392144 - "ASSERTION: JS object but unknown to the JS GC" and "ASSERTION: Fault in cycle collector: script pointer traversal failed"

Status: RESOLVED DUPLICATE of bug 386912

(Core :: XPConnect, defect)

Description

[Jesse Ruderman]

Attachment: stack traces and context

During EM restart, I got these three assertions.  I wasn't able to reproduce, but  I happened to be testing the patch for bug 336517, so I got stack traces :)

2 * ###!!! ASSERTION: JS object but unknown to the JS GC?: 'mObjRefcounts->Get(p) > 0', file /Users/jruderman/trunk/mozilla/js/src/xpconnect/src/nsXPConnect.cpp, line 611

(since dbaron asked: both on the same line, in nsXPConnect::ToParticipant)

###!!! ASSERTION: Fault in cycle collector: script pointer traversal failed (ptr: 2260820)
: 'Not Reached', file /Users/jruderman/trunk/mozilla/xpcom/base/nsCycleCollector.cpp, line 939

Comment 1

[Brendan Eich [:brendan]]

Jesse, what's your jsgc.c:2037 look like?

/be

Comment 2

[Igor Bukanov]

This lines from jsgc.c that present in the stack are:

http://lxr.mozilla.org/seamonkey/source/js/src/jsgc.c#2037

and

http://lxr.mozilla.org/seamonkey/source/js/src/jsgc.c#1724

Comment 3

[Jesse Ruderman]

My jsgc.c isn't modified.  Line 2037 is:

JS_CALL_OBJECT_TRACER(trc, acx->globalObject, "global object");

Comment 4

[Bob Clary [:bc:]]

I don't know if this will be useful to anyone, but during a scan of msn on CentOS4 where I was bookmarking every page visited, I saw the following contiguous assertions. They are not reproducible by simply loading the page where they occurred.

###!!! ASSERTION: JS object but unknown to the JS GC?: 'mObjRefcounts->Get(p) > 0', file mozilla/js/src/xpconnect/src/nsXPConnect.cpp, line 611
###!!! ASSERTION: JS object but unknown to the JS GC?: 'mObjRefcounts->Get(p) > 0', file mozilla/js/src/xpconnect/src/nsXPConnect.cpp, line 611
###!!! ASSERTION: JS object but unknown to the JS GC?: 'refcount > 0', file mozilla/js/src/xpconnect/src/nsXPConnect.cpp, line 717
###!!! ASSERTION: Fault in cycle collector: zero refcount (ptr: a5eb0c0)
: 'Not Reached', file mozilla/xpcom/base/nsCycleCollector.cpp, line 954
###!!! ASSERTION: JS object but unknown to the JS GC?: 'refcount > 0', file mozilla/js/src/xpconnect/src/nsXPConnect.cpp, line 717
###!!! ASSERTION: Fault in cycle collector: zero refcount (ptr: 9ce7c80)
: 'Not Reached', file mozilla/xpcom/base/nsCycleCollector.cpp, line 954
###!!! ASSERTION: JS object but unknown to the JS GC?: 'mObjRefcounts->Get(p) > 0', file mozilla/js/src/xpconnect/src/nsXPConnect.cpp, line 611
###!!! ASSERTION: JS object but unknown to the JS GC?: 'mObjRefcounts->Get(p) > 0', file mozilla/js/src/xpconnect/src/nsXPConnect.cpp, line 611
###!!! ASSERTION: JS object but unknown to the JS GC?: 'mObjRefcounts->Get(p) > 0', file mozilla/js/src/xpconnect/src/nsXPConnect.cpp, line 611
###!!! ASSERTION: JS object but unknown to the JS GC?: 'refcount > 0', file mozilla/js/src/xpconnect/src/nsXPConnect.cpp, line 717
###!!! ASSERTION: Fault in cycle collector: zero refcount (ptr: a5ead00)
: 'Not Reached', file mozilla/xpcom/base/nsCycleCollector.cpp, line 954
###!!! ASSERTION: JS object but unknown to the JS GC?: 'refcount > 0', file mozilla/js/src/xpconnect/src/nsXPConnect.cpp, line 717
###!!! ASSERTION: Fault in cycle collector: zero refcount (ptr: a5eb480)
: 'Not Reached', file mozilla/xpcom/base/nsCycleCollector.cpp, line 954
###!!! ASSERTION: JS object but unknown to the JS GC?: 'mObjRefcounts->Get(p) > 0', file mozilla/js/src/xpconnect/src/nsXPConnect.cpp, line 611
###!!! ASSERTION: JS object but unknown to the JS GC?: 'refcount > 0', file mozilla/js/src/xpconnect/src/nsXPConnect.cpp, line 717
###!!! ASSERTION: Fault in cycle collector: zero refcount (ptr: a5eb4a0)
: 'Not Reached', file mozilla/xpcom/base/nsCycleCollector.cpp, line 954

Comment 5

[Jesse Ruderman]

I think you need stack traces for those to be useful.  Want to turn on XPCOM_DEBUG_BREAK=stack and try again?  (Depending on your OS, you may need to run mozilla/tools/rb/fix-*-stack.pl once you get a rough stack trace from Firefox.)

Comment 6

[Bob Clary [:bc:]]

Attachment: gzipped stack traces from scan of yahoo china while bookmarking each page

These all occurred while loading the referenced page but are not reproducible simply by loading that page by itself.

Comment 7

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Peter, could you have a look at this. Would be great to know what's going on at least to see if this might possibly not be a blocker. Though it does look very bad indeed.

Might this even be fixed by your patch to do tracing differently?

Comment 8

[Mike Schroepfer]

Do we care about this for b1?

Comment 9

[Peter Van der Beken [:peterv]]

This should be fixed by the patch for bug 401687 and looks like a dupe of bug
386912.