If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

"ASSERTION: Fault in cycle collector: zero refcount" and/or crash related to cycle collector with -moz-binding

RESOLVED FIXED

Status

()

Core
XUL
--
critical
RESOLVED FIXED
10 years ago
9 years ago

People

(Reporter: Jesse Ruderman, Assigned: dbaron)

Tracking

(Blocks: 1 bug, 4 keywords)

Trunk
x86
Mac OS X
assertion, crash, mlk, testcase
Points:
---
Bug Flags:
blocking1.9 ?
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(3 attachments, 2 obsolete attachments)

(Reporter)

Description

10 years ago
Reloading this testcase about 20 times triggers:

###!!! ASSERTION: Fault in cycle collector: zero refcount (ptr: 3bfa0a40)
: 'Not Reached', file /Users/jruderman/trunk/mozilla/xpcom/base/nsCycleCollector.cpp, line 920

or

###!!! ASSERTION: nsCycleCollectionParticipant shouldn't change!: 'result->mParticipant == aParticipant', file /Users/jruderman/trunk/mozilla/xpcom/base/nsCycleCollector.cpp, line 1107

Sometimes the first assertion is repeated and/or accompanied by

###!!! ASSERTION: JS object but unknown to the JS GC?: 'refcount > 0', file /Users/jruderman/trunk/mozilla/js/src/xpconnect/src/nsXPConnect.cpp, line 672

The testcase can also cause crashes, e.g. during shutdown, but not reliably.

Tested with Mac trunk debug.
Flags: blocking1.9?
(Reporter)

Comment 1

10 years ago
Created attachment 271017 [details]
testcase (can crash Firefox)
(Reporter)

Comment 2

10 years ago
Created attachment 271018 [details]
testcase (can crash Firefox)

Changed to reference url('#t') instead of url('t') so it doesn't try to load an extra URL from Bugzilla each time.
Attachment #271017 - Attachment is obsolete: true
This is a 1.9 blocker, and it's great to have a small testcase. The bug needs an assignee. Any takers from the cc: list?

/be
Created attachment 271129 [details] [diff] [review]
make Fault more informative, #ifdef DEBUG_CC

This helps debugging.

On Jesse's testcase, it tells me:

Fault in cycle collector: zero refcount
  while operating on pointer 0x1837ac0 nsXULPrototypeNode
  which has internal references from:
    0x16d8bf0 nsXULPrototypeNode
Attachment #271129 - Flags: review?(graydon)
We have an nsXULPrototypeNode for a window element with 2 children.  The first is an nsXULPrototypeNode for a script element.  The second is a garbage pointer.  We get this fault after traversing the garbage pointer (and finding that the memory location happens to have a 0 for the reference count).
Which probably happens because we've called ReleaseSubtree on the prototype tree.

Updated

10 years ago
Attachment #271129 - Flags: review?(graydon) → review+
Created attachment 271132 [details] [diff] [review]
patch 

This fixes the bug, except my "ReleaseSubtree not called" assertion keeps firing...
Assignee: nobody → dbaron
Status: NEW → ASSIGNED
Created attachment 271134 [details] [diff] [review]
patch

Er, oops.
Attachment #271132 - Attachment is obsolete: true
Attachment #271134 - Flags: superreview?(jonas)
Attachment #271134 - Flags: review?(jonas)
Attachment #271134 - Flags: superreview?(jonas)
Attachment #271134 - Flags: superreview+
Attachment #271134 - Flags: review?(jonas)
Attachment #271134 - Flags: review+
Duplicate of this bug: 384844
Both patches checked in to trunk.
Status: ASSIGNED → RESOLVED
Last Resolved: 10 years ago
Resolution: --- → FIXED
Flags: in-testsuite?
(Reporter)

Comment 11

10 years ago
Crashtest checked in.
Flags: in-testsuite? → in-testsuite+

Updated

9 years ago
Component: XP Toolkit/Widgets: XUL → XUL
QA Contact: xptoolkit.xul → xptoolkit.widgets
You need to log in before you can comment on or make changes to this bug.