Open Bug 1941866 Opened 1 month ago Updated 13 days ago

Intermittent Assertion failure: header->isInList(), at /builds/worker/checkouts/gecko/js/src/gc/BufferAllocator.cpp:2363

Categories

(Core :: JavaScript: GC, defect, P5)

defect

Tracking

()

People

(Reporter: intermittent-bug-filer, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, intermittent-failure, pernosco-wanted)

Filed by: amarc [at] mozilla.com
Parsed log: https://treeherder.mozilla.org/logviewer?job_id=490258629&repo=mozilla-central
Full log: https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/SDT48KLFRPS7949sLm6PGg/runs/0/artifacts/public/logs/live_backing.log


[task 2025-01-15T17:02:29.237Z] TEST-PASS | testGCPersistentRootedOutlivesRuntime | ok
[task 2025-01-15T17:02:29.237Z] testGCRootedStaticStructInternalStackStorageAugmented
[task 2025-01-15T17:02:29.271Z] TEST-PASS | testGCRootedStaticStructInternalStackStorageAugmented | ok
[task 2025-01-15T17:02:29.271Z] testGCSuppressions
[task 2025-01-15T17:02:29.304Z] TEST-PASS | testGCSuppressions | ok
[task 2025-01-15T17:02:29.304Z] testGCExactRooting
[task 2025-01-15T17:02:29.337Z] TEST-PASS | testGCExactRooting | ok
[task 2025-01-15T17:02:29.337Z] testGCChunkPool
[task 2025-01-15T17:02:29.373Z] TEST-PASS | testGCChunkPool | ok
[task 2025-01-15T17:02:29.373Z] testGCCellPtr
[task 2025-01-15T17:02:29.405Z] TEST-PASS | testGCCellPtr | ok
[task 2025-01-15T17:02:29.405Z] testBufferAllocator_stress
[task 2025-01-15T17:02:29.437Z] heap == 49152, malloc == 9468
[task 2025-01-15T17:02:30.191Z] [4088] Assertion failure: header->isInList(), at /builds/worker/checkouts/gecko/js/src/gc/BufferAllocator.cpp:2363
[task 2025-01-15T17:02:30.191Z] #01: ???[/builds/worker/workspace/obj-spider/dist/bin/jsapi-tests +0x2455a65]
[task 2025-01-15T17:02:30.191Z] #02: ???[/builds/worker/workspace/obj-spider/dist/bin/jsapi-tests +0x245576b]
[task 2025-01-15T17:02:30.191Z] #03: ???[/builds/worker/workspace/obj-spider/dist/bin/jsapi-tests +0x2454216]
[task 2025-01-15T17:02:30.191Z] #04: ???[/builds/worker/workspace/obj-spider/dist/bin/jsapi-tests +0x1aa13a4]
[task 2025-01-15T17:02:30.191Z] #05: ???[/builds/worker/workspace/obj-spider/dist/bin/jsapi-tests +0x1a6addd]
[task 2025-01-15T17:02:30.251Z] in directory /builds/worker/workspace/obj-spider, running ['make', 'check-jstests']
[task 2025-01-15T17:02:30.257Z] make -C js/src check-jstests
[task 2025-01-15T17:02:30.261Z] make[1]: Entering directory '/builds/worker/workspace/obj-spider/js/src'
[task 2025-01-15T17:02:30.261Z] /builds/worker/.mozbuild/srcdirs/gecko-8a5b87fe5d69/_virtualenvs/build/bin/python -u /builds/worker/checkouts/gecko/js/src/tests/jstests.py \
[task 2025-01-15T17:02:30.261Z] 	--no-progress --format=automation --timeout 300 \
[task 2025-01-15T17:02:30.261Z] 	--show-slow --jitflags=debug \
[task 2025-01-15T17:02:30.261Z] 	../../dist/bin/js
[task 2025-01-15T17:02:52.911Z] TEST-PASS | non262/argumentsLengthOpt.js | (args: "") [0.0 s]
[task 2025-01-15T17:02:52.951Z] TEST-PASS | non262/extensions/shareddataview.js | (args: "") [0.0 s]
[task 2025-01-15T17:02:52.954Z] TEST-PASS | non262/argumentsLengthOpt.js | (args: "--baseline-eager --write-protect-code=off") [0.0 s]
[task 2025-01-15T17:02:52.954Z] TEST-PASS | non262/extensions/getset-006.js | (args: "") [0.0 s]
[task 2025-01-15T17:02:52.957Z] TEST-PASS | non262/extensions/for-loop-with-lexical-declaration-and-nested-function-statement.js | (args: "") [0.0 s]
[task 2025-01-15T17:02:52.957Z] TEST-PASS | non262/extensions/regress-354297.js | (args: "") [0.0 s]
[task 2025-01-15T17:02:52.957Z] TEST-KNOWN-FAIL | non262/extensions/regress-372309.js | (args: "") | (SKIP) [0.0 s]
[task 2025-01-15T17:02:52.958Z] TEST-PASS | non262/extensions/for-loop-with-lexical-declaration-and-nested-function-statement.js | (args: "--baseline-eager --write-protect-code=off") [0.0 s]
[task 2025-01-15T17:02:52.958Z] TEST-KNOWN-FAIL | non262/extensions/regress-372309.js | (args: "--ion-eager --ion-offthread-compile=off --more-compartments") | (SKIP) [0.0 s]
[task 2025-01-15T17:02:52.959Z] TEST-KNOWN-FAIL | non262/extensions/regress-372309.js | (args: "--baseline-eager --write-protect-code=off") | (SKIP) [0.0 s]
[task 2025-01-15T17:02:52.959Z] TEST-PASS | non262/extensions/getset-006.js | (args: "--baseline-eager --write-protect-code=off") [0.0 s]
[task 2025-01-15T17:02:52.964Z] TEST-PASS | non262/extensions/shareddataview.js | (args: "--baseline-eager --write-protect-code=off") [0.0 s]

I haven't been able to reproduce this failure locally.

The latest crash has a stack:

[task 2025-01-28T23:55:11.422Z] PROCESS-CRASH | None [@ js::gc::BufferAllocator::freeLarge] | mozcrash.py
[task 2025-01-28T23:55:11.422Z] Crash dump filename: /tmp/67a1297d-c19c-72b2-587b-db10e6606714.dmp
[task 2025-01-28T23:55:11.422Z] Process type: unknown
[task 2025-01-28T23:55:11.422Z] Process pid: 11259
[task 2025-01-28T23:55:11.422Z] Operating system: Linux
[task 2025-01-28T23:55:11.422Z]                   5.4.0-1106-gcp #115~18.04.1-Ubuntu SMP Mon May 22 20:46:39 UTC 2023
[task 2025-01-28T23:55:11.422Z] CPU: amd64
[task 2025-01-28T23:55:11.422Z]      family 6 model 85 stepping 7
[task 2025-01-28T23:55:11.422Z]      16 CPUs
[task 2025-01-28T23:55:11.422Z] Linux debian 12 - bookworm (Debian GNU/Linux 12 (bookworm))
[task 2025-01-28T23:55:11.422Z] 
[task 2025-01-28T23:55:11.422Z] Crash reason:  SIGSEGV / SEGV_MAPERR
[task 2025-01-28T23:55:11.422Z] Crash address: 0x0000000000000000
[task 2025-01-28T23:55:11.422Z] Crashing instruction: `mov dword [0x0], 0x8bd`
[task 2025-01-28T23:55:11.422Z] Memory accessed by instruction:
[task 2025-01-28T23:55:11.422Z]   0. Address: 0x0000000000000000
[task 2025-01-28T23:55:11.422Z]      Size: 4
[task 2025-01-28T23:55:11.422Z]      Access type: Write
[task 2025-01-28T23:55:11.422Z] No instruction pointer update by instruction
[task 2025-01-28T23:55:11.422Z] Process uptime: not available
[task 2025-01-28T23:55:11.422Z] 
[task 2025-01-28T23:55:11.422Z] Linux memory map count: 232
[task 2025-01-28T23:55:11.422Z] 
[task 2025-01-28T23:55:11.422Z] Thread 0 jsapi-tests (crashed) - tid: 11259
[task 2025-01-28T23:55:11.422Z]  0  jsapi-tests!js::gc::BufferAllocator::freeLarge(void*) [BufferAllocator.cpp:71355d0cef22d394f5d46172f87495991c9ea90e : 2237 + 0x0]
[task 2025-01-28T23:55:11.422Z]      rax = 0x000055df657deb34    rdx = 0x0000000000000001
[task 2025-01-28T23:55:11.422Z]      rcx = 0x000055df685a5fa0    rbx = 0x0000011ee9a00000
[task 2025-01-28T23:55:11.422Z]      rsi = 0x0000000000000001    rdi = 0x00007fb947d31a00
[task 2025-01-28T23:55:11.422Z]      rbp = 0x00007fffa44d2610    rsp = 0x00007fffa44d25f0
[task 2025-01-28T23:55:11.422Z]       r8 = 0x0000000000000000     r9 = 0x0000000000000003
[task 2025-01-28T23:55:11.422Z]      r10 = 0x0000000000000000    r11 = 0x0000000000000293
[task 2025-01-28T23:55:11.422Z]      r12 = 0x00000000000001f8    r13 = 0x00000000000001f8
[task 2025-01-28T23:55:11.422Z]      r14 = 0x00007fb946ffd708    r15 = 0x0000272785580d08
[task 2025-01-28T23:55:11.422Z]      rip = 0x000055df678db9b8
[task 2025-01-28T23:55:11.422Z]     Found by: given as instruction pointer in context
[task 2025-01-28T23:55:11.422Z]  1  jsapi-tests!js::gc::BufferAllocator::realloc(void*, unsigned long, bool)::$_0::operator()() const [BufferAllocator.cpp:71355d0cef22d394f5d46172f87495991c9ea90e : 547]
[task 2025-01-28T23:55:11.422Z]     Found by: inlining
[task 2025-01-28T23:55:11.422Z]  2  jsapi-tests!mozilla::ScopeExit<js::gc::BufferAllocator::realloc(void*, unsigned long, bool)::$_0>::~ScopeExit() [ScopeExit.h:71355d0cef22d394f5d46172f87495991c9ea90e : 106]
[task 2025-01-28T23:55:11.422Z]     Found by: inlining
[task 2025-01-28T23:55:11.422Z]  3  jsapi-tests!js::gc::BufferAllocator::realloc(void*, unsigned long, bool) [BufferAllocator.cpp:71355d0cef22d394f5d46172f87495991c9ea90e : 566 + 0xa]
[task 2025-01-28T23:55:11.422Z]      rbx = 0x0000011ee9a00048    rbp = 0x00007fffa44d2650
[task 2025-01-28T23:55:11.422Z]      rsp = 0x00007fffa44d2620    r12 = 0x00000000000001f8
[task 2025-01-28T23:55:11.422Z]      r13 = 0x00000000000001f8    r14 = 0x00007fb946ffd708
[task 2025-01-28T23:55:11.422Z]      r15 = 0x0000272785580d08    rip = 0x000055df678da33a
[task 2025-01-28T23:55:11.422Z]     Found by: call frame info
[task 2025-01-28T23:55:11.422Z]  4  jsapi-tests!js::gc::ReallocBuffer(JS::Zone*, void*, unsigned long, bool) [BufferAllocator-inl.h:71355d0cef22d394f5d46172f87495991c9ea90e : 127]
[task 2025-01-28T23:55:11.422Z]     Found by: inlining
[task 2025-01-28T23:55:11.422Z]  5  jsapi-tests!cls_testBufferAllocator_stress::run(JS::Handle<JSObject*>) [testGCAllocator.cpp:71355d0cef22d394f5d46172f87495991c9ea90e : 686 + 0xa2]
[task 2025-01-28T23:55:11.422Z]      rbx = 0xffffffffffffafd0    rbp = 0x00007fffa44d36e0
[task 2025-01-28T23:55:11.422Z]      rsp = 0x00007fffa44d2660    r12 = 0x000000000000013a
[task 2025-01-28T23:55:11.422Z]      r13 = 0x0000000000000045    r14 = 0x000000000000afec
[task 2025-01-28T23:55:11.422Z]      r15 = 0x0000011ee9a00048    rip = 0x000055df66f0ad24
[task 2025-01-28T23:55:11.422Z]     Found by: call frame info
[task 2025-01-28T23:55:11.422Z]  6  jsapi-tests!main::$_1::operator()(JSAPIRuntimeTest*) const [tests.cpp:71355d0cef22d394f5d46172f87495991c9ea90e : 269]
[task 2025-01-28T23:55:11.422Z]     Found by: inlining
[task 2025-01-28T23:55:11.422Z]  7  jsapi-tests!RunTests<JSAPIRuntimeTest, main::$_0, main::$_1, main::$_2>(int&, int&, CommandOptions&, JSAPIRuntimeTest*, main::$_0, main::$_1, main::$_2) [tests.cpp:71355d0cef22d394f5d46172f87495991c9ea90e : 197]
[task 2025-01-28T23:55:11.422Z]     Found by: inlining
You need to log in before you can comment on or make changes to this bug.