1918957 - Assertion failure: ok (Incremental marking verification failed), at /builds/worker/checkouts/gecko/js/src/gc/Verifier.cpp:768

Status: NEW

(Core :: JavaScript: GC, defect, P2)

Description

[Tyson Smith [:tsmith]]

Found while fuzzing m-c 20240910-ebf0e33ba93e (--enable-debug --enable-fuzzing)

Found with javascript.options.mem.gc_zeal.mode=11.

I don't have a reliable test case but I do have a Pernosco session: https://pernos.co/debug/96tMsSdxiyAxPuoYMoYZTA/index.html

Assertion failure: ok (Incremental marking verification failed), at /builds/worker/checkouts/gecko/js/src/gc/Verifier.cpp:768

#0 0x774242a124d1 in js::gc::MarkingValidator::validate() /builds/worker/checkouts/gecko/js/src/gc/Verifier.cpp:768:3
#1 0x7742429fbf7c in validateIncrementalMarking /builds/worker/checkouts/gecko/js/src/gc/Verifier.cpp:784:23
#2 0x7742429fbf7c in js::gc::GCRuntime::beginSweepingSweepGroup(JS::GCContext*, JS::SliceBudget&) /builds/worker/checkouts/gecko/js/src/gc/Sweeping.cpp:1589:3
#3 0x774242a28300 in sweepaction::SweepActionSequence::run(js::gc::SweepAction::Args&) /builds/worker/checkouts/gecko/js/src/gc/Sweeping.cpp:2219:23
#4 0x774242a2258e in sweepaction::SweepActionForEach<js::gc::SweepGroupsIter, JSRuntime*>::run(js::gc::SweepAction::Args&) /builds/worker/checkouts/gecko/js/src/gc/Sweeping.cpp:2254:19
#5 0x774242a01111 in js::gc::GCRuntime::performSweepActions(JS::SliceBudget&) /builds/worker/checkouts/gecko/js/src/gc/Sweeping.cpp:2415:53
#6 0x774242964a21 in js::gc::GCRuntime::incrementalSlice(JS::SliceBudget&, JS::GCReason, bool) /builds/worker/checkouts/gecko/js/src/gc/GC.cpp:3904:11
#7 0x774242967b4f in js::gc::GCRuntime::gcCycle(bool, JS::SliceBudget const&, JS::GCReason) /builds/worker/checkouts/gecko/js/src/gc/GC.cpp:4420:3
#8 0x7742429692f3 in js::gc::GCRuntime::collect(bool, JS::SliceBudget const&, JS::GCReason) /builds/worker/checkouts/gecko/js/src/gc/GC.cpp:4609:9
#9 0x77423dd33ffd in GarbageCollectImpl(JS::GCReason, nsJSContext::IsShrinking, JS::SliceBudget const&) /builds/worker/checkouts/gecko/dom/base/nsJSEnvironment.cpp:993:5
#10 0x77423dd34250 in nsJSContext::RunIncrementalGCSlice(JS::GCReason, nsJSContext::IsShrinking, JS::SliceBudget&) /builds/worker/checkouts/gecko/dom/base/nsJSEnvironment.cpp:1030:3
#11 0x77423d93d433 in mozilla::CCGCScheduler::GCRunnerFiredDoGC(mozilla::TimeStamp, mozilla::GCRunnerStep const&) /builds/worker/checkouts/gecko/dom/base/CCGCScheduler.cpp:353:3
#12 0x77423d93c954 in mozilla::CCGCScheduler::GCRunnerFired(mozilla::TimeStamp) /builds/worker/checkouts/gecko/dom/base/CCGCScheduler.cpp:312:10
#13 0x77423bc1f10e in operator() /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/std_function.h:687:14
#14 0x77423bc1f10e in mozilla::IdleTaskRunner::Run() /builds/worker/checkouts/gecko/xpcom/threads/IdleTaskRunner.cpp:124:14
#15 0x77423bc1fc4e in mozilla::IdleTaskRunnerTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/IdleTaskRunner.cpp:45:15
#16 0x77423bc2dae6 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:945:26
#17 0x77423bc2c65e in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:810:15
#18 0x77423bc2c975 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:554:36
#19 0x77423bc3b9e6 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:268:37
#20 0x77423bc3b9e6 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548:5
#21 0x77423bc4f10b in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1155:16
#22 0x77423bc55def in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
#23 0x77423c7b7da5 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
#24 0x77423c70fc61 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3
#25 0x77423c70fc61 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3
#26 0x774240f7c148 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:148:27
#27 0x774241029748 in nsAppShell::Run() /builds/worker/checkouts/gecko/widget/gtk/nsAppShell.cpp:469:33
#28 0x774241ee8b2b in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:710:20
#29 0x77423c7b8bf6 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:235:9
#30 0x77423c70fc61 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3
#31 0x77423c70fc61 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3
#32 0x774241ee83bb in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:645:34
#33 0x57ce564c8a2e in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:403:22

Comment 1

[BugBot [:suhaib / :marco]]

The severity field is not set for this bug.
:willyelm, could you have a look please?

For more information, please visit BugBot documentation.

Comment 2

[Steven DeTar [:sdetar]]

Jon, could you take a look at this bug and help us triage? It does have a Pernosco recording so that should help.

Comment 3

[Jon Coppeard (:jonco) (PTO until 14th September)]

I've spent a while looking into this bug haven't worked out what's going on.

We crash because marking validation finds 5 XrayHolder objects that are unmarked that it thinks should be marked gray. I looked at at the first one. It was allocated before the start of GC. Non-incremental marking finds it as reserved slot zero of a CCW. The wrapper is element zero of an array with inline elements. I didn't spot anything obviously wrong.

Steve do you have any ideas here?

Comment 4

[Tyson Smith [:tsmith]]

(In reply to Jon Coppeard (:jonco) from comment #3)

I've spent a while looking into this bug haven't worked out what's going on.

Would an updated Pernosco session be helpful? Are there any debug flags I can set to get more info? The fuzzers do hit this pretty frequently.

Comment 5

[BugBot [:suhaib / :marco]]

This bug prevents fuzzing from making progress; however, it has low severity. It is important for fuzz blocker bugs to be addressed in a timely manner (see here why?).
:sdetar, could you consider increasing the severity?

For more information, please visit BugBot documentation.

Comment 6

[Jon Coppeard (:jonco) (PTO until 14th September)]

(In reply to Tyson Smith [:tsmith] from comment #4)
Is this still happening? Is it still a fuzzblocker?

Comment 7

[Tyson Smith [:tsmith]]

The reports subsided 2025-07-21 (no long a fuzzblocker). I'm not sure if this is still reproducible because it is currently disabled (when browser fuzzing) due to triggering intermittent startup hangs. That said, the last reports I see coincide with when it was disabled.