Closed Bug 624540 Opened 14 years ago Closed 14 years ago

Assertion failure: compartment mismatch in cycle collector during xpcom-shutdown

Categories

(Core :: XPConnect, defect)

Product:
Core
Component:
XPConnect
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED
Tracking Flags:
Tracking Status
blocking2.0 --- final+

People

(Reporter: pcwalton, Assigned: mrbkap)

Details

(Keywords: crash)

Attachments

(1 file)

Propbable fix
905 bytes, patch
gal
: review+
Details | Diff | Splinter Review 
I got this when on http://githubissues.heroku.com/, with the Web Console open, when quitting during a lot of network activity.

Process:         firefox-bin [91750]
Path:            /Users/pwalton/Source/moz/mozilla-central/objdir-ff-debug/dist/MinefieldDebug.app/Contents/MacOS/firefox-bin
Identifier:      org.mozilla.minefielddebug
Version:         4.0b9pre (4.0b9pre)
Code Type:       X86-64 (Native)
Parent Process:  bash [184]

Date/Time:       2011-01-10 14:47:10.668 -0800
OS Version:      Mac OS X 10.6.6 (10J567)
Report Version:  6

Interval Since Last Report:          89651 sec
Crashes Since Last Report:           14
Per-App Interval Since Last Report:  165 sec
Per-App Crashes Since Last Report:   1
Anonymous UUID:                      9E720373-F0F0-40C8-91E2-6A72468F6FD2

Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000000
Crashed Thread:  0  Dispatch queue: com.apple.main-thread

Thread 0 Crashed:  Dispatch queue: com.apple.main-thread
0   XUL                           	0x0000000101a6f5f8 JS_Assert + 80
1   XUL                           	0x0000000101a0bded js::CompartmentChecker::fail(JSCompartment*, JSCompartment*) + 65
2   XUL                           	0x0000000101a573e5 js::CompartmentChecker::check(JSCompartment*) + 101
3   XUL                           	0x0000000101a57414 js::CompartmentChecker::check(JSObject*) + 44
4   XUL                           	0x00000001018f55bb void js::assertSameCompartment<JSObject*>(JSContext*, JSObject*) + 61
5   XUL                           	0x00000001018da104 JS_GetReservedSlot + 163
6   XUL                           	0x0000000101bae20f js::ctypes::CType::Trace(JSTracer*, JSObject*) + 49
7   XUL                           	0x00000001019bed01 js_TraceObject(JSTracer*, JSObject*) + 313
8   XUL                           	0x0000000101962835 js::gc::MarkChildren(JSTracer*, JSObject*) + 273
9   XUL                           	0x0000000101963e9c JS_TraceChildren + 58
10  XUL                           	0x0000000100eeebf4 nsXPConnect::Traverse(void*, nsCycleCollectionTraversalCallback&) + 1570 (nsXPConnect.cpp:776)
11  XUL                           	0x00000001016fad81 GCGraphBuilder::Traverse(PtrInfo*) + 97 (nsCycleCollector.cpp:1525)
12  XUL                           	0x00000001016fae1c nsCycleCollector::MarkRoots(GCGraphBuilder&) + 82 (nsCycleCollector.cpp:1764)
13  XUL                           	0x00000001016fb01e nsCycleCollector::BeginCollection(int, nsICycleCollectorListener*) + 494 (nsCycleCollector.cpp:2655)
14  XUL                           	0x00000001016fb25a nsCycleCollector::Collect(unsigned int, nsICycleCollectorListener*) + 138 (nsCycleCollector.cpp:2541)
15  XUL                           	0x00000001016fb397 nsCycleCollector::Shutdown() + 31 (nsCycleCollector.cpp:2803)
16  XUL                           	0x00000001016fb45a nsCycleCollector_shutdown() + 179 (nsCycleCollector.cpp:3503)
17  XUL                           	0x00000001016724a8 mozilla::ShutdownXPCOM(nsIServiceManager*) + 967 (nsXPComInit.cpp:696)
18  XUL                           	0x0000000101672861 NS_ShutdownXPCOM_P + 21 (nsXPComInit.cpp:595)
19  XUL                           	0x000000010002e1b5 ScopedXPCOMStartup::~ScopedXPCOMStartup() + 189 (nsAppRunner.cpp:1118)
20  XUL                           	0x0000000100037043 XRE_main + 13817 (nsAppRunner.cpp:3725)
21  org.mozilla.minefielddebug    	0x000000010000127f main + 755 (nsBrowserApp.cpp:158)
22  org.mozilla.minefielddebug    	0x0000000100000e40 start + 52
Just hit this during normal browsing. I just went to http://githubissues.heroku.com/#280north/cappuccino with the Web Console open.

Process:         firefox-bin [91836]
Path:            /Users/pwalton/Source/moz/mozilla-central/objdir-ff-debug/dist/MinefieldDebug.app/Contents/MacOS/firefox-bin
Identifier:      org.mozilla.minefielddebug
Version:         4.0b9pre (4.0b9pre)
Code Type:       X86-64 (Native)
Parent Process:  bash [184]

Date/Time:       2011-01-10 14:54:11.020 -0800
OS Version:      Mac OS X 10.6.6 (10J567)
Report Version:  6

Interval Since Last Report:          90057 sec
Crashes Since Last Report:           15
Per-App Interval Since Last Report:  385 sec
Per-App Crashes Since Last Report:   2
Anonymous UUID:                      9E720373-F0F0-40C8-91E2-6A72468F6FD2

Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000000
Crashed Thread:  3

Thread 0:  Dispatch queue: com.apple.main-thread
0   libSystem.B.dylib             	0x00007fff86d2ffca __semwait_signal + 10
1   libSystem.B.dylib             	0x00007fff86d33de1 _pthread_cond_wait + 1286
2   libnspr4.dylib                	0x00000001055810f0 PR_WaitCondVar + 317 (ptsynch.c:417)
3   XUL                           	0x000000010166b21e mozilla::CondVar::Wait(unsigned int) + 126 (BlockingResourceBase.cpp:373)
4   XUL                           	0x00000001016fe0a9 nsCycleCollectorRunner::Collect(nsICycleCollectorListener*) + 375 (nsCycleCollector.cpp:3362)
5   XUL                           	0x00000001016fb33b nsCycleCollector_collect(nsICycleCollectorListener*) + 89 (nsCycleCollector.cpp:3473)
6   XUL                           	0x000000010098df84 nsJSContext::CC(nsICycleCollectorListener*) + 104 (nsJSEnvironment.cpp:3632)
7   XUL                           	0x000000010098dff1 nsJSContext::IntervalCC() + 55 (nsJSEnvironment.cpp:3736)
8   XUL                           	0x000000010098e12f nsJSContext::MaybeCC(int) + 297 (nsJSEnvironment.cpp:3704)
9   XUL                           	0x000000010098e172 nsJSContext::CCIfUserInactive() + 24 (nsJSEnvironment.cpp:3714)
10  XUL                           	0x000000010098e362 GCTimerFired(nsITimer*, void*) + 101 (nsJSEnvironment.cpp:3750)
11  XUL                           	0x00000001016eaf4f nsTimerImpl::Fire() + 1299 (nsTimerImpl.cpp:426)
12  XUL                           	0x00000001016eb1c2 nsTimerEvent::Run() + 188 (nsTimerImpl.cpp:519)
13  XUL                           	0x00000001016e3706 nsThread::ProcessNextEvent(int, int*) + 906 (nsThread.cpp:633)
14  XUL                           	0x00000001016697fa NS_ProcessNextEvent_P(nsIThread*, int) + 118 (nsThreadUtils.cpp:250)
15  XUL                           	0x00000001016e48a5 nsThread::Shutdown() + 521 (nsThread.cpp:491)
16  XUL                           	0x000000010170183d NS_InvokeByIndex_P + 576 (xptcinvoke_x86_64_unix.cpp:208)
17  XUL                           	0x00000001016ef924 nsProxyObjectCallInfo::Run() + 116 (nsProxyEvent.cpp:181)
18  XUL                           	0x00000001016e3706 nsThread::ProcessNextEvent(int, int*) + 906 (nsThread.cpp:633)
19  XUL                           	0x0000000101669915 NS_ProcessPendingEvents_P(nsIThread*, unsigned int) + 135 (nsThreadUtils.cpp:200)
20  XUL                           	0x00000001013f1dc8 nsBaseAppShell::NativeEventCallback() + 184 (nsBaseAppShell.cpp:133)
21  XUL                           	0x00000001013a72c8 nsAppShell::ProcessGeckoEvents(void*) + 336 (nsAppShell.mm:400)
22  com.apple.CoreFoundation      	0x00007fff836d0401 __CFRunLoopDoSources0 + 1361
23  com.apple.CoreFoundation      	0x00007fff836ce5f9 __CFRunLoopRun + 873
24  com.apple.CoreFoundation      	0x00007fff836cddbf CFRunLoopRunSpecific + 575
25  com.apple.HIToolbox           	0x00007fff8029593a RunCurrentEventLoopInMode + 333
26  com.apple.HIToolbox           	0x00007fff8029573f ReceiveNextEventCommon + 310
27  com.apple.HIToolbox           	0x00007fff802955f8 BlockUntilNextEventMatchingListInMode + 59
28  com.apple.AppKit              	0x00007fff84549e64 _DPSNextEvent + 718
29  com.apple.AppKit              	0x00007fff845497a9 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 155
30  com.apple.AppKit              	0x00007fff8450f48b -[NSApplication run] + 395
31  XUL                           	0x00000001013a6be4 nsAppShell::Run() + 122 (nsAppShell.mm:746)
32  XUL                           	0x0000000101100332 nsAppStartup::Run() + 140 (nsAppStartup.cpp:191)
33  XUL                           	0x0000000100036e60 XRE_main + 13334 (nsAppRunner.cpp:3695)
34  org.mozilla.minefielddebug    	0x000000010000127f main + 755 (nsBrowserApp.cpp:158)
35  org.mozilla.minefielddebug    	0x0000000100000e40 start + 52
Shutdown crash, so not super critical.
Not just shutdown. It always causes Firefox to crash with the Console open on the specific page linked to in comment #1.
blocking2.0: --- → ?
Keywords: crash
Need an owner and triage.

/be
I triaged. This is a shutdown issue, so not high priority.
Assignee: general → nobody
Component: JavaScript Engine → XPConnect
OS: Mac OS X → All
QA Contact: general → xpconnect
Hardware: x86 → All
blocking2.0: ? → ---
status2.0: --- → wanted
Patrick is saying its not just shutdown.
blocking2.0: --- → final+
status2.0: wanted → ---
This requires the console to be open to crash.
Attached patch Propbable fix — — Splinter Review 
I've had this patch lying around since before I went to New York, but kept forgetting to file the bug.
Attachment #502669 - Flags: review?(gal)
Attachment #502669 - Flags: review?(gal) → review+
http://hg.mozilla.org/mozilla-central/rev/397fbc5af0fb
Assignee: nobody → mrbkap
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: