562060 - Assertion failures and abort() [@ld-2.5.so + 0x7f2] during Linux mochitest-other, apparently caused by OOM

Status: RESOLVED INVALID

(Core :: General, defect)

Description

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

First assertion fail I see is

###!!! ASSERTION: Oops!  You're asking for a weak reference to an object that doesn't support that.: 'factoryPtr', file nsWeakReference.cpp, line 109

which is a failed NULL check.  The second is

###!!! ASSERTION: Uh, IsInModalState() called w/o a reachable top window?: 'Error', file /builds/slave/mozilla-central-linux-debug/build/dom/base/nsGlobalWindow.cpp, line 5960

which is also a failed NULL check.  They might be related in that the failed attempt to get a weak reference on an object that doesn't support it, or they might be related in that an attempt was made to get a weak reference on a NULL object.  I tend to the latter, because of the abort() that takes down firefox-bin

Crash reason:  SIGABRT
Crash address: 0x183e

Thread 0 (crashed)
 0  ld-2.5.so + 0x7f2
    eip = 0x00a6f7f2   esp = 0xbfca1034   ebp = 0xbfca1048   ebx = 0x0c74bb88
    esi = 0x000007b9   edi = 0x00bc9ff4   eax = 0xfffffffc   ecx = 0x00000009
    edx = 0x000007b9   efl = 0x00200246
    Found by: given as instruction pointer in context
 1  libglib-2.0.so.0.1200.3 + 0x2e282
    eip = 0x0049c283   esp = 0xbfca1050   ebp = 0xbfca10a8
    Found by: previous frame's frame pointer
 2  libglib-2.0.so.0.1200.3 + 0x2e7b4
    eip = 0x0049c7b5   esp = 0xbfca10b0   ebp = 0xbfca10c8
    Found by: previous frame's frame pointer
 3  libxul.so!nsAppShell::ProcessNextNativeEvent [nsAppShell.cpp:c685e50cf4b6 : 144 + 0x12]
    eip = 0x0200bd1d   esp = 0xbfca10d0   ebp = 0xbfca10e8
    Found by: previous frame's frame pointer
 4  libxul.so!nsBaseAppShell::DoProcessNextNativeEvent [nsBaseAppShell.cpp:c685e50cf4b6 : 155 + 0x18]
    eip = 0x0203220d   esp = 0xbfca10f0   ebp = 0xbfca1108   ebx = 0x02a4f890
    Found by: call frame info

The glib2 frames are

1 g_main_context_iterate
  /usr/src/debug/glib-2.12.3/glib/gmain.c:2649
2 IA__g_main_context_pending
  /usr/src/debug/glib-2.12.3/glib/gmain.c:2704

and if I got the right package, frame 1 is

      context->cached_poll_array = g_new (GPollFD, context->n_poll_records);

g_new() is an abort-on-failure allocator, so OOM could explain the abort().

There's really nothing we can do about this if the OOM hypothesis is correct, but I'll leave the bug open for tracking these failures if they re-occur.

Comment 1

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

Forgot this

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1272378689.1272381263.25921.gz
Linux mozilla-central debug test mochitest-other on 2010/04/27 07:31:29  
s: moz2-linux-slave11

And I double-checked and apparently got the wrong symbols, judging by this frame

 3  libxul.so!nsAppShell::ProcessNextNativeEvent [nsAppShell.cpp:c685e50cf4b6 :

Instead, SIGABRT was delivered here

 1 g_main_context_poll
   /usr/src/debug/glib-2.12.3/glib/gmain.c:2979
   g_main_context_iterate
   /usr/src/debug/glib-2.12.3/glib/gmain.c:2672

 2 IA__g_main_context_iteration
   /usr/src/debug/glib-2.12.3/glib/gmain.c:2736

Frame 1 is |if ((*poll_func) (fds, n_fds, timeout) < 0 && errno != EINTR)|, which means this bug is invalid.  The bug instead appears to be a hang at

TEST-INFO | checking window state
TEST-INFO | (browser-test.js) | Waiting for window activation...

although the assertions are worrying ...