Closed Bug 600622 Opened 14 years ago Closed 14 years ago

Intermittent assertion failure "addr % sizeof(FreeCell) == 0" in test_jQuery.html or test_findbar.xul or test_badManifestMagic.html or test_bug396367-2.html or test_hiddenpaging.xul or test_menulist_keynav.xul or test_bug488426.html

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
Windows Server 2003
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED WORKSFORME
Tracking Flags:
Tracking Status
blocking2.0 --- betaN+

People

(Reporter: orangereporter, Unassigned)

References

Details

(Keywords: assertion, intermittent-failure, Whiteboard: [test which aborts the suite]) 

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1285777286.1285778218.24902.gz
WINNT 5.2 mozilla-central debug test mochitests-2/5 on 2010/09/29 09:21:26
s: win32-slave22

Assertion failure: addr % sizeof(FreeCell) == 0, at e:\builds\moz2_slave\mozilla-central-win32-debug\build\js\src\jsgc.h:312
Whiteboard: [orange] → [orange][test which aborts the suite]
http://tinderbox.mozilla.org/showlog.cgi?log=TraceMonkey/1286121746.1286124860.8325.gz#err0
WINNT 5.2 tracemonkey debug test mochitest-other on 2010/10/03 09:02:26
s: win32-slave43
Summary: Intermittent assertion failure in test_jQuery.html "addr % sizeof(FreeCell) == 0" → Intermittent assertion failure in test_jQuery.html or test_findbar.xul "addr % sizeof(FreeCell) == 0"
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1286686856.1286687432.3860.gz#err1
WINNT 5.2 mozilla-central debug test mochitests-2/5 on 2010/10/09 22:00:56
s: w32-ix-slave35

Assertion failure: addr % sizeof(FreeCell) == 0, at e:\builds\moz2_slave\mozilla-central-win32-debug\build\js\src\jsgc.h:311

NEXT ERROR TEST-UNEXPECTED-FAIL | /tests/dom/tests/mochitest/ajax/offline/test_badManifestMagic.html | Exited with code -1073741819 during test run
Summary: Intermittent assertion failure in test_jQuery.html or test_findbar.xul "addr % sizeof(FreeCell) == 0" → Intermittent assertion failure in test_jQuery.html or test_findbar.xul or test_badManifestMagic.html "addr % sizeof(FreeCell) == 0"
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1286980882.1286983723.18384.gz#err0
WINNT 5.2 mozilla-central debug test mochitest-other on 2010/10/13 07:41:22
s: win32-slave40

Assertion failure: addr % sizeof(FreeCell) == 0, at e:\builds\moz2_slave\mozilla-central-win32-debug\build\js\src\jsgc.h:311
TEST-UNEXPECTED-FAIL | chrome://mochitests/content/chrome/layout/base/test/chrome/test_bug396367-2.html | Exited with code -1073741819 during test run
Summary: Intermittent assertion failure in test_jQuery.html or test_findbar.xul or test_badManifestMagic.html "addr % sizeof(FreeCell) == 0" → Intermittent assertion failure in test_jQuery.html or test_findbar.xul or test_badManifestMagic.html or test_bug396367-2.html "addr % sizeof(FreeCell) == 0"
http://tinderbox.mozilla.org/showlog.cgi?log=TraceMonkey/1287094256.1287095484.339.gz
WINNT 5.2 tracemonkey debug test mochitests-5/5 on 2010/10/14 15:10:56
s: win32-slave29

Assertion failure: addr % sizeof(FreeCell) == 0, at e:\builds\moz2_slave\tracemonkey-win32-debug\build\js\src\jsgc.h:359
TEST-UNEXPECTED-FAIL | /tests/toolkit/content/tests/widgets/test_hiddenpaging.xul | Exited with code -1073741819 during test run
Summary: Intermittent assertion failure in test_jQuery.html or test_findbar.xul or test_badManifestMagic.html or test_bug396367-2.html "addr % sizeof(FreeCell) == 0" → Intermittent assertion failure "addr % sizeof(FreeCell) == 0" in test_jQuery.html or test_findbar.xul or test_badManifestMagic.html or test_bug396367-2.html or test_hiddenpaging.xul
blocking2.0: --- → ?
This is kinda scary. Gregor would be a good candidate to look at this but I don't think he has time right now. Igor maybe?
The stack trace and the assert indicates that cx->global is not 8 byte aligned.  So it seems like a JSContext was destroyed during the finalization while been a part of the cycle graph.
Depends on: 606752
Another possibility for the crash could be a double free when the code treats as alive some non-JSContext pointer fter it was freed resulting with JSContext allocated later from that memory. The gc background free thread running at the moment of the crash gives a weight to this theory as it could double-free that pointer. But this double free should be visible via other tests so I assume it is unlikely.

So my favorite theory for the crash is a destruction of a context on a Worker thread while the cycle collector is running. With the CC decoupled from the GC this is entirely possible and should be fixed. I filed the bug 606752 for that.

But I do not know if that could be responsible to this bug.
http://tinderbox.mozilla.org/showlog.cgi?log=TraceMonkey/1287981479.1287982168.17189.gz
WINNT 5.2 tracemonkey debug test mochitests-2/5 on 2010/10/24 21:37:59
s: win32-slave38

3841 INFO TEST-PASS | /tests/dom/tests/mochitest/ajax/jquery/test_jQuery.html | event module: toggle(Function, Function, ...) - Unbinding one function from toggle unbinds them all
(ton of GC)
Assertion failure: addr % sizeof(FreeCell) == 0, at e:\builds\moz2_slave\tracemonkey-win32-debug\build\js\src\jsgc.h:359
Also in test_menulist_keynav.xul

http://tinderbox.mozilla.org/showlog.cgi?log=MozillaTry/1288198580.1288199438.29920.gz
WINNT 5.2 tryserver debug test mochitests-5/5 on 2010/10/27 09:56:20

Assertion failure: addr % sizeof(FreeCell) == 0, at e:\builds\moz2_slave\tryserver-win32-debug\build\js\src\jsgc.h:359
Exception in thread "main" Exception in thread "main" nsStringStats

TEST-UNEXPECTED-FAIL | /tests/toolkit/content/tests/widgets/test_menulist_keynav.xul | Exited with code -1073741819 during test run
Summary: Intermittent assertion failure "addr % sizeof(FreeCell) == 0" in test_jQuery.html or test_findbar.xul or test_badManifestMagic.html or test_bug396367-2.html or test_hiddenpaging.xul → Intermittent assertion failure "addr % sizeof(FreeCell) == 0" in test_jQuery.html or test_findbar.xul or test_badManifestMagic.html or test_bug396367-2.html or test_hiddenpaging.xul or test_menulist_keynav.xul
blocking2.0: ? → beta8+
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1288822789.1288826953.6667.gz
Build Log (Brief)
WINNT 5.2 mozilla-central debug test mochitest-other on 2010/11/03 15:19:49
s: win32-slave20

Assertion failure: addr % sizeof(FreeCell) == 0, at e:\builds\moz2_slave\mozilla-central-win32-debug\build\js\src\jsgc.h:359
TEST-UNEXPECTED-FAIL | chrome://mochitests/content/chrome/extensions/universalchardet/tests/test_bug488426.html | Exited with code -1073741819 during test run
Summary: Intermittent assertion failure "addr % sizeof(FreeCell) == 0" in test_jQuery.html or test_findbar.xul or test_badManifestMagic.html or test_bug396367-2.html or test_hiddenpaging.xul or test_menulist_keynav.xul → Intermittent assertion failure "addr % sizeof(FreeCell) == 0" in test_jQuery.html or test_findbar.xul or test_badManifestMagic.html or test_bug396367-2.html or test_hiddenpaging.xul or test_menulist_keynav.xul or test_bug488426.html
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1289367863.1289368515.25417.gz
WINNT 5.2 mozilla-central debug test mochitests-2/5 on 2010/11/09 21:44:23
s: win32-slave39
Assertion failure: addr % sizeof(FreeCell) == 0, at e:\builds\moz2_slave\mozilla-central-win32-debug\build\js\src\jsgc.h:359
TEST-UNEXPECTED-FAIL | /tests/dom/tests/mochitest/ajax/jquery/test_jQuery.html | Exited with code -1073741819 during test run
This needs an owner.
Over in Bug 612511, Gregor has found away to reproduce this on demand with gczeal.

The part where the stack started to look suspicious for *me* was

#3  0x0000000100171fad in js::gc::MarkObject (trc=0x7fff5fbfd530,
obj=@0xdadadadadadadada, name=0x1002dbf78 "proto") at jsgcinlines.h:233
#4  0x00000001001718c6 in js::gc::MarkChildren (trc=0x7fff5fbfd530,
obj=0x100f03948) at jsgcinlines.h:252

someone's proto done go away!
blocking2.0: beta8+ → beta9+
This hasn't happened in a couple of weeks. Does that mean it has stopped? I.e., would every failure of this kind get posted by the robot?
Not a guarantee, since it requires actually looking in the log, and at least for a test_jQuery failure there will be other things suggested, but it certainly looks good for "was fixed on TM in late October, then got merged to m-c around the 18th of November." I should really start keeping track of when TM merges to m-c, to be able to say if that's likely.
Thanks. We can close then. I'm sure someone will reopen if it turns out not to have been fixed.
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → WORKSFORME
As per today's meeting, beta 9 will be a time-based release. Marking these all betaN+. Please move it back to beta9+ if  you believe it MUST be in the next beta (ie: trunk is in an unshippable state without this)
No longer blocks: 438871
blocking2.0: beta9+ → betaN+
No longer depends on: 606752
LegNeato, do you have any plans to restore the CC lists and the blocks/depends on lists that your mass-change deleted?  It's sad to lose that information.
Depends on: 606752
Whiteboard: [orange][test which aborts the suite] → [test which aborts the suite]
You need to log in before you can comment on or make changes to this bug.