup.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 271 + 0x6]
35  XUL!XREMain::XRE_mainRun() [nsAppRunner.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 4388 + 0x6]
36  XUL!XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) [nsAppRunner.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 4526 + 0x8]
37  XUL!XRE_main(int, char**, mozilla::BootstrapConfig const&) [nsAppRunner.cpp:c7fa6df4337cc9e42e1acfdeb25d313fc8d624a8 : 4610 + 0x10]

I think the fix in bug 1454940 was incomplete; we can return the original object so if we allow that to be gray the assertion that the returned object is not gray doesn't necessarily hold.

Assignee: nobody → jcoppeard
Blocks: 1454940
Attachment #9038194 - Flags: review?(sphink)
Attachment #9038194 - Flags: review?(sphink) → review+
Pushed by jcoppeard@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/2ab90d1a0e61
Unmark original object if we are going to return it from JS_TransplantObject r=sfink
Status: NEW → RESOLVED
Closed: Last year
Resolution: --- → FIXED
Target Milestone: --- → mozilla66
You need to log in before you can comment on or make changes to this bug.