Crash in GetFinalizableArenaTraceKind. ainfo->list fail

RESOLVED WONTFIX

Status

()

--
critical
RESOLVED WONTFIX
8 years ago
4 years ago

People

(Reporter: dougt, Unassigned)

Tracking

({crash})

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

8 years ago
#0  0x00007f8f0cc1f35d in nanosleep () at ../sysdeps/unix/syscall-template.S:82
#1  0x00007f8f0cc1f1d0 in __sleep (seconds=<value optimized out>) at ../sysdeps/unix/sysv/linux/sleep.c:138
#2  0x00007f8f0f3a2dcb in ah_crap_handler (signum=11) at /builds/e10s/electrolysis/toolkit/xre/nsSigHandlers.cpp:132
#3  0x00007f8f0f3a5b1d in nsProfileLock::FatalSignalHandler (signo=11, info=0x7fff0c641ff0, context=0x7fff0c641ec0) at nsProfileLock.cpp:221
#4  <signal handler called>
#5  0x00007f8f0c44a2ef in GetFinalizableArenaTraceKind (ainfo=0x2ffe4f0) at /builds/e10s/electrolysis/js/src/jsgc.cpp:809
#6  0x00007f8f0c44a326 in GetFinalizableThingTraceKind (thing=0x2ff2ac0) at /builds/e10s/electrolysis/js/src/jsgc.cpp:816
#7  0x00007f8f0c44d7fa in js_CallGCMarker (trc=0x7fff0c6425e0, thing=0x2ff2ac0, kind=0) at /builds/e10s/electrolysis/js/src/jsgc.cpp:1974
#8  0x00007f8f0c3fa181 in array_trace (trc=0x7fff0c6425e0, obj=0x7f8ef022c140) at /builds/e10s/electrolysis/js/src/jsarray.cpp:1076
#9  0x00007f8f0c44cf6d in JS_TraceChildren (trc=0x7fff0c6425e0, thing=0x7f8ef022c140, kind=0) at /builds/e10s/electrolysis/js/src/jsgc.cpp:1723
#10 0x00007f8f0c44d87c in js_CallGCMarker (trc=0x7fff0c6425e0, thing=0x7f8ef022c140, kind=0) at /builds/e10s/electrolysis/js/src/jsgc.cpp:1993
#11 0x00007f8f0c44d9c4 in js_CallValueTracerIfGCThing (trc=0x7fff0c6425e0, v=140251890893120) at /builds/e10s/electrolysis/js/src/jsgc.cpp:2041
#12 0x00007f8f0c44dc35 in gc_root_traversal (entry=..., trc=0x7fff0c6425e0) at /builds/e10s/electrolysis/js/src/jsgc.cpp:2092
#13 0x00007f8f0c44e645 in js_TraceRuntime (trc=0x7fff0c6425e0) at /builds/e10s/electrolysis/js/src/jsgc.cpp:2218
#14 0x00007f8f0c44f0e8 in GC (cx=0x20e3ad0) at /builds/e10s/electrolysis/js/src/jsgc.cpp:2785
#15 0x00007f8f0c44f9b5 in GCUntilDone (cx=0x20e3ad0, gckind=GC_LOCK_HELD) at /builds/e10s/electrolysis/js/src/jsgc.cpp:3156
#16 0x00007f8f0c44fb09 in js_GC (cx=0x20e3ad0, gckind=GC_LOCK_HELD) at /builds/e10s/electrolysis/js/src/jsgc.cpp:3207
#17 0x00007f8f0c44bd39 in LastDitchGC (cx=0x20e3ad0) at /builds/e10s/electrolysis/js/src/jsgc.cpp:1322
#18 0x00007f8f0c44beb4 in RefillFinalizableFreeList (cx=0x20e3ad0, thingKind=0) at /builds/e10s/electrolysis/js/src/jsgc.cpp:1346
#19 0x00007f8f0c44c3c4 in js_NewFinalizableGCThing (cx=0x20e3ad0, thingKind=0) at /builds/e10s/electrolysis/js/src/jsgc.cpp:1453
#20 0x00007f8f0c4acb09 in js_NewGCObject (cx=0x20e3ad0) at /builds/e10s/electrolysis/js/src/jsgc.h:291
#21 0x00007f8f0c4acff1 in NewObjectWithGivenProto (cx=0x20e3ad0, clasp=0x7f8f0c881ac0, proto=0x7f8ef9033b00, parent=0x0, objectSize=0)
    at /builds/e10s/electrolysis/js/src/jsobjinlines.h:640
#22 0x00007f8f0c4ad32d in NewObject (cx=0x20e3ad0, clasp=0x7f8f0c881ac0, proto=0x7f8ef9033b00, parent=0x0, objectSize=0)
    at /builds/e10s/electrolysis/js/src/jsobjinlines.h:707
#23 0x00007f8f0c4afeb1 in OpenObject (cx=0x20e3ad0, jp=0x2571590) at /builds/e10s/electrolysis/js/src/json.cpp:805
#24 0x00007f8f0c4b076d in js_ConsumeJSONText (cx=0x20e3ad0, jp=0x2571590, data=0x2ef5d48, len=2) at /builds/e10s/electrolysis/js/src/json.cpp:1006
#25 0x00007f8f0c3f15aa in JS_ConsumeJSONText (cx=0x20e3ad0, jp=0x2571590, data=0x2ef5d48, len=2) at /builds/e10s/electrolysis/js/src/jsapi.cpp:5033
#26 0x00007f8f0fa44db5 in nsFrameMessageManager::SendSyncMessage (this=0x20ccbc0) at /builds/e10s/electrolysis/content/base/src/nsFrameMessageManager.cpp:221
#27 0x00007f8f0fa49246 in nsInProcessTabChildGlobal::SendSyncMessage (this=0x20b9f80)
    at /builds/e10s/electrolysis/content/base/src/nsInProcessTabChildGlobal.h:73
#28 0x00007f8f108b85cb in NS_InvokeByIndex_P (that=0x20b9fc8, methodIndex=6, paramCount=0, params=0x7fff0c642e70)
    at /builds/e10s/electrolysis/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_x86_64_unix.cpp:208
#29 0x00007f8f1016a7d2 in CallMethodHelper::Invoke (this=0x7fff0c642e30) at /builds/e10s/electrolysis/js/src/xpconnect/src/xpcwrappednative.cpp:2983
#30 0x00007f8f1016886a in CallMethodHelper::Call (this=0x7fff0c642e30) at /builds/e10s/electrolysis/js/src/xpconnect/src/xpcwrappednative.cpp:2308
#31 0x00007f8f101642e8 in XPCWrappedNative::CallMethod (ccx=..., mode=XPCWrappedNative::CALL_METHOD)
    at /builds/e10s/electrolysis/js/src/xpconnect/src/xpcwrappednative.cpp:2272
#32 0x00007f8f101753af in XPC_WN_CallMethod (cx=0x20e3ad0, obj=0x7f8ef9033ac0, argc=2, argv=0x7f8efab32130, vp=0x7f8efab321c8)
    at /builds/e10s/electrolysis/js/src/xpconnect/src/xpcwrappednativejsops.cpp:1789
#33 0x00007f8f0c4854fd in js_Invoke (cx=0x20e3ad0, args=..., flags=2) at /builds/e10s/electrolysis/js/src/jsinterp.cpp:654
#34 0x00007f8f0c471f05 in js_Interpret (cx=0x20e3ad0) at /builds/e10s/electrolysis/js/src/jsops.cpp:2156
#35 0x00007f8f0c485591 in js_Invoke (cx=0x20e3ad0, args=..., flags=0) at /builds/e10s/electrolysis/js/src/jsinterp.cpp:664
#36 0x00007f8f1015b85f in nsXPCWrappedJSClass::CallMethod (this=0x20a6720, wrapper=0x20cf6f0, methodIndex=3, info=0x1756db0, nativeParams=0x7fff0c644120)
    at /builds/e10s/electrolysis/js/src/xpconnect/src/xpcwrappedjsclass.cpp:1689
#37 0x00007f8f10151fd5 in nsXPCWrappedJS::CallMethod (this=0x20cf6f0, methodIndex=3, info=0x1756db0, params=0x7fff0c644120)
    at /builds/e10s/electrolysis/js/src/xpconnect/src/xpcwrappedjs.cpp:570
#38 0x00007f8f108b8aab in PrepareAndDispatch (self=0x20cf680, methodIndex=3, args=0x7fff0c6442b0, gpregs=0x7fff0c644230, fpregs=0x7fff0c644260)
    at /builds/e10s/electrolysis/xpcom/reflect/xptcall/src/md/unix/xptcstubs_x86_64_linux.cpp:153
#39 0x00007f8f108b8b3f in SharedStub () at /builds/e10s/electrolysis/xpcom/reflect/xptcall/src/md/unix/xptcstubs_x86_64_linux.cpp:159
#40 0x00007f8f1026263d in nsDocLoader::FireOnStateChange (this=0x20b9210, aProgress=0x20b9238, aRequest=0x2f97620, aStateFlags=65540, aStatus=0)
    at /builds/e10s/electrolysis/uriloader/base/nsDocLoader.cpp:1321
#41 0x00007f8f102619d8 in nsDocLoader::OnProgress (this=0x20b9210, aRequest=0x2f97620, ctxt=0x0, aProgress=7853, aProgressMax=7853)
    at /builds/e10s/electrolysis/uriloader/base/nsDocLoader.cpp:1097
#42 0x00007f8f0f5d3fe2 in nsProgressNotificationProxy::OnProgress (this=0x2f97fd0, request=0x2f96900, ctxt=0x0, progress=7853, progressMax=7853)
    at /builds/e10s/electrolysis/modules/libpr0n/src/imgLoader.cpp:304
#43 0x00007f8f0f4cea7e in nsHttpChannel::OnTransportStatus (this=0x2f968b0, trans=0x0, status=2152398854, progress=7853, progressMax=7853)
    at /builds/e10s/electrolysis/netwerk/protocol/http/nsHttpChannel.cpp:4555
#44 0x00007f8f0f4ce772 in nsHttpChannel::OnDataAvailable (this=0x2f968b0, request=0x2f96700, ctxt=0x0, input=0x2f97d68, offset=0, count=7853)
    at /builds/e10s/electrolysis/netwerk/protocol/http/nsHttpChannel.cpp:4510
#45 0x00007f8f0f3cd5cf in nsInputStreamPump::OnStateTransfer (this=0x2f96700) at /builds/e10s/electrolysis/netwerk/base/src/nsInputStreamPump.cpp:510
#46 0x00007f8f0f3cd123 in nsInputStreamPump::OnInputStreamReady (this=0x2f96700, stream=0x2f97d68)
    at /builds/e10s/electrolysis/netwerk/base/src/nsInputStreamPump.cpp:400
#47 0x00007f8f1086c831 in nsInputStreamReadyEvent::Run (this=0x2f97680) at /builds/e10s/electrolysis/xpcom/io/nsStreamUtils.cpp:112
#48 0x00007f8f1089a60d in nsThread::ProcessNextEvent (this=0x133a490, mayWait=0, result=0x7fff0c6448fc)
    at /builds/e10s/electrolysis/xpcom/threads/nsThread.cpp:547
#49 0x00007f8f10828554 in NS_ProcessNextEvent_P (thread=0x133a490, mayWait=0) at nsThreadUtils.cpp:250
#50 0x00007f8f106ed1a8 in mozilla::ipc::MessagePump::Run (this=0x13390e0, aDelegate=0x13434a0) at /builds/e10s/electrolysis/ipc/glue/MessagePump.cpp:118
#51 0x00007f8f1091752d in MessageLoop::RunInternal (this=0x13434a0) at /builds/e10s/electrolysis/ipc/chromium/src/base/message_loop.cc:216
#52 0x00007f8f109174b2 in MessageLoop::RunHandler (this=0x13434a0) at /builds/e10s/electrolysis/ipc/chromium/


(gdb) frame 5


(gdb) p ainfo
$4 = (JSGCArenaInfo *) 0x2ffe4f0
(gdb) p *ainfo
$5 = {list = 0x7f8f00000001, prev = 0x1, freeList = 0x0}


This is in a fennec build using the e10s branch pull today:

dougt@dougt:/builds/e10s/electrolysis/obj-mobilebase-qt/dist/bin$ hg summary
parent: 43736:0d4877cd0a1b tip qtip bug_568925_remote_setTitle
 imported patch bug_568925_remote_setTitle
branch: default
commit: 25 unknown (clean)
update: 27 new changesets, 3 branch heads (merge)

dougt@dougt:/builds/e10s/electrolysis/mobile$ hg summary
parent: 1642:a4a753b705f1 tip
 Bug 572214 - [e10s] Add support for remote and local rendering [r=vingtetun]
branch: default
commit: 9 unknown (clean)
update: (current)


I saw this while trying to load http://cnn.com. Not sure how hard it is to reproduce.
(Assignee)

Updated

4 years ago
Assignee: general → nobody
(Reporter)

Comment 2

4 years ago
This bugs is ancient.
Status: NEW → RESOLVED
Last Resolved: 4 years ago
Flags: needinfo?(dougt)
Resolution: --- → WONTFIX
You need to log in before you can comment on or make changes to this bug.