687002 - Various garbage collection crashes

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[the.other.ray.cole]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:6.0.2) Gecko/20100101 Firefox/6.0.2
Build ID: 20110905175240

Steps to reproduce:

Just general browsing of the web.  Opening multiple windows / tabs, closing them.  Eventually I would get crashes - almost always pointing into garbage collection code.


Actual results:

I had been getting numerous firefox crashes, from 4.0 through 6.0, per day.  On September 2nd alone I had 18 crashes.  Most days I had 2 or 3 crashes per day.


Expected results:

Firefox should not have crashed.  10 days ago I set javascript.options.mem.gc_per_compartment to false and I have not had a single crash since that time.  There is clearly something wrong with gc_per_compartment that causes firefox to crash quite frequently.

Comment 1

[the.other.ray.cole]

Here is a sample of some crash records.  Compartment GC was enabled during these times.

https://crash-stats.mozilla.com/report/index/bp-e0171d90-cc9c-4c73-9d94-3bc9e2110905
https://crash-stats.mozilla.com/report/index/bp-7e0d3c5f-5fd0-4aa9-b223-467842110903
https://crash-stats.mozilla.com/report/index/bp-dbd0fb2e-a434-4d61-a7b9-beda62110902

There have been no crashes since turning compartment GC off.

I wish I could give specifics on how to reproduce these crashes.  But it is so random and I've not noticed any particular pattern.  The crashes themselves tend to have different signatures, but always relate to releasing objects in some form or fashion.

Comment 2

[the.other.ray.cole]

I am going to set javascripts.options.mem.gc_per_compartment back to true with Firefox 7 and see if the crashes continue or not.  Since setting it to false in Firefox 6 I have had no crashes.

Comment 3

[Tim (fmdeveloper)]

(In reply to the.other.ray.cole from comment #2)
> I am going to set javascripts.options.mem.gc_per_compartment back to true
> with Firefox 7 and see if the crashes continue or not.  Since setting it to
> false in Firefox 6 I have had no crashes.

Any update? Did you change the value back? Any crashes/new crash IDs?

Comment 4

[the.other.ray.cole]

I have had no more crashes since going to Firefox 7.  Firefox 6 crashed often with javascript.options.mem.gc_per_compartment set to true.  Set to false it was fine.  Firefox 7 seems to be fine either way.  So I assume this can be closed.

Comment 5

[Tim (fmdeveloper)]

Thanks for the update

Comment 6

[Tobias B. Besemer [:BesTo] (QA)]

[@ mozilla::css::Declaration::~Declaration ]

Win7, FF45.0a1, 64bit

https://crash-stats.mozilla.com/report/index/10fa7700-4b83-4b8a-9f91-955fc2151109

Crashing Thread
Frame 	Module 	Signature 	Source
0 	xul.dll 	mozilla::css::Declaration::~Declaration() 	layout/style/Declaration.cpp
1 	xul.dll 	mozilla::css::Declaration::`scalar deleting destructor'(unsigned int) 	
2 	xul.dll 	mozilla::css::StyleRule::`scalar deleting destructor'(unsigned int) 	
3 	xul.dll 	mozilla::css::StyleRule::Release() 	layout/style/StyleRule.cpp
4 	xul.dll 	ReleaseObjects 	xpcom/glue/nsCOMArray.cpp
5 	xul.dll 	nsCOMArray_base::RemoveElementsAt(unsigned int, unsigned int) 	xpcom/glue/nsCOMArray.cpp
6 	xul.dll 	DeferredFinalizeRulesArray 	layout/style/IncrementalClearCOMRuleArray.cpp
7 	xul.dll 	mozilla::IncrementalFinalizeRunnable::ReleaseNow(bool) 	xpcom/base/CycleCollectedJSRuntime.cpp
8 	xul.dll 	mozilla::CycleCollectedJSRuntime::FinalizeDeferredThings(mozilla::CycleCollectedJSRuntime::DeferredFinalizeType) 	xpcom/base/CycleCollectedJSRuntime.cpp
9 	xul.dll 	mozilla::CycleCollectedJSRuntime::GCCallback(JSRuntime*, JSGCStatus, void*) 	xpcom/base/CycleCollectedJSRuntime.cpp
10 	xul.dll 	js::gc::GCRuntime::callGCCallback(JSGCStatus) 	js/src/jsgc.cpp
11 	xul.dll 	`anonymous namespace'::AutoNotifyGCActivity::~AutoNotifyGCActivity() 	js/src/jsgc.cpp
12 	xul.dll 	js::gc::GCRuntime::gcCycle(bool, js::SliceBudget&, JS::gcreason::Reason) 	js/src/jsgc.cpp
13 	xul.dll 	js::gc::GCRuntime::collect(bool, js::SliceBudget, JS::gcreason::Reason) 	js/src/jsgc.cpp
14 	xul.dll 	FinishAnyIncrementalGC 	dom/base/nsJSEnvironment.cpp
15 	xul.dll 	FireForgetSkippable 	dom/base/nsJSEnvironment.cpp
16 	xul.dll 	CCTimerFired 	dom/base/nsJSEnvironment.cpp
17 	xul.dll 	nsTimerImpl::Fire() 	xpcom/threads/nsTimerImpl.cpp
18 	xul.dll 	nsTimerEvent::Run() 	xpcom/threads/TimerThread.cpp
19 	xul.dll 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp
20 	xul.dll 	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
21 	xul.dll 	mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
22 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc
23 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
24 	xul.dll 	nsBaseAppShell::Run() 	widget/nsBaseAppShell.cpp
25 	xul.dll 	nsAppShell::Run() 	widget/windows/nsAppShell.cpp
26 	xul.dll 	XRE_RunAppShell 	toolkit/xre/nsEmbedFunctions.cpp
27 	xul.dll 	mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
28 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc
29 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
30 	xul.dll 	XRE_InitChildProcess 	toolkit/xre/nsEmbedFunctions.cpp
31 	plugin-container.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp
32 	plugin-container.exe 	__tmainCRTStartup 	f:/dd/vctools/crt/crtw32/startup/crt0.c:255
Ø 33 	kernel32.dll 	kernel32.dll@0x159dc 	
Ø 34 	ntdll.dll 	ntdll.dll@0x2a630

Comment 7

[Cosmin Muntean [:cmuntean], Ecosystem QA]

From the crash signature [@ nsRuleNode::Transition ] and [@ mozilla::css::Declaration::~Declaration ], the affected versions are:
- Nightly: 47.0a1
- Firefox: 44.0
- Beta: 45.0b1, 44.0b99, 44.0b1

In the crash signature [@ nsRuleNode::Sweep ] there are no reports for newer versions of:
- Firefox: 43.0.4
- ESR: 31.7.0esr

Comment 8

[Wayne Mery (:wsmwk)]

This bug should remain closed because original reporter indicates his issue is gone, and the period of time between comment 5 and 6 is extreme. Any major issue in a current version deserves a new bug report.