Open Bug 1944574 Opened 14 days ago Updated 5 days ago

Intermittent TV MOZ_ASSERT(retainedBytes_ >= nbytes) [@ js::gc::HeapSize::removeBytes] | dom/media/webrtc/tests/mochitests/mochitest_peerconnection.toml

Categories

(Core :: JavaScript: GC, defect, P5)

defect

Tracking

()

Tracking Status
firefox-esr128 --- unaffected
firefox134 --- unaffected
firefox135 --- unaffected
firefox136 --- affected
firefox137 --- affected

People

(Reporter: intermittent-bug-filer, Unassigned)

References

(Blocks 2 open bugs, Regression)

Details

(4 keywords)

Crash Data

Filed by: amarc [at] mozilla.com
Parsed log: https://treeherder.mozilla.org/logviewer?job_id=492300244&repo=autoland
Full log: https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/YfdyWRQfRWyQTAssti_Mfg/runs/0/artifacts/public/logs/live_backing.log
Reftest URL: https://hg.mozilla.org/mozilla-central/raw-file/tip/layout/tools/reftest/reftest-analyzer.xhtml#logurl=https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/YfdyWRQfRWyQTAssti_Mfg/runs/0/artifacts/public/logs/live_backing.log&only_show_unexpected=1


[task 2025-01-29T13:19:31.744Z] 13:19:31     INFO -  TEST-START | dom/media/webrtc/tests/mochitests/test_peerConnection_simulcastOddResolution_oldSetParameters.html
[task 2025-01-29T13:20:01.948Z] 13:20:01     INFO -  wait for org.mozilla.geckoview.test_runner complete; top activity=com.android.launcher3
[task 2025-01-29T13:20:01.948Z] 13:20:01     INFO -  runtestsremote.py | Application ran for: 0:00:36.847156
[task 2025-01-29T13:20:02.023Z] 13:20:02     INFO -  mozcrash Copy/paste: /builds/worker/fetches/minidump-stackwalk/minidump-stackwalk --symbols-url=https://symbols.mozilla.org/ --cyborg=/tmp/tmp1c9v78_e/78ee2cba-bb2d-0290-8898-c4604792b104.trace /tmp/tmplsflzz9a/78ee2cba-bb2d-0290-8898-c4604792b104.dmp /builds/worker/workspace/build/symbols
[task 2025-01-29T13:20:07.297Z] 13:20:07     INFO -  mozcrash Saved minidump as /builds/worker/workspace/build/blobber_upload_dir/78ee2cba-bb2d-0290-8898-c4604792b104.dmp
[task 2025-01-29T13:20:07.297Z] 13:20:07     INFO -  mozcrash Saved app info as /builds/worker/workspace/build/blobber_upload_dir/78ee2cba-bb2d-0290-8898-c4604792b104.extra
[task 2025-01-29T13:20:07.298Z] 13:20:07  WARNING -  PROCESS-CRASH | MOZ_ASSERT(retainedBytes_ >= nbytes) [@ js::gc::HeapSize::removeBytes] | dom/media/webrtc/tests/mochitests/mochitest_peerconnection.toml
[task 2025-01-29T13:20:07.298Z] 13:20:07     INFO -  Process type: content
[task 2025-01-29T13:20:07.298Z] 13:20:07     INFO -  Process pid: 12752
[task 2025-01-29T13:20:07.298Z] 13:20:07     INFO -  Mozilla crash reason: MOZ_ASSERT(retainedBytes_ >= nbytes)
[task 2025-01-29T13:20:07.298Z] 13:20:07     INFO -  Crash dump filename: /tmp/tmplsflzz9a/78ee2cba-bb2d-0290-8898-c4604792b104.dmp
[task 2025-01-29T13:20:07.298Z] 13:20:07     INFO -  Operating system: Android
[task 2025-01-29T13:20:07.299Z] 13:20:07     INFO -                    0.0.0 Linux 3.10.0+ #260 SMP PREEMPT Fri May 19 12:48:14 PDT 2017 x86_64
[task 2025-01-29T13:20:07.299Z] 13:20:07     INFO -  CPU: amd64
[task 2025-01-29T13:20:07.299Z] 13:20:07     INFO -       family 6 model 6 stepping 3
[task 2025-01-29T13:20:07.299Z] 13:20:07     INFO -       4 CPUs
[task 2025-01-29T13:20:07.299Z] 13:20:07     INFO -  Crash reason:  SIGSEGV / SEGV_MAPERR
[task 2025-01-29T13:20:07.299Z] 13:20:07     INFO -  Crash address: 0x0000000000000000
[task 2025-01-29T13:20:07.299Z] 13:20:07     INFO -  Crashing instruction: `mov dword [0x0], 0x2a0`
[task 2025-01-29T13:20:07.299Z] 13:20:07     INFO -  Memory accessed by instruction:
[task 2025-01-29T13:20:07.299Z] 13:20:07     INFO -    0. Address: 0x0000000000000000
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -       Size: 4
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -       Access type: Write
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -  No instruction pointer update by instruction
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -  Crashing address may be the result of a flipped bit:
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -    0. Valid address: 0x0000000020000000 (0.250)
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -    1. Valid address: 0x0000000040000000 (0.250)
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -  Process uptime: not available
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -  Linux memory map count: 1391
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -  Thread 11 Web Content (crashed) - tid: 12752
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -   0  libxul.so!js::gc::HeapSize::removeBytes(unsigned long, bool) [Scheduling.h:923c6123afcb19d5b49694473b1058484fb4a844 : 672]
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -      Found by: inlining
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -   1  libxul.so!js::ZoneAllocator::removeCellMemory(js::gc::Cell*, unsigned long, js::MemoryUse, bool) [ZoneAllocator.h:923c6123afcb19d5b49694473b1058484fb4a844 : 88 + 0x62]
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -       rax = 0x00007d543e0dbb33    rdx = 0x0000000000000001
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -       rcx = 0x00007d54670ebab0    rbx = 0x0000000000384000
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -       rsi = 0x00007d54501c1860    rdi = 0x00007d54670ed644
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -       rbp = 0x00007d544ef4e510    rsp = 0x00007d544ef4e4e0
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -        r8 = 0x00000000000031d0     r9 = 0x00007d544ef50450
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -       r10 = 0x0000000000000000    r11 = 0x0000000000000246
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -       r12 = 0x00007d5434b84000    r13 = 0x0000000000000001
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -       r14 = 0x000021edaea26b28    r15 = 0x0000000000000001
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -       rip = 0x00007d544782ed42
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -      Found by: given as instruction pointer in context
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -   2  libxul.so!mozilla::dom::CanvasRenderingContext2D_Binding::_finalize(JS::GCContext*, JSObject*) [CanvasRenderingContext2DBinding.cpp: : 9322 + 0xf]
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -       rbx = 0x000021edaea26b28    rbp = 0x00007d544ef4e540
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -       rsp = 0x00007d544ef4e520    r12 = 0xfffe4b4b4b4b4b4b
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -       r13 = 0x000021edaea26b28    r14 = 0x00007d5434a23000
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -       r15 = 0x000021edaea26858    rip = 0x00007d54441ab5c7
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -      Found by: call frame info
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -   3  libxul.so!js::gc::Arena::finalize<JSObject>(JS::GCContext*, js::gc::AllocKind, unsigned long) [Sweeping.cpp:923c6123afcb19d5b49694473b1058484fb4a844 : 141 + 0xe]
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -       rbx = 0x0000000000000028    rbp = 0x00007d544ef4e5f0
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -       rsp = 0x00007d544ef4e550    r12 = 0xfffe4b4b4b4b4b4b
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -       r13 = 0x000021edaea26b28    r14 = 0x0000000000000b00
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -       r15 = 0x000021edaea26858    rip = 0x00007d54482645df
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -      Found by: call frame info
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -   4  libxul.so!FinalizeTypedArenas<JSObject>(JS::GCContext*, js::gc::ArenaList&, js::gc::SortedArenaList&, js::gc::AllocKind, JS::SliceBudget&) [Sweeping.cpp:923c6123afcb19d5b49694473b1058484fb4a844 : 197 + 0x13]
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -       rbx = 0x00007d544ef4e9a0    rbp = 0x00007d544ef4e650
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -       rsp = 0x00007d544ef4e600    r12 = 0x00007d5434b84528
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -       r13 = 0x0000000000000007    r14 = 0x000021edaea26000
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -       r15 = 0x0000000000000065    rip = 0x00007d5448264054
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -      Found by: call frame info
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -   5  libxul.so!js::gc::GCRuntime::foregroundFinalize(JS::GCContext*, JS::Zone*, js::gc::AllocKind, JS::SliceBudget&, js::gc::SortedArenaList&) [Sweeping.cpp:923c6123afcb19d5b49694473b1058484fb4a844 : 1831]
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -      Found by: inlining
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -   6  libxul.so!js::gc::GCRuntime::finalizeAllocKind(JS::GCContext*, JS::SliceBudget&) [Sweeping.cpp:923c6123afcb19d5b49694473b1058484fb4a844 : 2045 + 0x4b]
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -       rbx = 0x00007d5434b84000    rbp = 0x00007d544ef4e6b0
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -       rsp = 0x00007d544ef4e660    r12 = 0x00007d543592c608
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -       r13 = 0x0000000000000004    r14 = 0x00007d543592c5f8
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -       r15 = 0x00007d543592d910    rip = 0x00007d544824c7ad
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -      Found by: call frame info
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -   7  libxul.so!sweepaction::SweepActionForEach<ContainerIter<mozilla::EnumSet<js::gc::AllocKind, unsigned long> >, mozilla::EnumSet<js::gc::AllocKind, unsigned long> >::run(js::gc::SweepAction::Args&) [Sweeping.cpp:923c6123afcb19d5b49694473b1058484fb4a844 : 2290 + 0x8]
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -       rbx = 0x00007d54359240a0    rbp = 0x00007d544ef4e6f0
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -       rsp = 0x00007d544ef4e6c0    r12 = 0x0000000000000001
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -       r13 = 0x00007d543592c608    r14 = 0x00007d544ef4e7e0
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -       r15 = 0x00007d544ef4e6c0    rip = 0x00007d54482722b4
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -      Found by: call frame info
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -   8  libxul.so!sweepaction::SweepActionSequence::run(js::gc::SweepAction::Args&) [Sweeping.cpp:923c6123afcb19d5b49694473b1058484fb4a844 : 2255 + 0x8]
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -       rbx = 0x00007d543590f830    rbp = 0x00007d544ef4e720
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -       rsp = 0x00007d544ef4e700    r12 = 0x00007d544ef4e900
[task 2025-01-29T13:20:07.302Z] 13:20:07     INFO -       r13 = 0x00007d543592c608    r14 = 0x00007d544ef4e7e0
[task 2025-01-29T13:20:07.303Z] 13:20:07     INFO -       r15 = 0x00007d543590f860    rip = 0x00007d544827abe5
[task 2025-01-29T13:20:07.303Z] 13:20:07     INFO -      Found by: call frame info
[task 2025-01-29T13:20:07.303Z] 13:20:07     INFO -   9  libxul.so!sweepaction::SweepActionForEach<js::gc::SweepGroupZonesIter, JSRuntime*>::run(js::gc::SweepAction::Args&) [Sweeping.cpp:923c6123afcb19d5b49694473b1058484fb4a844 : 2290 + 0x8]
[task 2025-01-29T13:20:07.303Z] 13:20:07     INFO -       rbx = 0x00007d5435904070    rbp = 0x00007d544ef4e750
[task 2025-01-29T13:20:07.303Z] 13:20:07     INFO -       rsp = 0x00007d544ef4e730    r12 = 0x00007d544ef4e900
[task 2025-01-29T13:20:07.303Z] 13:20:07     INFO -       r13 = 0x00007d543592c608    r14 = 0x00007d544ef4e7e0
[task 2025-01-29T13:20:07.303Z] 13:20:07     INFO -       r15 = 0x00007d5435904090    rip = 0x00007d5448271c70
[task 2025-01-29T13:20:07.303Z] 13:20:07     INFO -      Found by: call frame info
[task 2025-01-29T13:20:07.303Z] 13:20:07     INFO -  10  libxul.so!sweepaction::SweepActionSequence::run(js::gc::SweepAction::Args&) [Sweeping.cpp:923c6123afcb19d5b49694473b1058484fb4a844 : 2255 + 0x8]
[task 2025-01-29T13:20:07.303Z] 13:20:07     INFO -       rbx = 0x00007d543590f880    rbp = 0x00007d544ef4e780
[task 2025-01-29T13:20:07.304Z] 13:20:07     INFO -       rsp = 0x00007d544ef4e760    r12 = 0x00007d544ef4e900
[task 2025-01-29T13:20:07.304Z] 13:20:07     INFO -       r13 = 0x00007d543592c608    r14 = 0x00007d544ef4e7e0
[task 2025-01-29T13:20:07.304Z] 13:20:07     INFO -       r15 = 0x00007d543590f8b0    rip = 0x00007d544827abe5
[task 2025-01-29T13:20:07.304Z] 13:20:07     INFO -      Found by: call frame info
[task 2025-01-29T13:20:07.304Z] 13:20:07     INFO -  11  libxul.so!sweepaction::SweepActionForEach<js::gc::SweepGroupsIter, JSRuntime*>::run(js::gc::SweepAction::Args&) [Sweeping.cpp:923c6123afcb19d5b49694473b1058484fb4a844 : 2290 + 0x8]
[task 2025-01-29T13:20:07.304Z] 13:20:07     INFO -       rbx = 0x00007d54359040a0    rbp = 0x00007d544ef4e7b0
[task 2025-01-29T13:20:07.304Z] 13:20:07     INFO -       rsp = 0x00007d544ef4e790    r12 = 0x00007d544ef4e9a0
[task 2025-01-29T13:20:07.304Z] 13:20:07     INFO -       r13 = 0x00007d543592c608    r14 = 0x00007d544ef4e7e0
[task 2025-01-29T13:20:07.304Z] 13:20:07     INFO -       r15 = 0x00007d54355a7000    rip = 0x00007d5448271726
[task 2025-01-29T13:20:07.304Z] 13:20:07     INFO -      Found by: call frame info
[task 2025-01-29T13:20:07.304Z] 13:20:07     INFO -  12  libxul.so!js::gc::GCRuntime::performSweepActions(JS::SliceBudget&) [Sweeping.cpp:923c6123afcb19d5b49694473b1058484fb4a844 : 2451 + 0xc]
[task 2025-01-29T13:20:07.305Z] 13:20:07     INFO -       rbx = 0x00007d543592c6a8    rbp = 0x00007d544ef4e880
[task 2025-01-29T13:20:07.305Z] 13:20:07     INFO -       rsp = 0x00007d544ef4e7c0    r12 = 0x00007d544ef4e9a0
[task 2025-01-29T13:20:07.305Z] 13:20:07     INFO -       r13 = 0x00007d543592c608    r14 = 0x00007d543592c5f8
[task 2025-01-29T13:20:07.305Z] 13:20:07     INFO -       r15 = 0x00007d543592c000    rip = 0x00007d544824f092
[task 2025-01-29T13:20:07.305Z] 13:20:07     INFO -      Found by: call frame info
<...>
[task 2025-01-29T13:20:07.542Z] 13:20:07     INFO -  0x7d546d169000 - 0x7d546d23cfff  linker64  ???
[task 2025-01-29T13:20:07.542Z] 13:20:07     INFO -  0x7d546d24c000 - 0x7d546d24ffff  app_process64  ???  (main)
[task 2025-01-29T13:20:07.542Z] 13:20:07     INFO -  0x7fff109fe000 - 0x7fff109fffff  linux-gate.so  ???
[task 2025-01-29T13:20:07.542Z] 13:20:07     INFO -  Unloaded modules:
[task 2025-01-29T13:20:07.542Z] 13:20:07     INFO -  Unimplemented streams encountered:
[task 2025-01-29T13:20:07.542Z] 13:20:07     INFO -  Stream 0x00000000 UnusedStream (Official) @ 0x00000000
[task 2025-01-29T13:20:07.542Z] 13:20:07     INFO -  Stream 0x47670006 LinuxCmdLine (Google Extension) @ 0x00077e78
[task 2025-01-29T13:20:07.542Z] 13:20:07     INFO -  Stream 0x47670008 LinuxAuxv (Google Extension) @ 0x00078217
[task 2025-01-29T13:20:07.543Z] 13:20:07     INFO -  Stream 0x4767000a LinuxDsoDebug (Google Extension) @ 0x0009dea6
[task 2025-01-29T13:20:07.543Z] 13:20:07     INFO -  Stopping web server
[task 2025-01-29T13:20:07.543Z] 13:20:07     INFO -  Server shut down.
[task 2025-01-29T13:20:07.543Z] 13:20:07     INFO -  Web server killed.
[task 2025-01-29T13:20:07.543Z] 13:20:07     INFO -  Stopping web socket server
[task 2025-01-29T13:20:07.543Z] 13:20:07     INFO -  Stopping ssltunnel
[task 2025-01-29T13:20:07.543Z] 13:20:07     INFO -  Stopping websocket/process bridge
[task 2025-01-29T13:20:07.543Z] 13:20:07     INFO -  runtests.py | Running tests: end.
[task 2025-01-29T13:20:07.690Z] 13:20:07     INFO -  Buffered messages logged at 13:19:33
[task 2025-01-29T13:20:07.690Z] 13:20:07     INFO -  TEST-PASS | dom/media/webrtc/tests/mochitests/test_peerConnection_simulcastOddResolution_oldSetParameters.html | A valid string reason is expected
[task 2025-01-29T13:20:07.690Z] 13:20:07     INFO -  TEST-PASS | dom/media/webrtc/tests/mochitests/test_peerConnection_simulcastOddResolution_oldSetParameters.html | Reason cannot be empty
Keywords: regression
Regressed by: 1210175

:pehrsons, since you are the author of the regressor, bug 1210175, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Flags: needinfo?(apehrson)

Set release status flags based on info from the regressing bug 1210175

This must be unrelated to bug 1210175. I see js::gc on the crashing stack so moving there.

Component: WebRTC: Audio/Video → JavaScript: GC
Flags: needinfo?(apehrson)

Based on the pointer being reported as potential bit flips …

Severity: -- → S4
Priority: -- → P5

Set release status flags based on info from the regressing bug 1210175

You need to log in before you can comment on or make changes to this bug.