Closed Bug 1522817 Opened 9 months ago Closed 6 months ago

Intermittent GECKO(8156) | Assertion failure: !tc->isMarkedGray(), at z:/build/build/src/js/src/gc/GC.cpp:9033

Categories

(Core :: JavaScript: GC, defect, P5)

defect

Tracking

()

RESOLVED FIXED
mozilla68
Tracking Status
firefox-esr60 --- unaffected
firefox66 --- wontfix
firefox67 --- fixed
firefox68 --- fixed

People

(Reporter: intermittent-bug-filer, Assigned: jonco)

References

Details

(Keywords: assertion, intermittent-failure, Whiteboard: [stockwell unknown])

Attachments

(2 files)

#[markdown(off)]
Filed by: ncsoregi [at] mozilla.com

https://treeherder.mozilla.org/logviewer.html#?job_id=224005777&repo=mozilla-central

https://queue.taskcluster.net/v1/task/Yme-auTkQkyye-OcSB0uYg/runs/0/artifacts/public/logs/live_backing.log

11:55:09 INFO - GECKO(8156) | --DOMWINDOW == 19 (000002058CDD9800) [pid = 1268] [serial = 602] [outer = 0000000000000000] [url = about:blank]
11:55:09 INFO - GECKO(8156) | ++DOMWINDOW == 20 (00000205846E8800) [pid = 1268] [serial = 627] [outer = 000002058A8A9400]
11:55:09 INFO - GECKO(8156) | Assertion failure: !tc->isMarkedGray(), at z:/build/build/src/js/src/gc/GC.cpp:9033
11:55:09 INFO - GECKO(8156) | ###!!! [Parent][MessageChannel] Error: (msgtype=0x1E0098,name=PBrowser::Msg_UpdateNativeWindowHandle) Channel error: cannot send/recv
11:55:09 INFO - GECKO(8156) | ###!!! [Parent][MessageChannel] Error: (msgtype=0x1E0087,name=PBrowser::Msg_Destroy) Channel error: cannot send/recv
11:55:09 INFO - GECKO(8156) | ###!!! [Parent][MessageChannel] Error: (msgtype=0x1E0098,name=PBrowser::Msg_UpdateNativeWindowHandle) Channel error: cannot send/recv
11:55:09 INFO - GECKO(8156) | ###!!! [Parent][MessageChannel] Error: (msgtype=0x1E0087,name=PBrowser::Msg_Destroy) Channel error: cannot send/recv
11:55:09 INFO - GECKO(8156) | ++DOCSHELL 0000028625DEC000 == 58 [pid = 5232] [id = {caf04ec8-39a6-4044-aa9e-2e510892812c}]
11:55:09 INFO - GECKO(8156) | ++DOMWINDOW == 126 (000002862F3B3000) [pid = 5232] [serial = 185] [outer = 0000000000000000]
11:55:09 INFO - GECKO(8156) | 2019-01-25 11:55:09: minidump.cc:1571: ERROR: MinidumpThread has a memory region problem, 0x20387faa48+0x55b8, RVA 0x0x0
11:55:09 INFO - GECKO(8156) | 2019-01-25 11:55:09: minidump.cc:1571: ERROR: MinidumpThread has a memory region problem, 0x203a7ff938+0x6c8, RVA 0x0x0
11:55:09 INFO - GECKO(8156) | 2019-01-25 11:55:09: minidump.cc:1571: ERROR: MinidumpThread has a memory region problem, 0x203a9fea68+0x1598, RVA 0x0x0
11:55:09 INFO - GECKO(8156) | 2019-01-25 11:55:09: minidump.cc:1571: ERROR: MinidumpThread has a memory region problem, 0x203abfecc8+0x1338, RVA 0x0x0
11:55:09 INFO - GECKO(8156) | 2019-01-25 11:55:09: minidump.cc:1571: ERROR: MinidumpThread has a memory region problem, 0x203adfed88+0x1278, RVA 0x0x0
11:55:09 INFO - GECKO(8156) | 2019-01-25 11:55:09: minidump.cc:1571: ERROR: MinidumpThread has a memory region problem, 0x203affe908+0x16f8, RVA 0x0x0
11:55:09 INFO - GECKO(8156) | 2019-01-25 11:55:09: minidump.cc:1571: ERROR: MinidumpThread has a memory region problem, 0x203b1febd8+0x1428, RVA 0x0x0
11:55:09 INFO - GECKO(8156) | 2019-01-25 11:55:09: minidump.cc:1571: ERROR: MinidumpThread has a memory region problem, 0x203b3feb88+0x1478, RVA 0x0x0
11:55:09 INFO - GECKO(8156) | 2019-01-25 11:55:09: minidump.cc:1571: ERROR: MinidumpThread has a memory region problem, 0x203b5fec98+0x1368, RVA 0x0x0
11:55:09 INFO - GECKO(8156) | 2019-01-25 11:55:09: minidump.cc:1571: ERROR: MinidumpThread has a memory region problem, 0x203b7fecd8+0x1328, RVA 0x0x0
11:55:09 INFO - GECKO(8156) | 2019-01-25 11:55:09: minidump.cc:1571: ERROR: MinidumpThread has a memory region problem, 0x203c03ebe8+0x1418, RVA 0x0x0
11:55:09 INFO - GECKO(8156) | 2019-01-25 11:55:09: minidump.cc:1571: ERROR: MinidumpThread has a memory region problem, 0x203c0beb88+0x1478, RVA 0x0x0
11:55:09 INFO - GECKO(8156) | 2019-01-25 11:55:09: minidump.cc:1571: ERROR: MinidumpThread has a memory region problem, 0x203c0ff198+0xe68, RVA 0x0x0
11:55:09 INFO - GECKO(8156) | 2019-01-25 11:55:09: minidump.cc:1571: ERROR: MinidumpThread has a memory region problem, 0x203c13efc8+0x1038, RVA 0x0x0
11:55:09 INFO - GECKO(8156) | 2019-01-25 11:55:09: minidump.cc:1571: ERROR: MinidumpThread has a memory region problem, 0x203c17f1d8+0xe28, RVA 0x0x0
11:55:09 INFO - GECKO(8156) | 2019-01-25 11:55:09: minidump.cc:1571: ERROR: MinidumpThread has a memory region problem, 0x203c97f778+0x888, RVA 0x0x0
11:55:09 INFO - GECKO(8156) | 2019-01-25 11:55:09: minidump.cc:1571: ERROR: MinidumpThread has a memory region problem, 0x203c9bf248+0xdb8, RVA 0x0x0
11:55:09 INFO - GECKO(8156) | 2019-01-25 11:55:09: minidump.cc:1571: ERROR: MinidumpThread has a memory region problem, 0x203d1bfb88+0x478, RVA 0x0x0
11:55:09 INFO - GECKO(8156) | 2019-01-25 11:55:09: minidump.cc:1571: ERROR: MinidumpThread has a memory region problem, 0x203d1fefc8+0x1038, RVA 0x0x0
11:55:09 INFO - GECKO(8156) | 2019-01-25 11:55:09: minidump.cc:1571: ERROR: MinidumpThread has a memory region problem, 0x203d23ebb8+0x1448, RVA 0x0x0
11:55:09 INFO - GECKO(8156) | 2019-01-25 11:55:09: minidump.cc:1571: ERROR: MinidumpThread has a memory region problem, 0x203da3faa8+0x558, RVA 0x0x0
11:55:09 INFO - GECKO(8156) | 2019-01-25 11:55:09: minidump.cc:1571: ERROR: MinidumpThread has a memory region problem, 0x203da7f6b8+0x948, RVA 0x0x0
11:55:09 INFO - GECKO(8156) | 2019-01-25 11:55:09: minidump.cc:1571: ERROR: MinidumpThread has a memory region problem, 0x203dabf178+0xe88, RVA 0x0x0
11:55:09 INFO - GECKO(8156) | 2019-01-25 11:55:09: minidump.cc:1571: ERROR: MinidumpThread has a memory region problem, 0x203daff3e8+0xc18, RVA 0x0x0
11:55:09 INFO - GECKO(8156) | 2019-01-25 11:55:09: minidump.cc:1571: ERROR: MinidumpThread has a memory region problem, 0x203db3f6a8+0x958, RVA 0x0x0
11:55:09 INFO - GECKO(8156) | 2019-01-25 11:55:09: minidump.cc:1571: ERROR: MinidumpThread has a memory region problem, 0x203e3bec68+0x1398, RVA 0x0x0
11:55:09 INFO - GECKO(8156) | 2019-01-25 11:55:09: minidump.cc:1571: ERROR: MinidumpThread has a memory region problem, 0x203e3fed08+0x12f8, RVA 0x0x0
11:55:09 INFO - GECKO(8156) | 2019-01-25 11:55:09: minidump.cc:1571: ERROR: MinidumpThread has a memory region problem, 0x203e43ec28+0x13d8, RVA 0x0x0
11:55:09 INFO - GECKO(8156) | 2019-01-25 11:55:09: minidump.cc:1571: ERROR: MinidumpThread has a memory region problem, 0x203e47ee48+0x11b8, RVA 0x0x0
11:55:09 INFO - GECKO(8156) | 2019-01-25 11:55:09: minidump.cc:1571: ERROR: MinidumpThread has a memory region problem, 0x203e4bedb8+0x1248, RVA 0x0x0
11:55:09 INFO - GECKO(8156) | 2019-01-25 11:55:09: minidump.cc:1571: ERROR: MinidumpThread has a memory region problem, 0x203e4ff158+0xea8, RVA 0x0x0
11:55:09 INFO - GECKO(8156) | ++DOMWINDOW == 127 (000002862F9D4400) [pid = 5232] [serial = 186] [outer = 000002862F3B3000]
11:55:09 INFO - GECKO(8156) | ++DOCSHELL 000002862F96C800 == 59 [pid = 5232] [id = {0ea1c523-1223-4e39-afa7-9e26d1c9f701}]
11:55:09 INFO - GECKO(8156) | ++DOMWINDOW == 128 (000002862FC0D400) [pid = 5232] [serial = 187] [outer = 0000000000000000]
11:55:09 INFO - GECKO(8156) | ++DOMWINDOW == 129 (000002862FC10400) [pid = 5232] [serial = 188] [outer = 000002862FC0D400]
11:55:09 INFO - GECKO(8156) | A content process crashed and MOZ_CRASHREPORTER_SHUTDOWN is set, shutting down

Last test running: docshell/test/navigation/test_sessionhistory.html

That assertion doesn't want to die.

Component: Document Navigation → JavaScript: GC
Flags: needinfo?(jcoppeard)
See Also: → 1521717
Duplicate of this bug: 1526156

There are 27 total failures in the last 7 days on multiple platforms: https://treeherder.mozilla.org/intermittent-failures.html#/bugdetails?startday=2019-04-19&endday=2019-04-26&tree=trunk&bug=1522817

Recent failure log: https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=242846879&repo=mozilla-central&lineNumber=42696

12:25:36 INFO - TEST-START | browser/extensions/formautofill/test/browser/browser_submission_in_private_mode.js
12:26:01 INFO - GECKO(4968) | Assertion failure: !tc->isMarkedGray(), at z:/build/build/src/js/src/gc/GC.cpp:9085
12:26:01 INFO - GECKO(4968) | Exiting due to channel error.
12:26:01 INFO - GECKO(4968) | Exiting due to channel error.
12:26:01 INFO - GECKO(4968) | Exiting due to channel error.
12:26:01 INFO - GECKO(4968) | Exiting due to channel error.
12:26:01 INFO - GECKO(4968) | Exiting due to channel error.
12:26:01 INFO - GECKO(4968) | Exiting due to channel error.
12:26:01 INFO - GECKO(4968) | [GPU 496, Main Thread] WARNING: Shutting down GPU process early due to a crash!: file z:/build/build/src/gfx/ipc/GPUParentExiting due to channel error.
12:26:01 INFO - GECKO(4968) | .cpp, line 472
12:26:01 INFO - GECKO(4968) | Exiting due to channel error.
12:26:01 INFO - GECKO(4968) | Exiting due to channel error.
12:26:01 INFO - GECKO(4968) | Exiting due to channel error.
12:26:01 INFO - TEST-INFO | Main app process: exit 1

Flags: needinfo?(jcoppeard)
Whiteboard: [stockwell needswork:owner]

Jon, could you please assign this to someone?

Flags: needinfo?(jcoppeard)

I'll look into this next week.

Assignee: nobody → jcoppeard
Flags: needinfo?(jcoppeard)

Currently Document::AdoptNode gets the JS global object, but in a way that does not expose it first, so it's possible for this to pass a gray object in here. From the comments it seems like this doesn't matter, but it does break our invariant that no gray objects are passed into the API.

The comment here talks about unmarking wrapper targets in case we're in incremental GC, but it does it conditially based on the color of the wrapper. We can't depend on that because a wrapper marked gray may eventually be marked black. Also, I don't think we should be touching gray wrappers anyway. Let's just always expose here.

Depends on D29210

Pushed by jcoppeard@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/5b4e6fb7da20
Expose possibly-gray global object before passing it into the JS API in Document::AdoptNode r=bzbarsky
https://hg.mozilla.org/integration/mozilla-inbound/rev/20ca9c77f630
Always expose returned target object of wrapper r=sfink
Status: NEW → RESOLVED
Closed: 6 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla68

Is there a user impact which justifies backport consideration here or can this ride the trains?

Flags: needinfo?(jcoppeard)
Keywords: assertion

(In reply to Ryan VanderMeulen [:RyanVM] from comment #22)

Let's play it safe and backport these.

Flags: needinfo?(jcoppeard)

Comment on attachment 9061378 [details]
Bug 1522817 - Expose possibly-gray global object before passing it into the JS API in Document::AdoptNode r=bzbarsky?

Beta/Release Uplift Approval Request

  • User impact if declined: It's possible that this could fix some crashes.
  • Is this code covered by automated tests?: Yes
  • Has the fix been verified in Nightly?: Yes
  • Needs manual test from QE?: No
  • If yes, steps to reproduce:
  • List of other uplifts needed: None
  • Risk to taking this patch: Low
  • Why is the change risky/not risky? (and alternatives if risky): This is a small change to unmark gray objects in some circumstances. There's very little risk that this would do anything untoward.
  • String changes made/needed:
Attachment #9061378 - Flags: approval-mozilla-beta?
Attachment #9061379 - Flags: approval-mozilla-beta?

Comment on attachment 9061378 [details]
Bug 1522817 - Expose possibly-gray global object before passing it into the JS API in Document::AdoptNode r=bzbarsky?

Uplift approved for 67 beta 16, thanks.

Attachment #9061378 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
Attachment #9061379 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
You need to log in before you can comment on or make changes to this bug.