Intermittent crash regress-360969-05.js, test_hc_noderemovechild.html, browser_tabview_apptabs.js, browser_607016.js [@ js::gc::Cell::markIfUnmarked] [@ MarkInternal<js::types::TypeObject>] [@ js::gc::MarkInternal<JSString>(JSTracer*, JSString**)]

RESOLVED WORKSFORME

Status

()

defect
--
critical
RESOLVED WORKSFORME
7 years ago
6 years ago

People

(Reporter: mats, Unassigned)

Tracking

({crash, intermittent-failure})

Trunk
x86_64
macOS
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [js:t], crash signature)

(Reporter)

Description

7 years ago
This is a Try push (based on mozilla-central rev 64187d60fae7),
but I'm pretty sure it's unrelated to my changes:
https://tbpl.mozilla.org/php/getParsedLog.php?id=11951797&tree=Try


REFTEST TEST-START | file:///Users/cltbld/talos-slave/test/build/jsreftest/tests/jsreftest.html?test=js1_5/Regress/regress-360969-05.js | 2058 / 3409 (60%)
++DOMWINDOW == 68 (0x13df51fb8) [serial = 3906] [outer = 0x11c006f80]
BUGNUMBER: 360969
STATUS: 2^17: local function
TEST-UNEXPECTED-FAIL | file:///Users/cltbld/talos-slave/test/build/jsreftest/tests/jsreftest.html?test=js1_5/Regress/regress-360969-05.js | Exited with code 1 during test run
INFO | automation.py | Application ran for: 0:07:39.839111
INFO | automation.py | Reading PID log: /var/folders/Hs/HsDn6a9SG8idoIya6p9mtE+++TI/-Tmp-/tmp1c7te5pidlog
Downloading symbols from: http://ftp.mozilla.org/pub/mozilla.org/firefox/try-builds/mpalmgren@mozilla.com-e445217e4d50/try-macosx64-debug/firefox-15.0a1.en-US.mac64.crashreporter-symbols.zip
PROCESS-CRASH | file:///Users/cltbld/talos-slave/test/build/jsreftest/tests/jsreftest.html?test=js1_5/Regress/regress-360969-05.js | application crashed (minidump found)
Crash dump filename: /var/folders/Hs/HsDn6a9SG8idoIya6p9mtE+++TI/-Tmp-/tmpwBgEAK/minidumps/C13C262D-53B4-4B99-9366-E7BF1E3E2EDD.dmp
Operating system: Mac OS X
                  10.6.8 10K549
CPU: amd64
     family 6 model 23 stepping 10
     2 CPUs

Crash reason:  EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
Crash address: 0x4b0feb48

Thread 0 (crashed)
 0  XUL!js::gc::Cell::markIfUnmarked [Heap.h : 677 + 0x4]
    rbx = 0x00000552   r12 = 0x000154a7   r13 = 0x00000000   r14 = 0x4b0fc0b8
    r15 = 0x5fbf9f01   rip = 0x03da57eb   rsp = 0x5fbf9da0   rbp = 0x5fbf9de0
    Found by: given as instruction pointer in context
 1  XUL!js::gc::ScanShape [Marking.cpp : 551 + 0x7]
    rbx = 0x4b0aa538   r12 = 0x05ef0230   r13 = 0x4a3e02e0   r14 = 0x4a3e0000
    r15 = 0x5fbf9f08   rip = 0x03d9f972   rsp = 0x5fbf9df0   rbp = 0x5fbf9e00
    Found by: call frame info
 2  XUL!js::gc::MarkInternal<js::Shape> [Marking.cpp : 522 + 0xa]
    rbx = 0x00000000   r12 = 0x05ef0230   r13 = 0x4a3e02e0   r14 = 0x4a3e0000
    r15 = 0x5fbf9f08   rip = 0x03dab85b   rsp = 0x5fbf9e10   rbp = 0x5fbf9e60
    Found by: call frame info
 3  XUL!js::MarkIfGCThingWord [jsgc.cpp : 1028 + 0x11]
    rbx = 0x5fbf9ea0   r12 = 0x4a3e02e0   r13 = 0x05ef0230   r14 = 0x4a300000
    r15 = 0x4a3e02e0   rip = 0x03aeb117   rsp = 0x5fbf9e70   rbp = 0x5fbf9f40
    Found by: call frame info
 4  XUL!js::MarkConservativeStackRoots [jsgc.cpp : 1052 + 0x7]
    rbx = 0x5fbfab28   r12 = 0x5fc00000   r13 = 0x05ef0230   r14 = 0x05ef0000
    r15 = 0x5fbfa240   rip = 0x03ad683b   rsp = 0x5fbf9f50   rbp = 0x5fbf9f90
    Found by: call frame info
 5  XUL!js::MarkRuntime [jsgc.cpp : 2234 + 0xb]
    rbx = 0x00000000   r12 = 0x00000000   r13 = 0x05ef0230   r14 = 0x05ef0000
    r15 = 0x05ef0b60   rip = 0x03ad7869   rsp = 0x5fbf9fa0   rbp = 0x5fbfa0c0
    Found by: call frame info
 6  XUL!BeginMarkPhase [jsgc.cpp : 2945 + 0xa]
    rbx = 0x28883200   r12 = 0x28883200   r13 = 0x00000000   r14 = 0x05ef0320
    r15 = 0x28962200   rip = 0x03adafae   rsp = 0x5fbfa0d0   rbp = 0x5fbfa150
    Found by: call frame info
 7  XUL!GCCycle [jsgc.cpp : 3242 + 0x7]
    rbx = 0x28962340   r12 = 0x28962340   r13 = 0x00000014   r14 = 0x4ee65000
    r15 = 0x28962200   rip = 0x03adba4c   rsp = 0x5fbfa160   rbp = 0x5fbfa240
    Found by: call frame info
 8  XUL!Collect [jsgc.cpp : 3690 + 0x11]
    rbx = 0x05ef0320   r12 = 0x05ef0000   r13 = 0x05ef0b60   r14 = 0x00000001
    r15 = 0x5fbfa270   rip = 0x03adc8d1   rsp = 0x5fbfa250   rbp = 0x5fbfa2b0
    Found by: call frame info
 9  XUL!js_InvokeOperationCallback [jscntxt.cpp : 908 + 0x11]
    rbx = 0x000000c2   r12 = 0x05ef0000   r13 = 0x1c007390   r14 = 0x5fbfa700
    r15 = 0x5fbfa5d0   rip = 0x03a71292   rsp = 0x5fbfa2c0   rbp = 0x5fbfa2e0

...
Whiteboard: [js:t]
https://tbpl.mozilla.org/php/getParsedLog.php?id=15426621&tree=Mozilla-Aurora

Thread 0 (crashed)
 0  XUL!js::gc::MarkInternal<JSAtom> [Heap.h : 1010 + 0x0]
    rbx = 0x06920270   r12 = 0x4a1b1540   r13 = 0x4b733000   r14 = 0x4b733640
    r15 = 0x4a1b1578   rip = 0x036811bb   rsp = 0x5fbf69d0   rbp = 0x5fbf6a00
    Found by: given as instruction pointer in context
 1  XUL!JSFunction::trace [jsfun.cpp : 490 + 0xe]
    rip = 0x0348150a   rsp = 0x5fbf6a10
    Found by: stack scanning
 2  XUL!js::GCMarker::processMarkStackTop [Marking.cpp : 1214 + 0xa]
    rip = 0x0367f94b   rsp = 0x5fbf6a40
    Found by: stack scanning
 3  XUL!js::GCMarker::drainMarkStack [Marking.cpp : 1258 + 0xa]
    rip = 0x0367bd3f   rsp = 0x5fbf6aa0
    Found by: stack scanning
 4  XUL!IncrementalCollectSlice [jsgc.cpp : 4126 + 0x7]
    rip = 0x0348b380   rsp = 0x5fbf6ad0
    Found by: stack scanning
 5  XUL!dosprintf [jsprf.cpp : 999 + 0x13]
    rip = 0x03536bde   rsp = 0x5fbf6b00
    Found by: stack scanning
Blocks: 438871
Summary: regress-360969-05.js | Exited with code 1 during test run → regress-360969-05.js | Exited with code 1 during test run [@ js::gc::MarkInternal] [@ js::gc::Cell::markIfUnmarked]
Whiteboard: [js:t] → [js:t][orange]
Whiteboard: [js:t][orange] → [js:t]
Rev4 MacOSX Snow Leopard 10.6 mozilla-inbound debug test mochitest-3 on 2012-11-27 01:11:57 PST for push a5002d796673

slave: talos-r4-snow-051

https://tbpl.mozilla.org/php/getParsedLog.php?id=17368652&tree=Mozilla-Inbound

{
TEST-UNEXPECTED-FAIL | /tests/dom/tests/mochitest/dom-level1-core/test_hc_noderemovechild.html | Exited with code 1 during test run
INFO | automation.py | Application ran for: 0:08:34.337022
INFO | automation.py | Reading PID log: /var/folders/Hs/HsDn6a9SG8idoIya6p9mtE+++TI/-Tmp-/tmpUqb6wVpidlog
Downloading symbols from: http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-inbound-macosx64-debug/1354005725/firefox-20.0a1.en-US.mac64.crashreporter-symbols.zip
PROCESS-CRASH | /tests/dom/tests/mochitest/dom-level1-core/test_hc_noderemovechild.html | application crashed (minidump found)
Crash dump filename: /var/folders/Hs/HsDn6a9SG8idoIya6p9mtE+++TI/-Tmp-/tmpXVcWPO/minidumps/4FF475EC-CCDD-4422-A7A2-76D75662821F.dmp
Operating system: Mac OS X
                  10.6.8 10K549
CPU: amd64
     family 6 model 23 stepping 10
     2 CPUs

Crash reason:  EXC_BAD_ACCESS / 0x0000000d
Crash address: 0x0

Thread 0 (crashed)
 0  XUL!MarkInternal<js::types::TypeObject> [Marking.cpp : 107 + 0x0]
    rbx = 0x000000011f20a000   r12 = 0x00007fff5fbfcbe0
    r13 = 0x0000000000000005   r14 = 0x000000011f20a0a0
    r15 = 0x00000001283bd560   rip = 0x0000000103a33f18
    rsp = 0x00007fff5fbf8a70   rbp = 0x00007fff5fbf8aa0
    Found by: given as instruction pointer in context
 1  XUL!js::ObjectImpl::markChildren(JSTracer*) [ObjectImpl.cpp : 278 + 0x12]
    rbx = 0x000000014f5049c0   r12 = 0x00007fff5fbf8b98
    r13 = 0x0000000000000005   r14 = 0x00007fff5fbfcbe0
    r15 = 0x00000001283bd560   rip = 0x00000001039bbae0
    rsp = 0x00007fff5fbf8ab0   rbp = 0x00007fff5fbf8ac0
    Found by: call frame info
 2  XUL!IncrementalCollectSlice [jsgc.cpp : 3289 + 0x9]
    rbx = 0x0000000000000000   r12 = 0x00007fff5fbf8b98
    r13 = 0x0000000000000005   r14 = 0x00007fff5fbfcbe0
    r15 = 0x00000001283bd560   rip = 0x000000010382a087
    rsp = 0x00007fff5fbf8ad0   rbp = 0x00007fff5fbfcd10
    Found by: call frame info
 3  XUL!GCCycle [jsgc.cpp : 4558 + 0x10]
    rbx = 0x00000001061f5000   r12 = 0x0000000000002710
    r13 = 0x0000000000000000   r14 = 0x00000001061f5400
    r15 = 0x00000001061f5000   rip = 0x00000001038297de
    rsp = 0x00007fff5fbfcd20   rbp = 0x00007fff5fbfcd60
    Found by: call frame info
 4  XUL!Collect [jsgc.cpp : 4673 + 0x14]
    rbx = 0x00000001061f5000   r12 = 0x0000000000000001
    r13 = 0x00000001061f5400   r14 = 0x0000000000000012
    r15 = 0x0000000000000000   rip = 0x000000010382619c
    rsp = 0x00007fff5fbfcd70   rbp = 0x00007fff5fbfcdb0
    Found by: call frame info
 5  XUL!nsJSContext::GarbageCollectNow(js::gcreason::Reason, nsJSContext::IsIncremental, nsJSContext::IsCompartment, nsJSContext::IsShrinking, long long) [nsJSEnvironment.cpp : 2939 + 0xa]
    rbx = 0x0000000000000000   r12 = 0x0000000000000012
    r13 = 0x0000000000000001   r14 = 0x0000000000000000
    r15 = 0x0000000000000000   rip = 0x00000001022fbd0a
    rsp = 0x00007fff5fbfcdc0   rbp = 0x00007fff5fbfcdf0
    Found by: call frame info
 6  XUL!nsTimerImpl::Fire() [nsTimerImpl.cpp : 482 + 0x9]
    rbx = 0x0000000102304080   r12 = 0x00000001385de5f0
    r13 = 0x00007fff5fbfcf00   r14 = 0x0000000000000002
}
Crash Signature: [@ MarkInternal<js::types::TypeObject>] [@ js::gc::MarkInternal] [@ js::gc::Cell::markIfUnmarked]
Summary: regress-360969-05.js | Exited with code 1 during test run [@ js::gc::MarkInternal] [@ js::gc::Cell::markIfUnmarked] → regress-360969-05.js, test_hc_noderemovechild.html | Exited with code 1 during test run [@ js::gc::MarkInternal] [@ js::gc::Cell::markIfUnmarked] [@ MarkInternal<js::types::TypeObject>]
(Reporter)

Comment 3

7 years ago
Rev4 MacOSX Snow Leopard 10.6 mozilla-aurora debug test mochitest-browser-chrome on 2012-11-30 16:08:54 PST for push 19c3aa22d0ea

slave: talos-r4-snow-051

https://tbpl.mozilla.org/php/getParsedLog.php?id=17505322&tree=Mozilla-Aurora&full=1#error0

TEST-UNEXPECTED-FAIL | chrome://mochitests/content/browser/browser/components/tabview/test/browser_tabview_apptabs.js | Exited with code 1 during test run
INFO | automation.py | Application ran for: 0:16:26.690623
INFO | automation.py | Reading PID log: /var/folders/Hs/HsDn6a9SG8idoIya6p9mtE+++TI/-Tmp-/tmpXbcEDapidlog
Downloading symbols from: http://ftp-scl3.mozilla.com/pub/mozilla.org/firefox/tinderbox-builds/mozilla-aurora-macosx64-debug/1354318545/firefox-19.0a2.en-US.mac64.crashreporter-symbols.zip
PROCESS-CRASH | chrome://mochitests/content/browser/browser/components/tabview/test/browser_tabview_apptabs.js | application crashed (minidump found)
Crash dump filename: /var/folders/Hs/HsDn6a9SG8idoIya6p9mtE+++TI/-Tmp-/tmpBE_Uva/minidumps/A7E64BD3-BA6F-4611-8138-26E385401D36.dmp
Operating system: Mac OS X
                  10.6.8 10K549
CPU: amd64
     family 6 model 23 stepping 10
     2 CPUs

Crash reason:  EXC_BAD_ACCESS / 0x0000000d
Crash address: 0x0

Thread 0 (crashed)
 0  XUL!void js::gc::MarkInternal<JSString>(JSTracer*, JSString**) [Marking.cpp : 91 + 0x0]
    rbx = 0x0000000117726000   r12 = 0x00007fff5fbfcce0
    r13 = 0x000000000000000d   r14 = 0x0000000117726b00
    r15 = 0x00007fff5fbfcce0   rip = 0x0000000103a36348
    rsp = 0x00007fff5fbf8b20   rbp = 0x00007fff5fbf8b50
    Found by: given as instruction pointer in context
 1  XUL!js::gc::MarkIdInternal [Marking.cpp : 328 + 0x4]
    rbx = 0x0000000000000005   r12 = 0x00007fff5fbf8c98
    r13 = 0x000000000000000d   r14 = 0x0000000113ba29c8
    r15 = 0x00007fff5fbfcce0   rip = 0x0000000103a32d38
    rsp = 0x00007fff5fbf8b60   rbp = 0x00007fff5fbf8b80
    Found by: call frame info
 2  XUL!js::TraceChildren(JSTracer*, void*, JSGCTraceKind) [Marking.cpp : 345 + 0xa]
    rbx = 0x0000000000000005   r12 = 0x00007fff5fbf8c98
    r13 = 0x000000000000000d   r14 = 0x0000000113ba29c0
    r15 = 0x00007fff5fbfcce0   rip = 0x0000000103a34daa
    rsp = 0x00007fff5fbf8b90   rbp = 0x00007fff5fbf8bc0
    Found by: call frame info
 3  XUL!IncrementalCollectSlice [jsgc.cpp : 3317 + 0x9]
    rbx = 0x0000000000000005   r12 = 0x00007fff5fbf8c98
    r13 = 0x000000000000000d   r14 = 0x00007fff5fbfcce0
    r15 = 0x000000012dbcde10   rip = 0x000000010382b3c7
    rsp = 0x00007fff5fbf8bd0   rbp = 0x00007fff5fbfce10
    Found by: call frame info
 4  XUL!GCCycle [jsgc.cpp : 4583 + 0x10]
    rbx = 0x000000010559a000   r12 = 0x0000000000002710
    r13 = 0x0000000000000000   r14 = 0x000000010559a3f8
    r15 = 0x000000010559a000   rip = 0x000000010382ab1e
    rsp = 0x00007fff5fbfce20   rbp = 0x00007fff5fbfce60
    Found by: call frame info
 5  XUL!Collect [jsgc.cpp : 4698 + 0x14]
    rbx = 0x000000010559a000   r12 = 0x0000000000000001
    r13 = 0x000000010559a3f8   r14 = 0x000000000000000e
    r15 = 0x0000000000000000   rip = 0x00000001038274bc
    rsp = 0x00007fff5fbfce70   rbp = 0x00007fff5fbfceb0
    Found by: call frame info
 6  XUL!nsJSContext::GarbageCollectNow(js::gcreason::Reason, nsJSContext::IsIncremental, nsJSContext::IsCompartment, nsJSContext::IsShrinking, long long) [nsJSEnvironment.cpp : 2935 + 0xa]
    rbx = 0x0000000000000000   r12 = 0x000000000000000e
    r13 = 0x0000000000000001   r14 = 0x0000000000000000
    r15 = 0x0000000000000000   rip = 0x00000001022f7daa
    rsp = 0x00007fff5fbfcec0   rbp = 0x00007fff5fbfcef0
    Found by: call frame info
Summary: regress-360969-05.js, test_hc_noderemovechild.html | Exited with code 1 during test run [@ js::gc::MarkInternal] [@ js::gc::Cell::markIfUnmarked] [@ MarkInternal<js::types::TypeObject>] → regress-360969-05.js, test_hc_noderemovechild.html, browser_tabview_apptabs.js | Exited with code 1 during test run [@ js::gc::MarkInternal] [@ js::gc::Cell::markIfUnmarked] [@ MarkInternal<js::types::TypeObject>]
Summary: regress-360969-05.js, test_hc_noderemovechild.html, browser_tabview_apptabs.js | Exited with code 1 during test run [@ js::gc::MarkInternal] [@ js::gc::Cell::markIfUnmarked] [@ MarkInternal<js::types::TypeObject>] → Intermittent crash regress-360969-05.js, test_hc_noderemovechild.html, browser_tabview_apptabs.js [@ js::gc::MarkInternal] [@ js::gc::Cell::markIfUnmarked] [@ MarkInternal<js::types::TypeObject>] [@ js::gc::MarkInternal<JSString>(JSTracer*, JSString**)]
https://tbpl.mozilla.org/php/getParsedLog.php?id=17726998&tree=Mozilla-Inbound
Summary: Intermittent crash regress-360969-05.js, test_hc_noderemovechild.html, browser_tabview_apptabs.js [@ js::gc::MarkInternal] [@ js::gc::Cell::markIfUnmarked] [@ MarkInternal<js::types::TypeObject>] [@ js::gc::MarkInternal<JSString>(JSTracer*, JSString**)] → Intermittent crash regress-360969-05.js, test_hc_noderemovechild.html, browser_tabview_apptabs.js, browser_607016.js [@ js::gc::Cell::markIfUnmarked] [@ MarkInternal<js::types::TypeObject>] [@ js::gc::MarkInternal<JSString>(JSTracer*, JSString**)]
Comment hidden (Legacy TBPL/Treeherder Robot)
Resolving WFM keyword:intermittent-failure bugs last modified >3 months ago, whose whiteboard contains none of:
{random,disabled,marked,fuzzy,todo,fails,failing,annotated,time-bomb,leave open}

There will inevitably be some false positives; for that (and the bugspam) I apologise. Filter on orangewfm.
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.