Closed Bug 707758 Opened 13 years ago Closed 12 years ago

Intermittent OS X64 dromaeo_css crash [@ js::gc::ScanObject] or [@ nsCOMPtr_base::~nsCOMPtr_base | nsBaseContentList::~nsBaseContentList]

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86_64
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: philor, Unassigned)

References

Details

(Keywords: crash, intermittent-failure, Whiteboard: [test which aborts the suite])

Crash Data

https://tbpl.mozilla.org/php/getParsedLog.php?id=7752521&tree=Firefox
Rev4 MacOSX Lion 10.7 mozilla-central talos dromaeo on 2011-12-05 07:24:29 PST for push cb70391c86d9

Running test dromaeo_css: 
		Started Mon, 05 Dec 2011 07:25:18
	Screen width/height:1600/1200
	colorDepth:24
	Browser inner width/height: 1024/644

NOISE: 
NOISE: __FAILbrowser non-zero return code (256)__FAIL
NOISE: 
NOISE: __FAILbrowser non-zero return code (256)__FAIL
NOISE: Found crashdump: /var/folders/qd/srwd5f710sj0fcl9z464lkj00000gn/T/tmp0tG2yH/profile/minidumps/10067DF4-2280-4E5B-9A23-CF53A61E26D5.dmp
Operating system: Mac OS X
                  10.7.2 11C74
CPU: amd64
     family 6 model 23 stepping 10
     2 CPUs

Crash reason:  EXC_BAD_ACCESS / KERN_PROTECTION_FAILURE
Crash address: 0x12bfc860

Thread 0 (crashed)
 0  XUL!js::gc::ScanObject [jsgc.h:cb70391c86d9 : 642 + 0x3]
    rbx = 0x0000000b   r12 = 0x1c647458   r13 = 0x20ca6b88   r14 = 0xffffffff
    r15 = 0x0000002b   rip = 0x021f6e94   rsp = 0x5fbfcad0   rbp = 0x5fbfcbe0
 1  XUL!js::GCMarker::drainMarkStack [jsgcmark.cpp:cb70391c86d9 : 1054 + 0xd]
    rbx = 0x07602000   r12 = 0x11cf6800   r13 = 0x07602000   r14 = 0x00000000
    r15 = 0x00000000   rip = 0x021f76f5   rsp = 0x5fbfcb30   rbp = 0x5fbfcbe0
 2  XUL!GCCycle [jsgc.cpp:cb70391c86d9 : 2518 + 0x7]
    rbx = 0x07602000   r12 = 0x11cf6800   r13 = 0x07602000   r14 = 0x00000000
    r15 = 0x00000000   rip = 0x021f3428   rsp = 0x5fbfcb90   rbp = 0x5fbfcbe0
 3  XUL!js_GC [jsgc.cpp:cb70391c86d9 : 2981 + 0xd]
    rbx = 0x07602000   r12 = 0x00000000   r13 = 0x084ce501   r14 = 0x00000000
    r15 = 0x00000000   rip = 0x021f426e   rsp = 0x5fbfccf0   rbp = 0x003e3330
 4  XUL!nsXPConnect::Collect [nsXPConnect.cpp:cb70391c86d9 : 412 + 0x4]
    rbx = 0x07653000   r12 = 0x00000000   r13 = 0x084ce5d8   r14 = 0x5fbfcf3f
    r15 = 0x00307701   rip = 0x01a45999   rsp = 0x5fbfcd40   rbp = 0x5fbfcd60
 5  XUL!nsXPConnect::GarbageCollect [nsXPConnect.cpp:cb70391c86d9 : 420 + 0xc]
    rbx = 0x00000002   r12 = 0x016bdee0   r13 = 0x084ce5d8   r14 = 0x5fbfcf3f
    r15 = 0x00307701   rip = 0x01a44cc1   rsp = 0x5fbfce60   rbp = 0x084ce5b0
 6  XUL!nsTimerImpl::Fire [nsTimerImpl.cpp:cb70391c86d9 : 425 + 0x9]
    rbx = 0x00000002   r12 = 0x016bdee0   r13 = 0x084ce5d8   r14 = 0x5fbfcf3f
    r15 = 0x00307701   rip = 0x01f1d18a   rsp = 0x5fbfce70   rbp = 0x084ce5b0
 7  XUL!nsTimerEvent::Run [nsTimerImpl.cpp:cb70391c86d9 : 521 + 0x7]
    rbx = 0x084ce5b0   r12 = 0x00000000   r13 = 0x5fbfced0   r14 = 0x5fbfcf3f
    r15 = 0x00307701   rip = 0x01f1d248   rsp = 0x5fbfcea0   rbp = 0x8000ffff
 8  XUL!nsThread::ProcessNextEvent [nsThread.cpp:cb70391c86d9 : 625 + 0x5]
    rbx = 0x00331a00   r12 = 0x00000000   r13 = 0x5fbfced0   r14 = 0x5fbfcf3f
    r15 = 0x00307701   rip = 0x01f19cca   rsp = 0x5fbfceb0   rbp = 0x8000ffff
 9  XUL!NS_ProcessPendingEvents_P [nsThreadUtils.cpp:cb70391c86d9 : 195 + 0xd]
    rbx = 0x00331a00   r12 = 0x0ed5a89c   r13 = 0x00000014   r14 = 0x5fbfcf3f
    r15 = 0x00307788   rip = 0x01eda5de   rsp = 0x5fbfcf30   rbp = 0x00000000
10  XUL!nsBaseAppShell::NativeEventCallback [nsBaseAppShell.cpp:cb70391c86d9 : 130 + 0x13]
    rbx = 0x00307ba0   r12 = 0x00331a00   r13 = 0x00000000   r14 = 0x05338158
    r15 = 0x00307788   rip = 0x01da2669   rsp = 0x5fbfcf70   rbp = 0x00000000
11  XUL!nsAppShell::ProcessGeckoEvents [nsAppShell.mm:cb70391c86d9 : 440 + 0x7]
    rbx = 0x05338140   r12 = 0x00000000   r13 = 0x784dbae0   r14 = 0x05338158
    r15 = 0x00307788   rip = 0x01d697ab   rsp = 0x5fbfcfa0   rbp = 0x00307ba0
12  CoreFoundation + 0x12b50
    rbx = 0x05338140   r12 = 0x00000000   r13 = 0x784dbae0   r14 = 0x05338158
    r15 = 0x00307788   rip = 0x92f39b51   rsp = 0x5fbfd000   rbp = 0x5fbfd000
Crash Signature: [@ js::gc::ScanObject]
Keywords: crash
https://tbpl.mozilla.org/php/getParsedLog.php?id=7807340&tree=Mozilla-Inbound
Rev4 MacOSX Lion 10.7 mozilla-inbound talos dromaeo on 2011-12-07 15:34:06 PST for push 6b60ebe2cae4

RETURN:s: talos-r4-lion-036
RETURN:id:20111207141754
RETURN:<a href = "http://hg.mozilla.org/integration/mozilla-inbound/rev/6b60ebe2cae4">rev:6b60ebe2cae4</a>
talos-r4-lion-036: 
		Started Wed, 07 Dec 2011 15:34:44
Running test dromaeo_css: 
		Started Wed, 07 Dec 2011 15:34:44
	Screen width/height:1600/1200
	colorDepth:24
	Browser inner width/height: 1024/644

NOISE: 
NOISE: __FAILbrowser non-zero return code (256)__FAIL
NOISE: 
NOISE: __FAILbrowser non-zero return code (256)__FAIL
NOISE: Found crashdump: /var/folders/qd/srwd5f710sj0fcl9z464lkj00000gn/T/tmpHJ8_VY/profile/minidumps/32A2AB11-2DE6-4AB3-8B15-053CD246FBBA.dmp
Operating system: Mac OS X
                  10.7.2 11C74
CPU: amd64
     family 6 model 23 stepping 10
     2 CPUs

Crash reason:  EXC_BAD_ACCESS / 0x0000000d
Crash address: 0x0

Thread 0 (crashed)
 0  XUL!nsCOMPtr_base::~nsCOMPtr_base [nsCOMPtr.cpp:6b60ebe2cae4 : 81 + 0x3]
    rbx = 0x18f90450   r12 = 0x180fa7f0   r13 = 0x00000e1f   r14 = 0x148f8fff
    r15 = 0x148f8040   rip = 0x01009bfb   rsp = 0x5fbfc948   rbp = 0x18f91100
 1  XUL!nsBaseContentList::~nsBaseContentList [nsCOMPtr.h : 519 + 0x7]
    rbx = 0x18f90450   r12 = 0x180fa7f0   r13 = 0x00000e1f   r14 = 0x148f8fff
    r15 = 0x148f8040   rip = 0x01430368   rsp = 0x5fbfc950   rbp = 0x18f91100
 2  XUL!nsSimpleContentList::~nsSimpleContentList [nsContentList.h:6b60ebe2cae4 : 150 + 0x7]
    rbx = 0x180fa7f0   r12 = 0x00000000   r13 = 0x00000000   r14 = 0x148f8fff
    r15 = 0x148f8040   rip = 0x01430bfa   rsp = 0x5fbfc980   rbp = 0x180fa7f0
 3  XUL!nsBaseContentList::Release [nsContentList.cpp:6b60ebe2cae4 : 109 + 0x9]
    rbx = 0x14c42a78   r12 = 0x00000000   r13 = 0x00000000   r14 = 0x148f8fff
    r15 = 0x148f8040   rip = 0x0142def9   rsp = 0x5fbfc990   rbp = 0x180fa7f0
 4  XUL!mozilla::dom::binding::ListBase<mozilla::dom::binding::ListClass<nsINodeList, mozilla::dom::binding::Ops<mozilla::dom::binding::Getter<nsIContent*>, mozilla::dom::binding::NoOp>, mozilla::dom::binding::Ops<mozilla::dom::binding::NoOp, mozilla::dom::binding::NoOp> > >::finalize [dombindings.cpp:6b60ebe2cae4 : 1183 + 0x8]
    rbx = 0x180fa7f0   r12 = 0x00000000   r13 = 0x00000000   r14 = 0x148f8fff
    r15 = 0x148f8040   rip = 0x01b360bb   rsp = 0x5fbfc9b0   rbp = 0x003e8330
 5  XUL!js::gc::FinalizeArenas [jsobjinlines.h:6b60ebe2cae4 : 279 + 0x9]
    rbx = 0x148f8840   r12 = 0x00000000   r13 = 0x00000000   r14 = 0x148f8fff
    r15 = 0x148f8040   rip = 0x021fb779   rsp = 0x5fbfc9d0   rbp = 0x003e8330
 6  XUL!js::gc::ArenaLists::finalizeObjects [jsgc.cpp:6b60ebe2cae4 : 1463 + 0x3e]
    rbx = 0x12d46010   r12 = 0x00000000   r13 = 0x06a02000   r14 = 0x00000000
    r15 = 0x00000000   rip = 0x021fd25b   rsp = 0x5fbfcb70   rbp = 0x003e8330
 7  XUL!GCCycle [jsgc.cpp:6b60ebe2cae4 : 2584 + 0x10]
    rbx = 0x09d803f8   r12 = 0x00000000   r13 = 0x06a02000   r14 = 0x00000000
    r15 = 0x00000000   rip = 0x021fdc38   rsp = 0x5fbfcb90   rbp = 0x09d80400
 8  XUL!js_GC [jsgc.cpp:6b60ebe2cae4 : 2980 + 0xd]
    rbx = 0x06a02000   r12 = 0x00000000   r13 = 0x08b33f01   r14 = 0x00000000
    r15 = 0x00000000   rip = 0x021fe93e   rsp = 0x5fbfccf0   rbp = 0x003e8330
 9  XUL!nsXPConnect::Collect [nsXPConnect.cpp:6b60ebe2cae4 : 412 + 0x4]
    rbx = 0x06a56000   r12 = 0x00000000   r13 = 0x08b33f38   r14 = 0x5fbfcf3f
    r15 = 0x00307701   rip = 0x01a4ce19   rsp = 0x5fbfcd40   rbp = 0x5fbfcd60
10  XUL!nsXPConnect::GarbageCollect [nsXPConnect.cpp:6b60ebe2cae4 : 420 + 0xc]
    rbx = 0x00000002   r12 = 0x016c44a0   r13 = 0x08b33f38   r14 = 0x5fbfcf3f
    r15 = 0x00307701   rip = 0x01a4c141   rsp = 0x5fbfce60   rbp = 0x08b33f10
11  XUL!nsTimerImpl::Fire [nsTimerImpl.cpp:6b60ebe2cae4 : 425 + 0x9]
    rbx = 0x00000002   r12 = 0x016c44a0   r13 = 0x08b33f38   r14 = 0x5fbfcf3f
    r15 = 0x00307701   rip = 0x01f27e3a   rsp = 0x5fbfce70   rbp = 0x08b33f10
12  XUL!nsTimerEvent::Run [nsTimerImpl.cpp:6b60ebe2cae4 : 521 + 0x7]
    rbx = 0x08b33f10   r12 = 0x00000000   r13 = 0x5fbfced0   r14 = 0x5fbfcf3f
    r15 = 0x00307701   rip = 0x01f27ef8   rsp = 0x5fbfcea0   rbp = 0x8000ffff
Crash Signature: [@ js::gc::ScanObject] → [@ js::gc::ScanObject] [@ nsCOMPtr_base::~nsCOMPtr_base]
Summary: Intermittent dromaeo_css crash [@ js::gc::ScanObject] → Intermittent OS X64 dromaeo_css crash [@ js::gc::ScanObject] or [@ nsCOMPtr_base::~nsCOMPtr_base]
Hmmm, this is kind of interesting. These look kind of like some of the GC topcrashes we have.
Keywords: topcrash
The first crash is in ScanObject, and the other ones happen when running a finalizer for the new DOM binding code. I'm CCing some people who know about the DOM bindings.

Also, is there a way to get a crash dump? It would really be nice if we saved the tinderbox minidumps somewhere.
There are no crashes above 10.0.2.
Crash Signature: [@ js::gc::ScanObject] [@ nsCOMPtr_base::~nsCOMPtr_base] → [@ js::gc::ScanObject] [@ nsCOMPtr_base::~nsCOMPtr_base | nsBaseContentList::~nsBaseContentList]
Keywords: topcrash
Summary: Intermittent OS X64 dromaeo_css crash [@ js::gc::ScanObject] or [@ nsCOMPtr_base::~nsCOMPtr_base] → Intermittent OS X64 dromaeo_css crash [@ js::gc::ScanObject] or [@ nsCOMPtr_base::~nsCOMPtr_base | nsBaseContentList::~nsBaseContentList]
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → WORKSFORME
Whiteboard: [orange][test which aborts the suite] → [test which aborts the suite]
You need to log in before you can comment on or make changes to this bug.