Intermittent crash [@ JS::AutoCheckRequestDepth::AutoCheckRequestDepth] or [@ js::detail::HashTable] or "Assertion failure: !entered, at ./../../dist/include/js/Utility.h:840" during test_fullscreen-api.html

RESOLVED FIXED in mozilla13

Status

()

--
critical
RESOLVED FIXED
7 years ago
6 years ago

People

(Reporter: philor, Assigned: billm)

Tracking

({crash, intermittent-failure})

Trunk
mozilla13
crash, intermittent-failure
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

7 years ago
https://tbpl.mozilla.org/php/getParsedLog.php?id=9473159&tree=Mozilla-Inbound
Rev3 MacOSX Leopard 10.5.8 mozilla-inbound debug test mochitests-1/5 on 2012-02-20 09:24:56 PST for push 6a43d088a2b4

TEST-UNEXPECTED-FAIL | /tests/content/html/content/test/test_fullscreen-api.html | Exited with code 1 during test run
INFO | automation.py | Application ran for: 0:09:36.094469
INFO | automation.py | Reading PID log: /var/folders/Xr/Xr--yJnSEY0U11ET5NZuMU+++TM/-Tmp-/tmp404oc7pidlog
PROCESS-CRASH | /tests/content/html/content/test/test_fullscreen-api.html | application crashed (minidump found)
Crash dump filename: /var/folders/Xr/Xr--yJnSEY0U11ET5NZuMU+++TM/-Tmp-/tmpQqy_hg/minidumps/ADADB4F6-F3BA-403E-A07A-C8676AC28056.dmp
Operating system: Mac OS X
                  10.5.8 9L31a
CPU: x86
     GenuineIntel family 6 model 23 stepping 10
     2 CPUs

Crash reason:  EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
Crash address: 0xffffffffc000007b

Thread 0 (crashed)
 0  XUL!JS::AutoCheckRequestDepth::AutoCheckRequestDepth [jscntxt.cpp:6a43d088a2b4 : 1301 + 0x2]
    eip = 0x05579dfc   esp = 0xbfff3c40   ebp = 0xbfff3c58   ebx = 0x05579df1
    esi = 0x290c3750   edi = 0xbfff3c7c   eax = 0xc0000003   ecx = 0xbfff3dbc
    edx = 0x0072017c   efl = 0x00210282
    Found by: given as instruction pointer in context
 1  XUL!JS_GetCompartmentPrivate [jsapi.cpp:6a43d088a2b4 : 1512 + 0x11]
    eip = 0x055088ce   esp = 0xbfff3c60   ebp = 0xbfff3c88   ebx = 0x0477c28e
    esi = 0x00000000   edi = 0xbfff3c7c
    Found by: call frame info
 2  XUL!TraceCompartment [XPCJSRuntime.cpp:6a43d088a2b4 : 404 + 0x14]
    eip = 0x0477c2a4   esp = 0xbfff3c90   ebp = 0xbfff3cd8   ebx = 0x0477c28e
    esi = 0x00000000   edi = 0x3109de00
    Found by: call frame info
 3  XUL!nsBaseHashtable<xpc::PtrAndPrincipalHashKey,JSCompartment*,JSCompartment*>::s_EnumReadStub [nsBaseHashtable.h : 395 + 0x12]
    eip = 0x047873bb   esp = 0xbfff3ce0   ebp = 0xbfff3d08   ebx = 0x047873a1
    esi = 0x00000000   edi = 0x3109de00
    Found by: call frame info
 4  XUL!PL_DHashTableEnumerate [pldhash.cpp:6a43d088a2b4 : 754 + 0x1d]
    eip = 0x032c862a   esp = 0xbfff3d10   ebp = 0xbfff3d78   ebx = 0x032c853e
    esi = 0x00000000   edi = 0x3109de00
    Found by: call frame info
 5  XUL!XPCJSRuntime::TraceXPConnectRoots [nsBaseHashtable.h : 206 + 0x20]
    eip = 0x0477f2f9   esp = 0xbfff3d80   ebp = 0xbfff3de8   ebx = 0x0477f16e
    esi = 0x05f2ddc0   edi = 0x0072017c
    Found by: call frame info
 6  XUL!js::MarkRuntime [jsgc.cpp:6a43d088a2b4 : 2396 + 0x14]
    eip = 0x055e1505   esp = 0xbfff3df0   ebp = 0xbfff3ee8   ebx = 0x055e0b11
    esi = 0x0477f350   edi = 0x269f4894
    Found by: call frame info
 7  XUL!ValidateIncrementalMarking [jsgc.cpp:6a43d088a2b4 : 3089 + 0xf]
    eip = 0x055e1d20   esp = 0xbfff3ef0   ebp = 0xbfff7fc8   ebx = 0x055e18b1
    esi = 0x22f7ec00   edi = 0x22f7ec00
    Found by: call frame info
 8  XUL!EndMarkPhase [jsgc.cpp:6a43d088a2b4 : 3041 + 0x6]
    eip = 0x055e324a   esp = 0xbfff7fd0   ebp = 0xbfff8058   ebx = 0x055e2e9e
    esi = 0x00720200   edi = 0x00172e30
    Found by: call frame info
 9  XUL!IncrementalGCSlice [jsgc.cpp:6a43d088a2b4 : 3503 + 0x7]
    eip = 0x055f3a7c   esp = 0xbfff8060   ebp = 0xbfff8138   ebx = 0x055f3651
(Reporter)

Comment 2

7 years ago
Not exclusively Mac or 32 bit, though, apparently:

https://tbpl.mozilla.org/php/getParsedLog.php?id=9445557&tree=Mozilla-Inbound
Rev3 Fedora 12x64 mozilla-inbound debug test mochitests-1/5 on 2012-02-18 12:17:23 PST for push 2742dd95aa74

TEST-UNEXPECTED-FAIL | /tests/content/html/content/test/test_fullscreen-api.html | Exited with code 1 during test run
INFO | automation.py | Application ran for: 0:11:01.097186
INFO | automation.py | Reading PID log: /tmp/tmpcN0zK0pidlog
==> process 2290 launched child process 2335
INFO | automation.py | Checking for orphan process with PID: 2335
PROCESS-CRASH | /tests/content/html/content/test/test_fullscreen-api.html | application crashed (minidump found)
Crash dump filename: /tmp/tmp2tVAYp/minidumps/1e97bbdc-0834-7aea-0d824eff-0a46b1f1.dmp
Operating system: Linux
                  0.0.0 Linux 2.6.31.5-127.fc12.x86_64 #1 SMP Sat Nov 7 21:11:14 EST 2009 x86_64
CPU: amd64
     family 6 model 23 stepping 10
     2 CPUs

Crash reason:  SIGABRT
Crash address: 0x1f4000008f2

Thread 0 (crashed)
 0  libpthread-2.11.so + 0xee6b
    rbx = 0x07a7db50   r12 = 0x059fefe0   r13 = 0x00000040   r14 = 0x05974480
    r15 = 0x00000000   rip = 0xd360ee6b   rsp = 0x1cc91da8   rbp = 0x1cc91dc0
    Found by: given as instruction pointer in context
 1  libxul.so!JS::AutoCheckRequestDepth::AutoCheckRequestDepth [jscntxt.cpp:2742dd95aa74 : 1302 + 0x20]
    rip = 0x36f238c6   rsp = 0x1cc91db0
    Found by: stack scanning
 2  libxul.so!JS_GetCompartmentPrivate [jsapi.cpp:2742dd95aa74 : 1512 + 0xa]
    rip = 0x36ee9cd2   rsp = 0x1cc91dd0
    Found by: stack scanning
 3  libxul.so!js::gc::MarkInternal<JSObject> [jsgcmark.cpp:2742dd95aa74 : 83 + 0x7]
    rip = 0x36f7d566   rsp = 0x1cc91de0
    Found by: stack scanning
 4  libxul.so!TraceCompartment [XPCJSRuntime.cpp:2742dd95aa74 : 404 + 0x8]
    rip = 0x36740506   rsp = 0x1cc91e00
    Found by: stack scanning
 5  libxul.so!nsBaseHashtable<xpc::PtrAndPrincipalHashKey, JSCompartment*, JSCompartment*>::s_EnumReadStub [nsBaseHashtable.h : 395 + 0x9]
    rip = 0x367441b6   rsp = 0x1cc91e20
    Found by: stack scanning
 6  libxul.so!PL_DHashTableEnumerate [pldhash.cpp:2742dd95aa74 : 754 + 0x17]
    rip = 0x36bd1a41   rsp = 0x1cc91e40
    Found by: stack scanning
 7  libxul.so + 0x109519f
    rip = 0x367441a0   rsp = 0x1cc91e60
    Found by: stack scanning
 8  libxul.so!XPCRootSetElem::RemoveFromRootSet [XPCJSRuntime.cpp:2742dd95aa74 : 2258 + 0x8]
    rip = 0x367404f3   rsp = 0x1cc91e90
    Found by: stack scanning
 9  0x7fff1cc91f07
    rbx = 0x012828e8   r12 = 0x012ad788   rip = 0x1cc91f08   rsp = 0x1cc91e98
    rbp = 0x367404f3
    Found by: call frame info
10  libxul.so!nsBaseHashtable<xpc::PtrAndPrincipalHashKey, JSCompartment*, JSCompartment*>::EnumerateRead [nsBaseHashtable.h : 206 + 0x4]
    rip = 0x36744730   rsp = 0x1cc91eb0
    Found by: stack scanning
11  libxul.so!XPCRootSetElem::RemoveFromRootSet [XPCJSRuntime.cpp:2742dd95aa74 : 2258 + 0x8]
    rip = 0x367404f3   rsp = 0x1cc91eb8
    Found by: stack scanning
OS: Mac OS X → All
Hardware: x86 → All
(Reporter)

Comment 6

7 years ago
Maybe the same root cause, maybe not:

https://tbpl.mozilla.org/php/getParsedLog.php?id=9485880&tree=Mozilla-Inbound

Thread 0 (crashed)
 0  XUL!js::detail::HashTable<js::gc::Chunk* const,js::HashSet<js::gc::Chunk*, js::GCChunkHasher, js::SystemAllocPolicy>::SetOps,js::SystemAllocPolicy>::lookup [HashTable.h : 88 + 0x0]
    rbx = 0x0147d60e   r12 = 0x47a2db39   r13 = 0x00000337   r14 = 0x04d06228
    r15 = 0x1b800000   rip = 0x030f6619   rsp = 0x5fbf1eb0   rbp = 0x5fbf1f00
    Found by: given as instruction pointer in context
 1  XUL!js::MarkRuntime [HashTable.h : 671 + 0x1e]
    rbx = 0x00bf8a40   r12 = 0x1b8c6d80   r13 = 0x00bfaa00   r14 = 0x04d06228
    r15 = 0x1b800000   rip = 0x030e40ec   rsp = 0x5fbf1f10   rbp = 0x5fbf20a0
    Found by: call frame info
 2  XUL!ValidateIncrementalMarking [jsgc.cpp:c3e591a5b867 : 3089 + 0x10]
    rbx = 0x1c355c00   r12 = 0x1c355c00   r13 = 0x00000093   r14 = 0x000000ff
    r15 = 0x00000000   rip = 0x030e5abe   rsp = 0x5fbf20b0   rbp = 0x5fbf6100
    Found by: call frame info
 3  XUL!EndMarkPhase [jsgc.cpp:c3e591a5b867 : 3041 + 0x7]
    rbx = 0x04d06310   r12 = 0x00163cf0   r13 = 0x00000001   r14 = 0x27c581d8
    r15 = 0x04d06000   rip = 0x030e666a   rsp = 0x5fbf6110   rbp = 0x5fbf6180
    Found by: call frame info
 4  XUL!IncrementalGCSlice [jsgc.cpp:c3e591a5b867 : 3503 + 0xb]
    rbx = 0x27c581d8   r12 = 0x27c581d8   r13 = 0x00000001   r14 = 0x27c581d8
    r15 = 0x00000001   rip = 0x030e9b08   rsp = 0x5fbf6190   rbp = 0x5fbf6230
    Found by: call frame info
 5  XUL!GCCycle [jsgc.cpp:c3e591a5b867 : 3620 + 0x18]
    rbx = 0x4674c940   r12 = 0x4674c940   r13 = 0x00000040   r14 = 0x00000014
    r15 = 0x44c04000   rip = 0x030ea586   rsp = 0x5fbf6240   rbp = 0x5fbf6340
    Found by: call frame info
 6  XUL!Collect [jsgc.cpp:c3e591a5b867 : 3683 + 0x11]
    rbx = 0x04d06000   r12 = 0x04d089b0   r13 = 0x00163cf0   r14 = 0x00000000
    r15 = 0x00000000   rip = 0x030f3acd   rsp = 0x5fbf6350   rbp = 0x5fbf63c0
    Found by: call frame info
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
(Reporter)

Updated

7 years ago
Summary: Intermittent crash [@ JS::AutoCheckRequestDepth::AutoCheckRequestDepth] during test_fullscreen-api.html → Intermittent crash [@ JS::AutoCheckRequestDepth::AutoCheckRequestDepth] or [@ js::detail::HashTable] during test_fullscreen-api.html
Comment hidden (Treeherder Robot)
Keywords: fennecnative-betablocker
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
(Reporter)

Comment 36

7 years ago
Juicier than most, managing to assert instead of crashing directly:

https://tbpl.mozilla.org/php/getParsedLog.php?id=9552827&tree=Mozilla-Inbound
Rev3 Fedora 12x64 mozilla-inbound debug test mochitests-1/5 on 2012-02-22 22:11:53 PST for push 3d8fc342348b

72483 INFO TEST-PASS | /tests/content/html/content/test/test_fullscreen-api.html | [denied] Should not ever grant a fullscreen request in this doc.
++DOCSHELL 0x7d44fe0 == 15
++DOMWINDOW == 639 (0x811b0f8) [serial = 2229] [outer = (nil)]
++DOMWINDOW == 640 (0x5cab2e8) [serial = 2230] [outer = 0x811b080]
WARNING: NS_ENSURE_SUCCESS(rv, false) failed with result 0x8000FFFF: file /builds/slave/m-in-lnx64-dbg/build/content/base/src/nsContentUtils.cpp, line 2630
WARNING: NS_ENSURE_TRUE(pusher.Push(aBoundElement)) failed: file /builds/slave/m-in-lnx64-dbg/build/content/xbl/src/nsXBLProtoImplMethod.cpp, line 359
WARNING: NS_ENSURE_SUCCESS(rv, false) failed with result 0x8000FFFF: file /builds/slave/m-in-lnx64-dbg/build/content/base/src/nsContentUtils.cpp, line 2630
WARNING: NS_ENSURE_TRUE(pusher.Push(aBoundElement)) failed: file /builds/slave/m-in-lnx64-dbg/build/content/xbl/src/nsXBLProtoImplMethod.cpp, line 359
WARNING: NS_ENSURE_SUCCESS(rv, false) failed with result 0x8000FFFF: file /builds/slave/m-in-lnx64-dbg/build/content/base/src/nsContentUtils.cpp, line 2630
WARNING: NS_ENSURE_TRUE(pusher.Push(aBoundElement)) failed: file /builds/slave/m-in-lnx64-dbg/build/content/xbl/src/nsXBLProtoImplMethod.cpp, line 359
WARNING: NS_ENSURE_SUCCESS(rv, false) failed with result 0x8000FFFF: file /builds/slave/m-in-lnx64-dbg/build/content/base/src/nsContentUtils.cpp, line 2630
WARNING: NS_ENSURE_TRUE(pusher.Push(aBoundElement)) failed: file /builds/slave/m-in-lnx64-dbg/build/content/xbl/src/nsXBLProtoImplMethod.cpp, line 359
WARNING: NS_ENSURE_SUCCESS(rv, false) failed with result 0x8000FFFF: file /builds/slave/m-in-lnx64-dbg/build/content/base/src/nsContentUtils.cpp, line 2630
WARNING: NS_ENSURE_TRUE(pusher.Push(aBoundElement)) failed: file /builds/slave/m-in-lnx64-dbg/build/content/xbl/src/nsXBLProtoImplMethod.cpp, line 359
WARNING: NS_ENSURE_SUCCESS(rv, false) failed with result 0x8000FFFF: file /builds/slave/m-in-lnx64-dbg/build/content/base/src/nsContentUtils.cpp, line 2630
WARNING: NS_ENSURE_TRUE(pusher.Push(aBoundElement)) failed: file /builds/slave/m-in-lnx64-dbg/build/content/xbl/src/nsXBLProtoImplMethod.cpp, line 359
++DOCSHELL 0x94073b0 == 16
++DOMWINDOW == 641 (0x89d3038) [serial = 2231] [outer = (nil)]
++DOCSHELL 0x5d47590 == 17
++DOMWINDOW == 642 (0x6cba868) [serial = 2232] [outer = (nil)]
Assertion failure: !entered, at ./../../dist/include/js/Utility.h:840
WARNING: shutting down early because of crash!: file /builds/slave/m-in-lnx64-dbg/build/dom/plugins/ipc/PluginModuleChild.cpp, line 743
WARNING: plugin process _exit()ing: file /builds/slave/m-in-lnx64-dbg/build/dom/plugins/ipc/PluginModuleChild.cpp, line 708
TEST-UNEXPECTED-FAIL | /tests/content/html/content/test/test_fullscreen-api.html | Exited with code 1 during test run
INFO | automation.py | Application ran for: 0:11:00.057980
INFO | automation.py | Reading PID log: /tmp/tmpZveNjCpidlog
==> process 2211 launched child process 2255
INFO | automation.py | Checking for orphan process with PID: 2255
PROCESS-CRASH | /tests/content/html/content/test/test_fullscreen-api.html | application crashed (minidump found)
Crash dump filename: /tmp/tmpROW6Ys/minidumps/29e99821-70b7-8a7b-76acaf5a-68ac53bc.dmp
Operating system: Linux
                  0.0.0 Linux 2.6.31.5-127.fc12.x86_64 #1 SMP Sat Nov 7 21:11:14 EST 2009 x86_64
CPU: amd64
     family 6 model 23 stepping 10
     2 CPUs

Crash reason:  SIGABRT
Crash address: 0x1f4000008a3

Thread 0 (crashed)
 0  libpthread-2.11.so + 0xee6b
    rbx = 0x16636560   r12 = 0x4d921200   r13 = 0x18033390   r14 = 0x1803344c
    r15 = 0x16636560   rip = 0xd360ee6b   rsp = 0x18033338   rbp = 0x18033360
    Found by: given as instruction pointer in context
 1  libxul.so!js::detail::HashTable<js::gc::Chunk* const, js::HashSet<js::gc::Chunk*, js::GCChunkHasher, js::SystemAllocPolicy>::SetOps, js::SystemAllocPolicy>::lookup [Utility.h : 840 + 0x19]
    rip = 0x4c840e88   rsp = 0x18033340
    Found by: stack scanning
 2  libxul.so!js::IsAddressableGCThing [HashTable.h : 1327 + 0x4]
    rip = 0x4c840f7e   rsp = 0x18033370
    Found by: stack scanning
 3  libxul.so!js::MarkIfGCThingWord [jsgc.cpp:3d8fc342348b : 1073 + 0x13]
    rip = 0x4c846802   rsp = 0x180333e0
    Found by: stack scanning
 4  libxul.so!js::gc::MarkInternal<JSObject> [jsgcmark.cpp:3d8fc342348b : 107 + 0xa]
    rip = 0x4c84fb3b   rsp = 0x180333f0
    Found by: stack scanning
 5  libxul.so!js::MarkConservativeStackRoots [jsgc.cpp:3d8fc342348b : 1138 + 0x4]
    rip = 0x4c832517   rsp = 0x18033450
    Found by: stack scanning
 6  libxul.so!js::MarkRuntime [jsgc.cpp:3d8fc342348b : 2149 + 0x15]
    rip = 0x4c832dc5   rsp = 0x18033480
    Found by: stack scanning
 7  libxul.so!js::detail::HashTable<js::HashMapEntry<js::gc::Chunk*, long unsigned int*>, js::HashMap<js::gc::Chunk*, long unsigned int*>::MapHashPolicy, js::TempAllocPolicy>::changeTableSize [Utility.h : 152 + 0x7]
    rip = 0x4c848508   rsp = 0x180334a0
    Found by: stack scanning
 8  libxul.so!js::HashMap<JSFunction*, JSString*, js::DefaultHasher<JSFunction*>, js::SystemAllocPolicy>::put<JSFunction*, JSString*> [HashTable.h : 1026 + 0x8]
    rip = 0x4c82a920   rsp = 0x180334e8
    Found by: stack scanning
 9  libxul.so!js::HashMap<js::gc::Chunk*, long unsigned int*, js::DefaultHasher<js::gc::Chunk*>, js::TempAllocPolicy>::putNew [HashTable.h : 737 + 0xa]
    rip = 0x4c8487bb   rsp = 0x18033520
    Found by: stack scanning
10  libxul.so!ValidateIncrementalMarking [jsgc.cpp:3d8fc342348b : 3089 + 0xc]
    rip = 0x4c8355e3   rsp = 0x18033570
    Found by: stack scanning
Summary: Intermittent crash [@ JS::AutoCheckRequestDepth::AutoCheckRequestDepth] or [@ js::detail::HashTable] during test_fullscreen-api.html → Intermittent crash [@ JS::AutoCheckRequestDepth::AutoCheckRequestDepth] or [@ js::detail::HashTable] or "Assertion failure: !entered, at ./../../dist/include/js/Utility.h:840" during test_fullscreen-api.html

Comment 37

7 years ago
Hopefully my patch for the bug 723286 addresses this as it removes few unnecessary request checks.
Assignee: general → igor
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Keywords: fennecnative-betablocker
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Created attachment 600733 [details] [diff] [review]
fix

You're right about the cause, Igor. In between incremental GC slices, I wasn't resetting the context of rt->gcMarker. So in some cases we were using a freed context. Usually this wasn't an issue because most code has been changed to use trc->runtime rather than trc->context->runtime. But there are still a few places where trc->context is used.

I agree that the right fix is to stop using the context during GC. However, I would like to fix this right away since it's triggering so much. This patch seems to fix it on a try run.
Assignee: igor → wmccloskey
Status: NEW → ASSIGNED
Attachment #600733 - Flags: review?(igor)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)

Updated

7 years ago
Attachment #600733 - Flags: review?(igor) → review+
https://hg.mozilla.org/integration/mozilla-inbound/rev/f09084db292c

Let's make sure this fixes it before closing.
Whiteboard: [orange] → [orange][leave-open]
Target Milestone: --- → mozilla13
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
(Reporter)

Comment 92

7 years ago
https://hg.mozilla.org/mozilla-central/rev/f09084db292c

(You don't really have to leave a bug open to see whether it fixes something - most people are entirely too happy to just star with a closed bug.)
Whiteboard: [orange][leave-open] → [orange]
Comment hidden (Treeherder Robot)
I'm going to close this so we don't accidentally lump anything else in here. The assertion failure in comment 93 is unrelated to this bug.
Status: ASSIGNED → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → FIXED
Keywords: intermittent-failure
Whiteboard: [orange]
You need to log in before you can comment on or make changes to this bug.