386947 - "ASSERTION: Fault in cycle collector: zero refcount" and/or crash related to cycle collector with -moz-binding

Status: RESOLVED FIXED

(Core :: XUL, defect)

Description

[Jesse Ruderman]

Reloading this testcase about 20 times triggers:

###!!! ASSERTION: Fault in cycle collector: zero refcount (ptr: 3bfa0a40)
: 'Not Reached', file /Users/jruderman/trunk/mozilla/xpcom/base/nsCycleCollector.cpp, line 920

or

###!!! ASSERTION: nsCycleCollectionParticipant shouldn't change!: 'result->mParticipant == aParticipant', file /Users/jruderman/trunk/mozilla/xpcom/base/nsCycleCollector.cpp, line 1107

Sometimes the first assertion is repeated and/or accompanied by

###!!! ASSERTION: JS object but unknown to the JS GC?: 'refcount > 0', file /Users/jruderman/trunk/mozilla/js/src/xpconnect/src/nsXPConnect.cpp, line 672

The testcase can also cause crashes, e.g. during shutdown, but not reliably.

Tested with Mac trunk debug.

Comment 1

[Jesse Ruderman]

Attachment: testcase (can crash Firefox)

Comment 2

[Jesse Ruderman]

Attachment: testcase (can crash Firefox)

Changed to reference url('#t') instead of url('t') so it doesn't try to load an extra URL from Bugzilla each time.

Comment 3

[Brendan Eich [:brendan]]

This is a 1.9 blocker, and it's great to have a small testcase. The bug needs an assignee. Any takers from the cc: list?

/be

Comment 4

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: make Fault more informative, #ifdef DEBUG_CC

This helps debugging.

On Jesse's testcase, it tells me:

Fault in cycle collector: zero refcount
  while operating on pointer 0x1837ac0 nsXULPrototypeNode
  which has internal references from:
    0x16d8bf0 nsXULPrototypeNode

Comment 5

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

We have an nsXULPrototypeNode for a window element with 2 children.  The first is an nsXULPrototypeNode for a script element.  The second is a garbage pointer.  We get this fault after traversing the garbage pointer (and finding that the memory location happens to have a 0 for the reference count).

Comment 6

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Which probably happens because we've called ReleaseSubtree on the prototype tree.

Comment 7

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: patch

This fixes the bug, except my "ReleaseSubtree not called" assertion keeps firing...

Comment 8

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: patch

Er, oops.

Comment 10

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Both patches checked in to trunk.

Comment 11

[Jesse Ruderman]

Crashtest checked in.