Closed Bug 1536772 Opened 6 years ago Closed 1 month ago

Intermittent netwerk/test/crashtests/785753-1.html | application crashed [...]

Categories

(Core :: General, defect, P3)

Product:
Core
Component:
General
Type:
defect

Tracking

()

Status:
RESOLVED INCOMPLETE

People

(Reporter: intermittent-bug-filer, Unassigned)

References

Details

(Keywords: intermittent-failure, regression, Whiteboard: [necko-triaged][stockwell disabled])

Crash Data

Attachments

(1 file)

Bug 1536772 - disabled 785753-1.html on all platforms
47 bytes, text/x-phabricator-request
Details | Review

#[markdown(off)]
Filed by: nerli [at] mozilla.com

https://treeherder.mozilla.org/logviewer.html#?job_id=234940227&repo=autoland

https://queue.taskcluster.net/v1/task/ZmY_fKJDRtmau5GepRySUA/runs/0/artifacts/public/logs/live_backing.log

https://hg.mozilla.org/mozilla-central/raw-file/tip/layout/tools/reftest/reftest-analyzer.xhtml#logurl=https://queue.taskcluster.net/v1/task/ZmY_fKJDRtmau5GepRySUA/runs/0/artifacts/public/logs/live_backing.log&only_show_unexpected=1

[task 2019-03-20T08:12:13.920Z] 08:12:13 INFO - eip = 0xf169a085 esp = 0xffd47dd0 ebp = 0xffd488e8 ebx = 0xf5428000
[task 2019-03-20T08:12:13.921Z] 08:12:13 INFO - esi = 0x10000005 edi = 0xe7bb23d0
[task 2019-03-20T08:12:13.921Z] 08:12:13 INFO - Found by: call frame info
[task 2019-03-20T08:12:13.921Z] 08:12:13 INFO - 3 libxul.so!js::jit::ICTypeMonitor_Fallback::addMonitorStubForValue(JSContext*, js::jit::BaselineFrame*, js::StackTypeSet*, JS::Handle<JS::Value>) [BaselineIC.h:708979f9c3f33c77fb2e9106054b215c77044a04 : 1407 + 0x8]
[task 2019-03-20T08:12:13.921Z] 08:12:13 INFO - eip = 0xf16997d0 esp = 0xffd488f0 ebp = 0xffd48958 ebx = 0xf5428000
[task 2019-03-20T08:12:13.922Z] 08:12:13 INFO - esi = 0xe7b96240 edi = 0xe7b19638
[task 2019-03-20T08:12:13.922Z] 08:12:13 INFO - Found by: call frame info
[task 2019-03-20T08:12:13.922Z] 08:12:13 INFO - 4 libxul.so!js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICCall_Fallback*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) [BaselineIC.cpp:708979f9c3f33c77fb2e9106054b215c77044a04 : 1028 + 0x2a]
[task 2019-03-20T08:12:13.923Z] 08:12:13 INFO - eip = 0xf16a9b03 esp = 0xffd48960 ebp = 0xffd48c08 ebx = 0xf5428000
[task 2019-03-20T08:12:13.923Z] 08:12:13 INFO - esi = 0xffd48cc8 edi = 0xffd48c3c
[task 2019-03-20T08:12:13.923Z] 08:12:13 INFO - Found by: call frame info
[task 2019-03-20T08:12:13.924Z] 08:12:13 INFO - 5 0x3acd848a
[task 2019-03-20T08:12:13.924Z] 08:12:13 INFO - eip = 0x3acd848a esp = 0xffd48c10 ebp = 0xffd48c88 ebx = 0xffd48c3c
[task 2019-03-20T08:12:13.924Z] 08:12:13 INFO - esi = 0x3b01594e edi = 0xe7b19370
[task 2019-03-20T08:12:13.925Z] 08:12:13 INFO - Found by: call frame info
[task 2019-03-20T08:12:13.925Z] 08:12:13 INFO - 6 0xe7b19370
[task 2019-03-20T08:12:13.925Z] 08:12:13 INFO - eip = 0xe7b19370 esp = 0xffd48c90 ebp = 0xffd48cfc
[task 2019-03-20T08:12:13.926Z] 08:12:13 INFO - Found by: previous frame's frame pointer
[task 2019-03-20T08:12:13.926Z] 08:12:13 INFO - 7 0x3acd3b7c
[task 2019-03-20T08:12:13.927Z] 08:12:13 INFO - eip = 0x3acd3b7c esp = 0xffd48d04 ebp = 0xffd48d38
[task 2019-03-20T08:12:13.927Z] 08:12:13 INFO - Found by: previous frame's frame pointer
[task 2019-03-20T08:12:13.927Z] 08:12:13 INFO - 8 libxul.so!js::jit::MaybeEnterJit(JSContext*, js::RunState&) [Jit.cpp:708979f9c3f33c77fb2e9106054b215c77044a04 : 103 + 0x3b]
[task 2019-03-20T08:12:13.928Z] 08:12:13 INFO - eip = 0xf196cdad esp = 0xffd48d40 ebp = 0xffd48fa8
[task 2019-03-20T08:12:13.928Z] 08:12:13 INFO - Found by: previous frame's frame pointer
[task 2019-03-20T08:12:13.928Z] 08:12:13 INFO - 9 libxul.so!js::RunScript(JSContext*, js::RunState&) [Interpreter.cpp:708979f9c3f33c77fb2e9106054b215c77044a04 : 407 + 0xc]
[task 2019-03-20T08:12:13.929Z] 08:12:13 INFO - eip = 0xf0e423ff esp = 0xffd48fb0 ebp = 0xffd48ff8 ebx = 0xf5428000
[task 2019-03-20T08:12:13.929Z] 08:12:13 INFO - esi = 0xe8510800 edi = 0xffd49030
[task 2019-03-20T08:12:13.929Z] 08:12:13 INFO - Found by: call frame info
[task 2019-03-20T08:12:13.930Z] 08:12:13 INFO - 10 libxul.so!js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) [Interpreter.cpp:708979f9c3f33c77fb2e9106054b215c77044a04 : 562 + 0xd]
[task 2019-03-20T08:12:13.930Z] 08:12:13 INFO - eip = 0xf0e56aca esp = 0xffd49000 ebp = 0xffd49078 ebx = 0xf5428000
[task 2019-03-20T08:12:13.930Z] 08:12:13 INFO - esi = 0xe8510800 edi = 0x00000000
[task 2019-03-20T08:12:13.931Z] 08:12:13 INFO - Found by: call frame info
[task 2019-03-20T08:12:13.931Z] 08:12:13 INFO - 11 libxul.so!InternalCall(JSContext*, js::AnyInvokeArgs const&) [Interpreter.cpp:708979f9c3f33c77fb2e9106054b215c77044a04 : 589 + 0x14]
[task 2019-03-20T08:12:13.932Z] 08:12:13 INFO - eip = 0xf0e57e15 esp = 0xffd49080 ebp = 0xffd490b8 ebx = 0xf5428000
[task 2019-03-20T08:12:13.932Z] 08:12:13 INFO - esi = 0xe8510800 edi = 0xffd491e8
[task 2019-03-20T08:12:13.934Z] 08:12:13 INFO - Found by: call frame info

From what I can see, this also started while Bug 1535355 landed, but it's intermittent.
https://treeherder.mozilla.org/#/jobs?repo=autoland&resultStatus=testfailed%2Cbusted%2Cexception&searchStr=linux%2Creftest%2C(c)&fromchange=708979f9c3f33c77fb2e9106054b215c77044a04

bastien: Could you please take a look at this too?

Flags: needinfo?(bastien)
Crash Signature: [@ js::InternalBarrierMethods<JS::Value>::readBarrier(JS::Value const&)] [@ google_breakpad::ExceptionHandler::WriteMinidump()] [@ js::CurrentThreadCanAccessRuntime(JSRuntime const*)] [@ mozilla::detail::EntrySlot<mozilla::HashMapEntry<unsigned int, js…

I don't think this crash is related to Bug 1535355, as it only introduced 2 code source linting tasks, and this looks like a bug in the C++ code itself

Flags: needinfo?(bastien)

It seems the first crash appeared in this push: https://treeherder.mozilla.org/#/jobs?repo=autoland&resultStatus=testfailed%2Cbusted%2Cexception&searchStr=linux%2Creftest%2C%28c%29&revision=67be47d6ddbb4b41f8d21f11f7a7b77641dc33cc&selectedJob=234791346.

But I can't tell if the changeset causes this or changesets before this one.

Whiteboard: [necko-triaged]
Crash Signature: , mozilla::DefaultHasher<unsi [@ ld-2.23.so + 0x124c5] → , mozilla::DefaultHasher<unsi [@ ld-2.23.so + 0x124c5] [@ libsystem_kernel.dylib + 0x16166]
Crash Signature: , mozilla::DefaultHasher<unsi [@ ld-2.23.so + 0x124c5] [@ libsystem_kernel.dylib + 0x16166] → , mozilla::DefaultHasher<unsi [@ ld-2.23.so + 0x124c5] [@ libsystem_kernel.dylib + 0x16166] [@ js::Wrapper::wrappedObject(JSObject*)]
Crash Signature: , mozilla::DefaultHasher<unsi [@ ld-2.23.so + 0x124c5] [@ libsystem_kernel.dylib + 0x16166] [@ js::Wrapper::wrappedObject(JSObject*)] → , mozilla::DefaultHasher<unsi [@ ld-2.23.so + 0x124c5] [@ libsystem_kernel.dylib + 0x16166] [@ js::Wrapper::wrappedObject(JSObject*)] [@ nsFrameMessageManager::AddMessageListener(nsTSubstring<char16_t> const&, mozilla::dom::MessageListener&, bool, moz…
Priority: -- → P5
Priority: P5 → P2

(In reply to Kershaw Chang [:kershaw] from comment #3)

It seems the first crash appeared in this push: https://treeherder.mozilla.org/#/jobs?repo=autoland&resultStatus=testfailed%2Cbusted%2Cexception&searchStr=linux%2Creftest%2C%28c%29&revision=67be47d6ddbb4b41f8d21f11f7a7b77641dc33cc&selectedJob=234791346.

But I can't tell if the changeset causes this or changesets before this one.

Based on that link, the failures are on the pushes below too.

This test is failing with different crash signatures, discussion about it is found here https://bugzilla.mozilla.org/show_bug.cgi?id=1536600#c4

Crash Signature: , mozilla::ErrorResult&)] → , mozilla::ErrorResult&)] [@ js::NewObjectCache::newObjectFromHit(JSContext*, int, js::gc::InitialHeap)]
Crash Signature: , mozilla::ErrorResult&)] [@ js::NewObjectCache::newObjectFromHit(JSContext*, int, js::gc::InitialHeap)] → , mozilla::ErrorResult&)] [@ js::NewObjectCache::newObjectFromHit(JSContext*, int, js::gc::InitialHeap)] [@ JS::GCCellPtr::mayBeOwnedByOtherRuntime() const]
Crash Signature: , mozilla::ErrorResult&)] [@ js::NewObjectCache::newObjectFromHit(JSContext*, int, js::gc::InitialHeap)] [@ JS::GCCellPtr::mayBeOwnedByOtherRuntime() const] → , mozilla::ErrorResult&)] [@ js::NewObjectCache::newObjectFromHit(JSContext*, int, js::gc::InitialHeap)] [@ JS::GCCellPtr::mayBeOwnedByOtherRuntime() const] [@ RefPtr<nsPresContext>::operator->() const]
See Also: → 1536600
Whiteboard: [necko-triaged][stockwell disable-recommended] → [necko-triaged][stockwell needswork]

There were 158 failures in the past week:

  • linux32 debug and opt
  • linux32-shippable opt
  • linux64 debug, opt and pgo
  • linux64-pgo-qr opt
  • linux64-qr debug
  • linux64-shippable opt
  • macosx64-qr debug and opt
  • macosx64-shippable-qr opt
  • osx-10-10 debug and opt
  • osx-10-10-shippable opt
  • windows10-64-shippable opt

Recent log failure: https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=237093155&repo=autoland&lineNumber=104153

Reftest analyzer: https://hg.mozilla.org/mozilla-central/raw-file/tip/layout/tools/reftest/reftest-analyzer.xhtml#logurl=https://queue.taskcluster.net/v1/task/NmKWYqmXQJW1zyhIhojXuQ/runs/0/artifacts/public/logs/live_backing.log&only_show_unexpected=1

Flags: needinfo?(sdeckelmann)
Whiteboard: [necko-triaged][stockwell disable-recommended] → [necko-triaged][stokwell needswork]
Whiteboard: [necko-triaged][stokwell needswork][stockwell disable-recommended] → [necko-triaged][stokwell needswork][stockwell needswork]

Waiting for reply on bug 1536600.

Whiteboard: [necko-triaged][stokwell needswork][stockwell disable-recommended] → [necko-triaged][stokwell needswork:owner]

Dragana can you please give input here too? bug 1536600 looks fixed.

Flags: needinfo?(dd.mozilla)
Whiteboard: [necko-triaged][stokwell needswork:owner][stockwell disable-recommended] → [necko-triaged][stokwell needswork:owner]
Crash Signature: , mozilla::ErrorResult&)] [@ js::NewObjectCache::newObjectFromHit(JSContext*, int, js::gc::InitialHeap)] [@ JS::GCCellPtr::mayBeOwnedByOtherRuntime() const] [@ RefPtr<nsPresContext>::operator->() const] → , mozilla::ErrorResult&)] [@ js::NewObjectCache::newObjectFromHit(JSContext*, int, js::gc::InitialHeap)] [@ JS::GCCellPtr::mayBeOwnedByOtherRuntime() const] [@ RefPtr<nsPresContext>::operator->() const] [@ _moz_cairo_set_scaled_font] [@ JS::Zone::get…

Hi Joel, is there something we can do about these: https://bugzilla.mozilla.org/buglist.cgi?quicksearch=785753-1.html&list_id=14661908?

Should we disable the test?

Flags: needinfo?(jmaher)
Whiteboard: [necko-triaged][stokwell needswork:owner][stockwell disable-recommended] → [necko-triaged][stokwell needswork:owner]

:apavel, as this is a single test, I would disable the test everywhere and mark all the intermittent bugs as [stockwell disabled].

It sounds like the right people are aware of this problem, it is worrisome that there are 26 different crash signatures that can come out of this one test on all platforms, but this is noise for developers.

Flags: needinfo?(jmaher)
Keywords: leave-open
Whiteboard: [necko-triaged][stokwell needswork:owner] → [necko-triaged][stockwell disabled]
Pushed by apavel@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/515b1710f387 disabled 785753-1.html on all platforms r=jmaher

Might be a good one to try running through Pernosco (or just reproducing under rr locally).

Crash Signature: , js::gc::InitialHeap)] [@ JS::GCCellPtr::mayBeOwnedByOtherRuntime() const] [@ RefPtr<nsPresContext>::operator->() const] [@ _moz_cairo_set_scaled_font] [@ JS::Zone::getOrCreateUniqueId(js::gc::Cell*, unsigned long*) → , js::gc::InitialHeap)] [@ JS::GCCellPtr::mayBeOwnedByOtherRuntime() const] [@ RefPtr<nsPresContext>::operator->() const] [@ _moz_cairo_set_scaled_font] [@ JS::Zone::getOrCreateUniqueId(js::gc::Cell*, unsigned long*) [@ libpthread-2.23.so + 0xe2d5]
Crash Signature: , js::gc::InitialHeap)] [@ JS::GCCellPtr::mayBeOwnedByOtherRuntime() const] [@ RefPtr<nsPresContext>::operator->() const] [@ _moz_cairo_set_scaled_font] [@ JS::Zone::getOrCreateUniqueId(js::gc::Cell*, unsigned long*) [@ libpthread-2.23.so + 0xe2d5] → , js::gc::InitialHeap)] [@ JS::GCCellPtr::mayBeOwnedByOtherRuntime() const] [@ RefPtr<nsPresContext>::operator->() const] [@ _moz_cairo_set_scaled_font] [@ JS::Zone::getOrCreateUniqueId(js::gc::Cell*, unsigned long*) [@ libpthread-2.23.so + 0xe2d5] [@…
Crash Signature: , unsigned long*) [@ libpthread-2.23.so + 0xe2d5] [@ nsresult mozilla::Preferences::UnregisterCallbackImpl<nsTSubstring<char> const&>(void (*)(char const*, void*), nsTSubstring<char> const&, void*, mozilla::Preferences::MatchKind)] → , unsigned long*) [@ libpthread-2.23.so + 0xe2d5] [@ nsresult mozilla::Preferences::UnregisterCallbackImpl<nsTSubstring<char> const&>(void (*)(char const*, void*), nsTSubstring<char> const&, void*, mozilla::Preferences::MatchKind)] [@ moz_xmalloc]
Assignee: nobody → honzab.moz
Crash Signature: , unsigned long*) [@ libpthread-2.23.so + 0xe2d5] [@ nsresult mozilla::Preferences::UnregisterCallbackImpl<nsTSubstring<char> const&>(void (*)(char const*, void*), nsTSubstring<char> const&, void*, mozilla::Preferences::MatchKind)] [@ moz_xmalloc] → , unsigned long*) [@ libpthread-2.23.so + 0xe2d5] [@ nsresult mozilla::Preferences::UnregisterCallbackImpl<nsTSubstring<char> const&>(void (*)(char const*, void*), nsTSubstring<char> const&, void*, mozilla::Preferences::MatchKind)] [@ moz_xmalloc]
status-firefox66: --- → affected
status-firefox-esr60: --- → affected
Crash Signature: , unsigned long*) [@ libpthread-2.23.so + 0xe2d5] [@ nsresult mozilla::Preferences::UnregisterCallbackImpl<nsTSubstring<char> const&>(void (*)(char const*, void*), nsTSubstring<char> const&, void*, mozilla::Preferences::MatchKind)] [@ moz_xmalloc] → , unsigned long*) [@ libpthread-2.23.so + 0xe2d5] [@ nsresult mozilla::Preferences::UnregisterCallbackImpl<nsTSubstring<char> const&>(void (*)(char const*, void*), nsTSubstring<char> const&, void*, mozilla::Preferences::MatchKind)] [@ moz_xmalloc] [@ n…
Crash Signature: , mozilla::Preferences::MatchKind)] [@ moz_xmalloc] [@ nsFrameMessageManager::DispatchAsyncMessage(JSContext*, nsTSubstring<char16_t> const&, JS::Handle<JS::Value>, JS::Handle<JSObject*>, nsIPrincipal*, JS::Handle<JS::Value>, mozilla::ErrorResult&)] → , mozilla::Preferences::MatchKind)] [@ moz_xmalloc] [@ nsFrameMessageManager::DispatchAsyncMessage(JSContext*, nsTSubstring<char16_t> const&, JS::Handle<JS::Value>, JS::Handle<JSObject*>, nsIPrincipal*, JS::Handle<JS::Value>, mozilla::ErrorResult&)] [@ l…
Crash Signature: , mozilla::ErrorResult&)] [@ linux-gate.so + 0x98c] [@ linux-gate.so + 0xcd9] → , mozilla::ErrorResult&)] [@ linux-gate.so + 0x98c] [@ linux-gate.so + 0xcd9] [@ mozilla::dom::CallbackObject::operator==(mozilla::dom::CallbackObject const&) const]
Crash Signature: , mozilla::ErrorResult&)] [@ linux-gate.so + 0x98c] [@ linux-gate.so + 0xcd9] [@ mozilla::dom::CallbackObject::operator==(mozilla::dom::CallbackObject const&) const] → , mozilla::ErrorResult&)] [@ linux-gate.so + 0x98c] [@ linux-gate.so + 0xcd9] [@ mozilla::dom::CallbackObject::operator==(mozilla::dom::CallbackObject const&) const] [@ arena_t::MallocSmall(unsigned long, bool)]
Crash Signature: , mozilla::ErrorResult&)] [@ linux-gate.so + 0x98c] [@ linux-gate.so + 0xcd9] [@ mozilla::dom::CallbackObject::operator==(mozilla::dom::CallbackObject const&) const] [@ arena_t::MallocSmall(unsigned long, bool)] → , mozilla::ErrorResult&)] [@ linux-gate.so + 0x98c] [@ linux-gate.so + 0xcd9] [@ mozilla::dom::CallbackObject::operator==(mozilla::dom::CallbackObject const&) const] [@ arena_t::MallocSmall(unsigned long, bool)] [@ JS::IncrementalReadBarrier(JS::GCCellPtr…
Crash Signature: , bool)] [@ JS::IncrementalReadBarrier(JS::GCCellPtr)] → , bool)] [@ JS::IncrementalReadBarrier(JS::GCCellPtr)] [@ js::gc::AssertGCThingHasType(js::gc::Cell*, JS::TraceKind)]
Crash Signature: , bool)] [@ JS::IncrementalReadBarrier(JS::GCCellPtr)] [@ js::gc::AssertGCThingHasType(js::gc::Cell*, JS::TraceKind)] → , bool)] [@ JS::IncrementalReadBarrier(JS::GCCellPtr)] [@ js::gc::AssertGCThingHasType(js::gc::Cell*, JS::TraceKind)] [@ js::UncheckedUnwrap(JSObject*, bool, unsigned int*)]
Crash Signature: , bool)] [@ JS::IncrementalReadBarrier(JS::GCCellPtr)] [@ js::gc::AssertGCThingHasType(js::gc::Cell*, JS::TraceKind)] [@ js::UncheckedUnwrap(JSObject*, bool, unsigned int*)] → , bool)] [@ JS::IncrementalReadBarrier(JS::GCCellPtr)] [@ js::gc::AssertGCThingHasType(js::gc::Cell*, JS::TraceKind)] [@ js::UncheckedUnwrap(JSObject*, bool, unsigned int*)] [@ js::gc::ArenaLists::refillFreeListAndAllocate(js::gc::FreeLists&, js::gc::Allo…
Crash Signature: , js::gc::AllocKind, js::gc::ShouldCheckThresholds)] → , js::gc::AllocKind, js::gc::ShouldCheckThresholds)] [@ js::gc::TenuredCell::arena() const]
Crash Signature: , js::gc::AllocKind, js::gc::ShouldCheckThresholds)] [@ js::gc::TenuredCell::arena() const] → , js::gc::AllocKind, js::gc::ShouldCheckThresholds)] [@ js::gc::TenuredCell::arena() const] [@ NS_CycleCollectorSuspectUsingNursery]
Crash Signature: , js::gc::AllocKind, js::gc::ShouldCheckThresholds)] [@ js::gc::TenuredCell::arena() const] [@ NS_CycleCollectorSuspectUsingNursery] → , js::gc::AllocKind, js::gc::ShouldCheckThresholds)] [@ js::gc::TenuredCell::arena() const] [@ NS_CycleCollectorSuspectUsingNursery] [@ js::CheckMainThread<(js::AllowedHelperThread)0>::check() const]
Crash Signature: , js::gc::AllocKind, js::gc::ShouldCheckThresholds)] [@ js::gc::TenuredCell::arena() const] [@ NS_CycleCollectorSuspectUsingNursery] [@ js::CheckMainThread<(js::AllowedHelperThread)0>::check() const] → , js::gc::AllocKind, js::gc::ShouldCheckThresholds)] [@ js::gc::TenuredCell::arena() const] [@ NS_CycleCollectorSuspectUsingNursery] [@ js::CheckMainThread<(js::AllowedHelperThread)0>::check() const] [@ js::gc::Cell::getTraceKind() const]
Crash Signature: , js::gc::AllocKind, js::gc::ShouldCheckThresholds)] [@ js::gc::TenuredCell::arena() const] [@ NS_CycleCollectorSuspectUsingNursery] [@ js::CheckMainThread<(js::AllowedHelperThread)0>::check() const] [@ js::gc::Cell::getTraceKind() const] → , js::gc::AllocKind, js::gc::ShouldCheckThresholds)] [@ js::gc::TenuredCell::arena() const] [@ NS_CycleCollectorSuspectUsingNursery] [@ js::CheckMainThread<(js::AllowedHelperThread)0>::check() const] [@ js::gc::Cell::getTraceKind() const] [@ js::CheckThre…
Crash Signature: const] → const] [@ NewObject(JSContext*, JS::Handle<js::ObjectGroup*>, js::gc::AllocKind, js::NewObjectKind, unsigned int)]
Crash Signature: const] [@ NewObject(JSContext*, JS::Handle<js::ObjectGroup*>, js::gc::AllocKind, js::NewObjectKind, unsigned int)] → const] [@ NewObject(JSContext*, JS::Handle<js::ObjectGroup*>, js::gc::AllocKind, js::NewObjectKind, unsigned int)] [@ js::gc::detail::AssertCellIsNotGray(js::gc::Cell const*)]

FWIW, I can reproduce this crash pretty easily in a VM with |./mach test --verify netwerk/test/crashtest|, but only if I run it on the entire directory. If I just load 785753-1.html in verify mode, it doesn't crash.

Crash Signature: , mozilla::Preferences::MatchKind)] [@ moz_xmalloc] [@ nsFrameMessageManager::DispatchAsyncMessage(JSContext*, nsTSubstring<char16_t> const&, JS::Handle<JS::Value>, JS::Handle<JSObject*>, nsIPrincipal*, JS::Handle<JS::Value>, mozilla::ErrorResult&)] [@ l… → , mozilla::Preferences::MatchKind)] [@ moz_xmalloc] [@ nsFrameMessageManager::DispatchAsyncMessage(JSContext*, nsTSubstring<char16_t> const&, JS::Handle<JS::Value>, JS::Handle<JSObject*>, nsIPrincipal*, JS::Handle<JS::Value>, mozilla::ErrorResult&)] [@…

Nhi - can you please follow up with the necko team on this? Thanks.

Flags: needinfo?(sdeckelmann) → needinfo?(nhnguyen)

Both test 785753-1.html, 785753-2.html (bug 1543732) have been disabled on all platforms.

Honza - since you're assigned on this bug and there's a reliable way to reproduce it (see comment #56), could you try reproducing and see if we can narrow down the changeset that introduced this?

Flags: needinfo?(nhnguyen) → needinfo?(honzab.moz)

This is a lower priority as only the test (now disabled) was crashing. I'll definitely find time, probably next week or so.

Flags: needinfo?(honzab.moz)

Both test 785753-1.html, 785753-2.html (bug 1543732) have been re-enabled here: bug 1545738

can't reproduce with STR from comment 56 (Ubuntu in VM, opt build, current nightly) :((

report from comment 66 has 1 crash and it is for a test from a non-network component: dom/media/test/crashtests/1547899.html
report from comment 67 has 1 crash and it is a duplicate of bug 1578246, SharedDummyStream with non-threadsafe refcounter used on more than one thread

previous reports were coming (also) from netwerk crashtests, but unfortunately not anymore, so no STR now :(

I'm moving this to general. I can't help with this right now realistically.

Assignee: honzab.moz → nobody
Component: Networking → General
Flags: needinfo?(dd.mozilla)

(In reply to Andreea Pavel [:apavel] from comment #69)

There is a total of 8 failures in this bug's full history: https://treeherder.mozilla.org/intermittent-failures.html#/bugdetails?startday=2019-05-16&endday=2019-09-13&tree=trunk&bug=1536772

Checked first two: both crash for a different test, not in net.

I don't believe this deserve a P2 now, lower to P3.

Please, if you feel this should be escalated, state why. Thanks.

Priority: P2 → P3

Okay Honza, we will, thank you.

See Also: → 1698165
Severity: normal → S3
Crash Signature: [@ js::InternalBarrierMethods<JS::Value>::readBarrier(JS::Value const&)] [@ google_breakpad::ExceptionHandler::WriteMinidump()] [@ js::CurrentThreadCanAccessRuntime(JSRuntime const*)] [@ mozilla::detail::EntrySlot<mozilla::HashMapEntry<unsigned int, mo… → [@ js::InternalBarrierMethods<JS::Value>::readBarrier] [@ google_breakpad::ExceptionHandler::WriteMinidump] [@ js::CurrentThreadCanAccessRuntime] [@ mozilla::detail::EntrySlot<mozilla::HashMapEntry<unsigned int, mozilla::DefaultHasher<unsi [@ ld-2.23.…

https://wiki.mozilla.org/Bug_Triage#Intermittent_Test_Failure_Cleanup
For more information, please visit BugBot documentation.

Status: NEW → RESOLVED
Closed: 1 month ago
Resolution: --- → INCOMPLETE
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: