Intermittent crash in browser_cmd_restart.js [@ js::GCMarker::processMarkStackTop(js::SliceBudget&)]

RESOLVED WORKSFORME

Status

()

Core
JavaScript Engine
--
critical
RESOLVED WORKSFORME
6 years ago
5 years ago

People

(Reporter: emorley, Unassigned)

Tracking

(Depends on: 1 bug, {crash, intermittent-failure})

Trunk
crash, intermittent-failure
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(1 obsolete attachment)

(Reporter)

Description

6 years ago
Rev4 MacOSX Snow Leopard 10.6 mozilla-central opt test mochitest-other on 2012-10-17 22:05:34 PDT for push cb573b9307e5

slave: talos-r4-snow-032

https://tbpl.mozilla.org/php/getParsedLog.php?id=16222906&tree=Firefox

{
TEST-START | chrome://mochitests/content/browser/browser/devtools/commandline/test/browser_cmd_restart.js
TEST-UNEXPECTED-FAIL | chrome://mochitests/content/browser/browser/devtools/commandline/test/browser_cmd_restart.js | Exited with code 1 during test run
INFO | automation.py | Application ran for: 0:10:01.694600
INFO | automation.py | Reading PID log: /var/folders/Hs/HsDn6a9SG8idoIya6p9mtE+++TI/-Tmp-/tmptINd3lpidlog
Downloading symbols from: http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-central-macosx64/1350534989/firefox-19.0a1.en-US.mac.crashreporter-symbols.zip
PROCESS-CRASH | chrome://mochitests/content/browser/browser/devtools/commandline/test/browser_cmd_restart.js | application crashed (minidump found)
Crash dump filename: /var/folders/Hs/HsDn6a9SG8idoIya6p9mtE+++TI/-Tmp-/tmpeva9hh/minidumps/59B6018F-415B-4B70-93F2-80D6CBA93A77.dmp
Operating system: Mac OS X
                  10.6.8 10K549
CPU: amd64
     family 6 model 23 stepping 10
     2 CPUs

Crash reason:  EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
Crash address: 0xffffffffd5dfe490

Thread 0 (crashed)
 0  XUL!js::GCMarker::processMarkStackTop(js::SliceBudget&) [Heap.h : 698 + 0x0]
    rbx = 0x00007fff5fbfcd48   r12 = 0x0000000000000000
    r13 = 0x00000001500793e0   r14 = 0x00000001500793d8
    r15 = 0x00006b07d5d8f71a   rip = 0x0000000102784a21
    rsp = 0x00007fff5fbfcca0   rbp = 0x00007fff5fbfcce0
    Found by: given as instruction pointer in context
 1  XUL!js::GCMarker::drainMarkStack(js::SliceBudget&) [Marking.cpp : 1299 + 0xa]
    rbx = 0x0000000106a9b1c8   r12 = 0x0000000000009c40
    r13 = 0x0000000106a9b2e0   r14 = 0x00007fff5fbfcd48
    r15 = 0x0000000106a9b1c8   rip = 0x0000000102782bbb
    rsp = 0x00007fff5fbfccf0   rbp = 0x00007fff5fbfcd00
    Found by: call frame info
 2  XUL!IncrementalCollectSlice [jsgc.cpp : 4283 + 0x7]
    rbx = 0x0000000106a9b000   r12 = 0x0000000000009c40
    r13 = 0x0000000106a9b2e0   r14 = 0x0000000000000000
    r15 = 0x0000000106a9b1c8   rip = 0x0000000102620bca
    rsp = 0x00007fff5fbfcd10   rbp = 0x00007fff5fbfce80
    Found by: call frame info
 3  XUL!GCCycle [jsgc.cpp : 4549 + 0x10]
    rbx = 0x000000012ca25000   r12 = 0x0000000000009c40
    r13 = 0x0000000000009c40   r14 = 0x0000000000000000
    r15 = 0x0000000106a9b000   rip = 0x000000010261fea4
    rsp = 0x00007fff5fbfce90   rbp = 0x00007fff5fbfced0
    Found by: call frame info
 4  XUL!Collect [jsgc.cpp : 4663 + 0x14]
    rbx = 0x0000000000000019   r12 = 0x0000000106a9b000
    r13 = 0x0000000106a9b2e0   r14 = 0x0000000000000001
    r15 = 0x0000000106a9b9b0   rip = 0x000000010261d71c
    rsp = 0x00007fff5fbfcee0   rbp = 0x00007fff5fbfcf20
    Found by: call frame info
 5  XUL!nsJSContext::GarbageCollectNow(js::gcreason::Reason, nsJSContext::IsIncremental, nsJSContext::IsCompartment, nsJSContext::IsShrinking, long long) [nsJSEnvironment.cpp : 2942 + 0xa]
    rbx = 0x0000000100395000   r12 = 0x0000000000000019
    r13 = 0x0000000000000001   r14 = 0x0000000000000028
    r15 = 0x0000000000000000   rip = 0x00000001016e8e9a
    rsp = 0x00007fff5fbfcf30   rbp = 0x00007fff5fbfcf70
    Found by: call frame info
 6  XUL!nsTimerImpl::Fire() [nsTimerImpl.cpp : 472 + 0x9]
    rbx = 0x0000000155bbbe20   r12 = 0x0000000000000002
    r13 = 0x0000000100328902   r14 = 0x00000001016ee390
}
Keywords: intermittent-failure
Whiteboard: [orange]

Comment 1

6 years ago
Created attachment 687354 [details]
stack trace

I can't provide an STR as I'm having trouble recreating the crash in a new profile, as I can't determine what unique parameter exists in my profile that is necessary for the crash.

However, I am able to reproduce consistently with my profile.

Basically I:
1. Install the Print Edit extension: https://addons.mozilla.org/en-US/firefox/addon/print-edit/
2. Click File --> Print Edit
3. Wait for the browser to crash with the subject signature.

I've reproduced this on both Windows 7 x64 and Windows 8 x64, using 32-bit Firefox.  I have not tried any other platform.

http://crash-stats.mozilla.com/report/index/bp-da0b6941-aaee-4977-aa90-fe7372121201

Comment 2

6 years ago
With regards to Step 2 above, I was actually on the Firefox default browser home page when I performed the step.  Pretty much any page with content can be used.
OS: Mac OS X → All
(In reply to IU from comment #2)
> With regards to Step 2 above, I was actually on the Firefox default browser
> home page when I performed the step.  Pretty much any page with content can
> be used.

Anything you can do to figure out how to reproduce this would be very helpful. Some ideas:
1. Copy your session restore file to a new profile and see if that makes it reproduce.
2. Same for your prefs.js file.
3. Try enabling/disabling addons and plugins to find the smallest set in which it happens.

Also, if this started happening recently, it would be great to have a regression range.

Comment 4

6 years ago
(In reply to Bill McCloskey (:billm) from comment #3)
> (In reply to IU from comment #2)
> > With regards to Step 2 above, I was actually on the Firefox default browser
> > home page when I performed the step.  Pretty much any page with content can
> > be used.
> 
> Anything you can do to figure out how to reproduce this would be very
> helpful. Some ideas:
> 1. Copy your session restore file to a new profile and see if that makes it
> reproduce.
> 2. Same for your prefs.js file.

I'll try those when I get a chance

> 3. Try enabling/disabling addons and plugins to find the smallest set in
> which it happens.

Already did this.  Even with everything disabled down to just Print Edit, I couldn't find what else was required.
 
> Also, if this started happening recently, it would be great to have a
> regression range.

Unfortunately, every attempt to use an older build on Windows 8 results in Firefox locking up.  I will try and see if I have better success on Windows 7.

I'll post more once I've completed more testing.

Comment 5

6 years ago
Just reproduced in a Windows XP VM, so I should have more options for tracking this down.
Hardware: x86_64 → All

Comment 6

6 years ago
Strangely, the crash I'm experiencing matches this signature but is recent.  I managed to ping it down to the following regression range which identifies bug 790338 as the cause: http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=7e6ac3bfbae9&tochange=26172ff887ae

Should I split this off into a new bug?  I still do not yet have an STR I can provide.
(Reporter)

Comment 7

6 years ago
(In reply to IU from comment #6)
> Should I split this off into a new bug?  I still do not yet have an STR I
> can provide.

Please :-)

File in core::js, cc :jonco and :billm , mark as blocking bug 790338 please. Thank you for tracking this down!

Comment 8

6 years ago
Comment on attachment 687354 [details]
stack trace

Filed bug 817342.  Also finally managed to determine STR.
Attachment #687354 - Attachment is obsolete: true
IU's bug was really helpful, but the original random orange filed here appeared once, 3 months ago, so I'm going to mark this WFM.
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → WORKSFORME
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
You need to log in before you can comment on or make changes to this bug.