Intermittent netwerk/test/crashtests/785753-1.html | application crashed [...]

NEW
Assigned to

Status

()

defect
P2
normal
5 months ago
2 months ago

People

(Reporter: intermittent-bug-filer, Assigned: mayhemer, NeedInfo)

Tracking

({intermittent-failure, leave-open, regression})

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [necko-triaged][stockwell disabled], crash signature)

Attachments

(1 attachment)

#[markdown(off)]
Filed by: nerli [at] mozilla.com

https://treeherder.mozilla.org/logviewer.html#?job_id=234940227&repo=autoland

https://queue.taskcluster.net/v1/task/ZmY_fKJDRtmau5GepRySUA/runs/0/artifacts/public/logs/live_backing.log

https://hg.mozilla.org/mozilla-central/raw-file/tip/layout/tools/reftest/reftest-analyzer.xhtml#logurl=https://queue.taskcluster.net/v1/task/ZmY_fKJDRtmau5GepRySUA/runs/0/artifacts/public/logs/live_backing.log&only_show_unexpected=1

[task 2019-03-20T08:12:13.920Z] 08:12:13 INFO - eip = 0xf169a085 esp = 0xffd47dd0 ebp = 0xffd488e8 ebx = 0xf5428000
[task 2019-03-20T08:12:13.921Z] 08:12:13 INFO - esi = 0x10000005 edi = 0xe7bb23d0
[task 2019-03-20T08:12:13.921Z] 08:12:13 INFO - Found by: call frame info
[task 2019-03-20T08:12:13.921Z] 08:12:13 INFO - 3 libxul.so!js::jit::ICTypeMonitor_Fallback::addMonitorStubForValue(JSContext*, js::jit::BaselineFrame*, js::StackTypeSet*, JS::Handle<JS::Value>) [BaselineIC.h:708979f9c3f33c77fb2e9106054b215c77044a04 : 1407 + 0x8]
[task 2019-03-20T08:12:13.921Z] 08:12:13 INFO - eip = 0xf16997d0 esp = 0xffd488f0 ebp = 0xffd48958 ebx = 0xf5428000
[task 2019-03-20T08:12:13.922Z] 08:12:13 INFO - esi = 0xe7b96240 edi = 0xe7b19638
[task 2019-03-20T08:12:13.922Z] 08:12:13 INFO - Found by: call frame info
[task 2019-03-20T08:12:13.922Z] 08:12:13 INFO - 4 libxul.so!js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICCall_Fallback*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) [BaselineIC.cpp:708979f9c3f33c77fb2e9106054b215c77044a04 : 1028 + 0x2a]
[task 2019-03-20T08:12:13.923Z] 08:12:13 INFO - eip = 0xf16a9b03 esp = 0xffd48960 ebp = 0xffd48c08 ebx = 0xf5428000
[task 2019-03-20T08:12:13.923Z] 08:12:13 INFO - esi = 0xffd48cc8 edi = 0xffd48c3c
[task 2019-03-20T08:12:13.923Z] 08:12:13 INFO - Found by: call frame info
[task 2019-03-20T08:12:13.924Z] 08:12:13 INFO - 5 0x3acd848a
[task 2019-03-20T08:12:13.924Z] 08:12:13 INFO - eip = 0x3acd848a esp = 0xffd48c10 ebp = 0xffd48c88 ebx = 0xffd48c3c
[task 2019-03-20T08:12:13.924Z] 08:12:13 INFO - esi = 0x3b01594e edi = 0xe7b19370
[task 2019-03-20T08:12:13.925Z] 08:12:13 INFO - Found by: call frame info
[task 2019-03-20T08:12:13.925Z] 08:12:13 INFO - 6 0xe7b19370
[task 2019-03-20T08:12:13.925Z] 08:12:13 INFO - eip = 0xe7b19370 esp = 0xffd48c90 ebp = 0xffd48cfc
[task 2019-03-20T08:12:13.926Z] 08:12:13 INFO - Found by: previous frame's frame pointer
[task 2019-03-20T08:12:13.926Z] 08:12:13 INFO - 7 0x3acd3b7c
[task 2019-03-20T08:12:13.927Z] 08:12:13 INFO - eip = 0x3acd3b7c esp = 0xffd48d04 ebp = 0xffd48d38
[task 2019-03-20T08:12:13.927Z] 08:12:13 INFO - Found by: previous frame's frame pointer
[task 2019-03-20T08:12:13.927Z] 08:12:13 INFO - 8 libxul.so!js::jit::MaybeEnterJit(JSContext*, js::RunState&) [Jit.cpp:708979f9c3f33c77fb2e9106054b215c77044a04 : 103 + 0x3b]
[task 2019-03-20T08:12:13.928Z] 08:12:13 INFO - eip = 0xf196cdad esp = 0xffd48d40 ebp = 0xffd48fa8
[task 2019-03-20T08:12:13.928Z] 08:12:13 INFO - Found by: previous frame's frame pointer
[task 2019-03-20T08:12:13.928Z] 08:12:13 INFO - 9 libxul.so!js::RunScript(JSContext*, js::RunState&) [Interpreter.cpp:708979f9c3f33c77fb2e9106054b215c77044a04 : 407 + 0xc]
[task 2019-03-20T08:12:13.929Z] 08:12:13 INFO - eip = 0xf0e423ff esp = 0xffd48fb0 ebp = 0xffd48ff8 ebx = 0xf5428000
[task 2019-03-20T08:12:13.929Z] 08:12:13 INFO - esi = 0xe8510800 edi = 0xffd49030
[task 2019-03-20T08:12:13.929Z] 08:12:13 INFO - Found by: call frame info
[task 2019-03-20T08:12:13.930Z] 08:12:13 INFO - 10 libxul.so!js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) [Interpreter.cpp:708979f9c3f33c77fb2e9106054b215c77044a04 : 562 + 0xd]
[task 2019-03-20T08:12:13.930Z] 08:12:13 INFO - eip = 0xf0e56aca esp = 0xffd49000 ebp = 0xffd49078 ebx = 0xf5428000
[task 2019-03-20T08:12:13.930Z] 08:12:13 INFO - esi = 0xe8510800 edi = 0x00000000
[task 2019-03-20T08:12:13.931Z] 08:12:13 INFO - Found by: call frame info
[task 2019-03-20T08:12:13.931Z] 08:12:13 INFO - 11 libxul.so!InternalCall(JSContext*, js::AnyInvokeArgs const&) [Interpreter.cpp:708979f9c3f33c77fb2e9106054b215c77044a04 : 589 + 0x14]
[task 2019-03-20T08:12:13.932Z] 08:12:13 INFO - eip = 0xf0e57e15 esp = 0xffd49080 ebp = 0xffd490b8 ebx = 0xf5428000
[task 2019-03-20T08:12:13.932Z] 08:12:13 INFO - esi = 0xe8510800 edi = 0xffd491e8
[task 2019-03-20T08:12:13.934Z] 08:12:13 INFO - Found by: call frame info

From what I can see, this also started while Bug 1535355 landed, but it's intermittent.
https://treeherder.mozilla.org/#/jobs?repo=autoland&resultStatus=testfailed%2Cbusted%2Cexception&searchStr=linux%2Creftest%2C(c)&fromchange=708979f9c3f33c77fb2e9106054b215c77044a04

bastien: Could you please take a look at this too?

Flags: needinfo?(bastien)
Crash Signature: [@ js::InternalBarrierMethods<JS::Value>::readBarrier(JS::Value const&)] [@ google_breakpad::ExceptionHandler::WriteMinidump()] [@ js::CurrentThreadCanAccessRuntime(JSRuntime const*)] [@ mozilla::detail::EntrySlot<mozilla::HashMapEntry<unsigned int, js…

I don't think this crash is related to Bug 1535355, as it only introduced 2 code source linting tasks, and this looks like a bug in the C++ code itself

Flags: needinfo?(bastien)
Whiteboard: [necko-triaged]
Crash Signature: , mozilla::DefaultHasher<unsi [@ ld-2.23.so + 0x124c5] → , mozilla::DefaultHasher<unsi [@ ld-2.23.so + 0x124c5] [@ libsystem_kernel.dylib + 0x16166]
Crash Signature: , mozilla::DefaultHasher<unsi [@ ld-2.23.so + 0x124c5] [@ libsystem_kernel.dylib + 0x16166] → , mozilla::DefaultHasher<unsi [@ ld-2.23.so + 0x124c5] [@ libsystem_kernel.dylib + 0x16166] [@ js::Wrapper::wrappedObject(JSObject*)]
Crash Signature: , mozilla::DefaultHasher<unsi [@ ld-2.23.so + 0x124c5] [@ libsystem_kernel.dylib + 0x16166] [@ js::Wrapper::wrappedObject(JSObject*)] → , mozilla::DefaultHasher<unsi [@ ld-2.23.so + 0x124c5] [@ libsystem_kernel.dylib + 0x16166] [@ js::Wrapper::wrappedObject(JSObject*)] [@ nsFrameMessageManager::AddMessageListener(nsTSubstring<char16_t> const&, mozilla::dom::MessageListener&, bool, moz…
Priority: -- → P5
Priority: P5 → P2

(In reply to Kershaw Chang [:kershaw] from comment #3)

It seems the first crash appeared in this push: https://treeherder.mozilla.org/#/jobs?repo=autoland&resultStatus=testfailed%2Cbusted%2Cexception&searchStr=linux%2Creftest%2C%28c%29&revision=67be47d6ddbb4b41f8d21f11f7a7b77641dc33cc&selectedJob=234791346.

But I can't tell if the changeset causes this or changesets before this one.

Based on that link, the failures are on the pushes below too.

This test is failing with different crash signatures, discussion about it is found here https://bugzilla.mozilla.org/show_bug.cgi?id=1536600#c4

Crash Signature: , mozilla::ErrorResult&)] → , mozilla::ErrorResult&)] [@ js::NewObjectCache::newObjectFromHit(JSContext*, int, js::gc::InitialHeap)]
Crash Signature: , mozilla::ErrorResult&)] [@ js::NewObjectCache::newObjectFromHit(JSContext*, int, js::gc::InitialHeap)] → , mozilla::ErrorResult&)] [@ js::NewObjectCache::newObjectFromHit(JSContext*, int, js::gc::InitialHeap)] [@ JS::GCCellPtr::mayBeOwnedByOtherRuntime() const]
Crash Signature: , mozilla::ErrorResult&)] [@ js::NewObjectCache::newObjectFromHit(JSContext*, int, js::gc::InitialHeap)] [@ JS::GCCellPtr::mayBeOwnedByOtherRuntime() const] → , mozilla::ErrorResult&)] [@ js::NewObjectCache::newObjectFromHit(JSContext*, int, js::gc::InitialHeap)] [@ JS::GCCellPtr::mayBeOwnedByOtherRuntime() const] [@ RefPtr<nsPresContext>::operator->() const]
See Also: → 1536600
Whiteboard: [necko-triaged][stockwell disable-recommended] → [necko-triaged][stockwell needswork]

There were 158 failures in the past week:

  • linux32 debug and opt
  • linux32-shippable opt
  • linux64 debug, opt and pgo
  • linux64-pgo-qr opt
  • linux64-qr debug
  • linux64-shippable opt
  • macosx64-qr debug and opt
  • macosx64-shippable-qr opt
  • osx-10-10 debug and opt
  • osx-10-10-shippable opt
  • windows10-64-shippable opt

Recent log failure: https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=237093155&repo=autoland&lineNumber=104153

Reftest analyzer: https://hg.mozilla.org/mozilla-central/raw-file/tip/layout/tools/reftest/reftest-analyzer.xhtml#logurl=https://queue.taskcluster.net/v1/task/NmKWYqmXQJW1zyhIhojXuQ/runs/0/artifacts/public/logs/live_backing.log&only_show_unexpected=1

Flags: needinfo?(sdeckelmann)
Whiteboard: [necko-triaged][stockwell disable-recommended] → [necko-triaged][stokwell needswork]
Whiteboard: [necko-triaged][stokwell needswork][stockwell disable-recommended] → [necko-triaged][stokwell needswork][stockwell needswork]

Waiting for reply on bug 1536600.

Whiteboard: [necko-triaged][stokwell needswork][stockwell disable-recommended] → [necko-triaged][stokwell needswork:owner]

Dragana can you please give input here too? bug 1536600 looks fixed.

Flags: needinfo?(dd.mozilla)
Whiteboard: [necko-triaged][stokwell needswork:owner][stockwell disable-recommended] → [necko-triaged][stokwell needswork:owner]
Crash Signature: , mozilla::ErrorResult&)] [@ js::NewObjectCache::newObjectFromHit(JSContext*, int, js::gc::InitialHeap)] [@ JS::GCCellPtr::mayBeOwnedByOtherRuntime() const] [@ RefPtr<nsPresContext>::operator->() const] → , mozilla::ErrorResult&)] [@ js::NewObjectCache::newObjectFromHit(JSContext*, int, js::gc::InitialHeap)] [@ JS::GCCellPtr::mayBeOwnedByOtherRuntime() const] [@ RefPtr<nsPresContext>::operator->() const] [@ _moz_cairo_set_scaled_font] [@ JS::Zone::get…

Hi Joel, is there something we can do about these: https://bugzilla.mozilla.org/buglist.cgi?quicksearch=785753-1.html&list_id=14661908?

Should we disable the test?

Flags: needinfo?(jmaher)
Whiteboard: [necko-triaged][stokwell needswork:owner][stockwell disable-recommended] → [necko-triaged][stokwell needswork:owner]

:apavel, as this is a single test, I would disable the test everywhere and mark all the intermittent bugs as [stockwell disabled].

It sounds like the right people are aware of this problem, it is worrisome that there are 26 different crash signatures that can come out of this one test on all platforms, but this is noise for developers.

Flags: needinfo?(jmaher)
Keywords: leave-open
Whiteboard: [necko-triaged][stokwell needswork:owner] → [necko-triaged][stockwell disabled]
Pushed by apavel@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/515b1710f387
disabled 785753-1.html on all platforms r=jmaher
Duplicate of this bug: 1543653
Duplicate of this bug: 1536197
Duplicate of this bug: 1543565
Duplicate of this bug: 1536571
Duplicate of this bug: 1536554
Duplicate of this bug: 1543397
Duplicate of this bug: 1543283
Duplicate of this bug: 1542939
Duplicate of this bug: 1536431
Duplicate of this bug: 1538086
Duplicate of this bug: 1536594
Duplicate of this bug: 1536397
Duplicate of this bug: 1536246
Duplicate of this bug: 1536570
Duplicate of this bug: 1538156
Duplicate of this bug: 1536526
Duplicate of this bug: 1536593
Duplicate of this bug: 1542797
Duplicate of this bug: 1536375
Duplicate of this bug: 1540070
Duplicate of this bug: 1536600
Duplicate of this bug: 1536694
Duplicate of this bug: 1541533
Duplicate of this bug: 1537965
Duplicate of this bug: 1542678
Duplicate of this bug: 1542182

Might be a good one to try running through Pernosco (or just reproducing under rr locally).

Crash Signature: , js::gc::InitialHeap)] [@ JS::GCCellPtr::mayBeOwnedByOtherRuntime() const] [@ RefPtr<nsPresContext>::operator->() const] [@ _moz_cairo_set_scaled_font] [@ JS::Zone::getOrCreateUniqueId(js::gc::Cell*, unsigned long*) → , js::gc::InitialHeap)] [@ JS::GCCellPtr::mayBeOwnedByOtherRuntime() const] [@ RefPtr<nsPresContext>::operator->() const] [@ _moz_cairo_set_scaled_font] [@ JS::Zone::getOrCreateUniqueId(js::gc::Cell*, unsigned long*) [@ libpthread-2.23.so + 0xe2d5]
Crash Signature: , js::gc::InitialHeap)] [@ JS::GCCellPtr::mayBeOwnedByOtherRuntime() const] [@ RefPtr<nsPresContext>::operator->() const] [@ _moz_cairo_set_scaled_font] [@ JS::Zone::getOrCreateUniqueId(js::gc::Cell*, unsigned long*) [@ libpthread-2.23.so + 0xe2d5] → , js::gc::InitialHeap)] [@ JS::GCCellPtr::mayBeOwnedByOtherRuntime() const] [@ RefPtr<nsPresContext>::operator->() const] [@ _moz_cairo_set_scaled_font] [@ JS::Zone::getOrCreateUniqueId(js::gc::Cell*, unsigned long*) [@ libpthread-2.23.so + 0xe2d5] [@…
Crash Signature: , unsigned long*) [@ libpthread-2.23.so + 0xe2d5] [@ nsresult mozilla::Preferences::UnregisterCallbackImpl<nsTSubstring<char> const&>(void (*)(char const*, void*), nsTSubstring<char> const&, void*, mozilla::Preferences::MatchKind)] → , unsigned long*) [@ libpthread-2.23.so + 0xe2d5] [@ nsresult mozilla::Preferences::UnregisterCallbackImpl<nsTSubstring<char> const&>(void (*)(char const*, void*), nsTSubstring<char> const&, void*, mozilla::Preferences::MatchKind)] [@ moz_xmalloc]
Assignee: nobody → honzab.moz
Crash Signature: , unsigned long*) [@ libpthread-2.23.so + 0xe2d5] [@ nsresult mozilla::Preferences::UnregisterCallbackImpl<nsTSubstring<char> const&>(void (*)(char const*, void*), nsTSubstring<char> const&, void*, mozilla::Preferences::MatchKind)] [@ moz_xmalloc] → , unsigned long*) [@ libpthread-2.23.so + 0xe2d5] [@ nsresult mozilla::Preferences::UnregisterCallbackImpl<nsTSubstring<char> const&>(void (*)(char const*, void*), nsTSubstring<char> const&, void*, mozilla::Preferences::MatchKind)] [@ moz_xmalloc]
Crash Signature: , unsigned long*) [@ libpthread-2.23.so + 0xe2d5] [@ nsresult mozilla::Preferences::UnregisterCallbackImpl<nsTSubstring<char> const&>(void (*)(char const*, void*), nsTSubstring<char> const&, void*, mozilla::Preferences::MatchKind)] [@ moz_xmalloc] → , unsigned long*) [@ libpthread-2.23.so + 0xe2d5] [@ nsresult mozilla::Preferences::UnregisterCallbackImpl<nsTSubstring<char> const&>(void (*)(char const*, void*), nsTSubstring<char> const&, void*, mozilla::Preferences::MatchKind)] [@ moz_xmalloc] [@ n…
Crash Signature: , mozilla::Preferences::MatchKind)] [@ moz_xmalloc] [@ nsFrameMessageManager::DispatchAsyncMessage(JSContext*, nsTSubstring<char16_t> const&, JS::Handle<JS::Value>, JS::Handle<JSObject*>, nsIPrincipal*, JS::Handle<JS::Value>, mozilla::ErrorResult&)] → , mozilla::Preferences::MatchKind)] [@ moz_xmalloc] [@ nsFrameMessageManager::DispatchAsyncMessage(JSContext*, nsTSubstring<char16_t> const&, JS::Handle<JS::Value>, JS::Handle<JSObject*>, nsIPrincipal*, JS::Handle<JS::Value>, mozilla::ErrorResult&)] [@ l…
Crash Signature: , mozilla::ErrorResult&)] [@ linux-gate.so + 0x98c] [@ linux-gate.so + 0xcd9] → , mozilla::ErrorResult&)] [@ linux-gate.so + 0x98c] [@ linux-gate.so + 0xcd9] [@ mozilla::dom::CallbackObject::operator==(mozilla::dom::CallbackObject const&) const]
Crash Signature: , mozilla::ErrorResult&)] [@ linux-gate.so + 0x98c] [@ linux-gate.so + 0xcd9] [@ mozilla::dom::CallbackObject::operator==(mozilla::dom::CallbackObject const&) const] → , mozilla::ErrorResult&)] [@ linux-gate.so + 0x98c] [@ linux-gate.so + 0xcd9] [@ mozilla::dom::CallbackObject::operator==(mozilla::dom::CallbackObject const&) const] [@ arena_t::MallocSmall(unsigned long, bool)]
Crash Signature: , mozilla::ErrorResult&)] [@ linux-gate.so + 0x98c] [@ linux-gate.so + 0xcd9] [@ mozilla::dom::CallbackObject::operator==(mozilla::dom::CallbackObject const&) const] [@ arena_t::MallocSmall(unsigned long, bool)] → , mozilla::ErrorResult&)] [@ linux-gate.so + 0x98c] [@ linux-gate.so + 0xcd9] [@ mozilla::dom::CallbackObject::operator==(mozilla::dom::CallbackObject const&) const] [@ arena_t::MallocSmall(unsigned long, bool)] [@ JS::IncrementalReadBarrier(JS::GCCellPtr…
Crash Signature: , bool)] [@ JS::IncrementalReadBarrier(JS::GCCellPtr)] → , bool)] [@ JS::IncrementalReadBarrier(JS::GCCellPtr)] [@ js::gc::AssertGCThingHasType(js::gc::Cell*, JS::TraceKind)]
Crash Signature: , bool)] [@ JS::IncrementalReadBarrier(JS::GCCellPtr)] [@ js::gc::AssertGCThingHasType(js::gc::Cell*, JS::TraceKind)] → , bool)] [@ JS::IncrementalReadBarrier(JS::GCCellPtr)] [@ js::gc::AssertGCThingHasType(js::gc::Cell*, JS::TraceKind)] [@ js::UncheckedUnwrap(JSObject*, bool, unsigned int*)]
Crash Signature: , bool)] [@ JS::IncrementalReadBarrier(JS::GCCellPtr)] [@ js::gc::AssertGCThingHasType(js::gc::Cell*, JS::TraceKind)] [@ js::UncheckedUnwrap(JSObject*, bool, unsigned int*)] → , bool)] [@ JS::IncrementalReadBarrier(JS::GCCellPtr)] [@ js::gc::AssertGCThingHasType(js::gc::Cell*, JS::TraceKind)] [@ js::UncheckedUnwrap(JSObject*, bool, unsigned int*)] [@ js::gc::ArenaLists::refillFreeListAndAllocate(js::gc::FreeLists&, js::gc::Allo…
Crash Signature: , js::gc::AllocKind, js::gc::ShouldCheckThresholds)] → , js::gc::AllocKind, js::gc::ShouldCheckThresholds)] [@ js::gc::TenuredCell::arena() const]
Crash Signature: , js::gc::AllocKind, js::gc::ShouldCheckThresholds)] [@ js::gc::TenuredCell::arena() const] → , js::gc::AllocKind, js::gc::ShouldCheckThresholds)] [@ js::gc::TenuredCell::arena() const] [@ NS_CycleCollectorSuspectUsingNursery]
Crash Signature: , js::gc::AllocKind, js::gc::ShouldCheckThresholds)] [@ js::gc::TenuredCell::arena() const] [@ NS_CycleCollectorSuspectUsingNursery] → , js::gc::AllocKind, js::gc::ShouldCheckThresholds)] [@ js::gc::TenuredCell::arena() const] [@ NS_CycleCollectorSuspectUsingNursery] [@ js::CheckMainThread<(js::AllowedHelperThread)0>::check() const]
Crash Signature: , js::gc::AllocKind, js::gc::ShouldCheckThresholds)] [@ js::gc::TenuredCell::arena() const] [@ NS_CycleCollectorSuspectUsingNursery] [@ js::CheckMainThread<(js::AllowedHelperThread)0>::check() const] → , js::gc::AllocKind, js::gc::ShouldCheckThresholds)] [@ js::gc::TenuredCell::arena() const] [@ NS_CycleCollectorSuspectUsingNursery] [@ js::CheckMainThread<(js::AllowedHelperThread)0>::check() const] [@ js::gc::Cell::getTraceKind() const]
Crash Signature: , js::gc::AllocKind, js::gc::ShouldCheckThresholds)] [@ js::gc::TenuredCell::arena() const] [@ NS_CycleCollectorSuspectUsingNursery] [@ js::CheckMainThread<(js::AllowedHelperThread)0>::check() const] [@ js::gc::Cell::getTraceKind() const] → , js::gc::AllocKind, js::gc::ShouldCheckThresholds)] [@ js::gc::TenuredCell::arena() const] [@ NS_CycleCollectorSuspectUsingNursery] [@ js::CheckMainThread<(js::AllowedHelperThread)0>::check() const] [@ js::gc::Cell::getTraceKind() const] [@ js::CheckThre…
Crash Signature: const] → const] [@ NewObject(JSContext*, JS::Handle<js::ObjectGroup*>, js::gc::AllocKind, js::NewObjectKind, unsigned int)]
Crash Signature: const] [@ NewObject(JSContext*, JS::Handle<js::ObjectGroup*>, js::gc::AllocKind, js::NewObjectKind, unsigned int)] → const] [@ NewObject(JSContext*, JS::Handle<js::ObjectGroup*>, js::gc::AllocKind, js::NewObjectKind, unsigned int)] [@ js::gc::detail::AssertCellIsNotGray(js::gc::Cell const*)]

FWIW, I can reproduce this crash pretty easily in a VM with |./mach test --verify netwerk/test/crashtest|, but only if I run it on the entire directory. If I just load 785753-1.html in verify mode, it doesn't crash.

Crash Signature: , mozilla::Preferences::MatchKind)] [@ moz_xmalloc] [@ nsFrameMessageManager::DispatchAsyncMessage(JSContext*, nsTSubstring<char16_t> const&, JS::Handle<JS::Value>, JS::Handle<JSObject*>, nsIPrincipal*, JS::Handle<JS::Value>, mozilla::ErrorResult&)] [@ l… → , mozilla::Preferences::MatchKind)] [@ moz_xmalloc] [@ nsFrameMessageManager::DispatchAsyncMessage(JSContext*, nsTSubstring<char16_t> const&, JS::Handle<JS::Value>, JS::Handle<JSObject*>, nsIPrincipal*, JS::Handle<JS::Value>, mozilla::ErrorResult&)] [@…

Nhi - can you please follow up with the necko team on this? Thanks.

Flags: needinfo?(sdeckelmann) → needinfo?(nhnguyen)

Both test 785753-1.html, 785753-2.html (bug 1543732) have been disabled on all platforms.

Honza - since you're assigned on this bug and there's a reliable way to reproduce it (see comment #56), could you try reproducing and see if we can narrow down the changeset that introduced this?

Flags: needinfo?(nhnguyen) → needinfo?(honzab.moz)

This is a lower priority as only the test (now disabled) was crashing. I'll definitely find time, probably next week or so.

Flags: needinfo?(honzab.moz)

Both test 785753-1.html, 785753-2.html (bug 1543732) have been re-enabled here: bug 1545738

You need to log in before you can comment on or make changes to this bug.