803018 - Intermittent crash in browser_cmd_restart.js [@ js::GCMarker::processMarkStackTop(js::SliceBudget&)]

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Ed Morley [:emorley]]

Rev4 MacOSX Snow Leopard 10.6 mozilla-central opt test mochitest-other on 2012-10-17 22:05:34 PDT for push cb573b9307e5

slave: talos-r4-snow-032

https://tbpl.mozilla.org/php/getParsedLog.php?id=16222906&tree=Firefox

{
TEST-START | chrome://mochitests/content/browser/browser/devtools/commandline/test/browser_cmd_restart.js
TEST-UNEXPECTED-FAIL | chrome://mochitests/content/browser/browser/devtools/commandline/test/browser_cmd_restart.js | Exited with code 1 during test run
INFO | automation.py | Application ran for: 0:10:01.694600
INFO | automation.py | Reading PID log: /var/folders/Hs/HsDn6a9SG8idoIya6p9mtE+++TI/-Tmp-/tmptINd3lpidlog
Downloading symbols from: http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-central-macosx64/1350534989/firefox-19.0a1.en-US.mac.crashreporter-symbols.zip
PROCESS-CRASH | chrome://mochitests/content/browser/browser/devtools/commandline/test/browser_cmd_restart.js | application crashed (minidump found)
Crash dump filename: /var/folders/Hs/HsDn6a9SG8idoIya6p9mtE+++TI/-Tmp-/tmpeva9hh/minidumps/59B6018F-415B-4B70-93F2-80D6CBA93A77.dmp
Operating system: Mac OS X
                  10.6.8 10K549
CPU: amd64
     family 6 model 23 stepping 10
     2 CPUs

Crash reason:  EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
Crash address: 0xffffffffd5dfe490

Thread 0 (crashed)
 0  XUL!js::GCMarker::processMarkStackTop(js::SliceBudget&) [Heap.h : 698 + 0x0]
    rbx = 0x00007fff5fbfcd48   r12 = 0x0000000000000000
    r13 = 0x00000001500793e0   r14 = 0x00000001500793d8
    r15 = 0x00006b07d5d8f71a   rip = 0x0000000102784a21
    rsp = 0x00007fff5fbfcca0   rbp = 0x00007fff5fbfcce0
    Found by: given as instruction pointer in context
 1  XUL!js::GCMarker::drainMarkStack(js::SliceBudget&) [Marking.cpp : 1299 + 0xa]
    rbx = 0x0000000106a9b1c8   r12 = 0x0000000000009c40
    r13 = 0x0000000106a9b2e0   r14 = 0x00007fff5fbfcd48
    r15 = 0x0000000106a9b1c8   rip = 0x0000000102782bbb
    rsp = 0x00007fff5fbfccf0   rbp = 0x00007fff5fbfcd00
    Found by: call frame info
 2  XUL!IncrementalCollectSlice [jsgc.cpp : 4283 + 0x7]
    rbx = 0x0000000106a9b000   r12 = 0x0000000000009c40
    r13 = 0x0000000106a9b2e0   r14 = 0x0000000000000000
    r15 = 0x0000000106a9b1c8   rip = 0x0000000102620bca
    rsp = 0x00007fff5fbfcd10   rbp = 0x00007fff5fbfce80
    Found by: call frame info
 3  XUL!GCCycle [jsgc.cpp : 4549 + 0x10]
    rbx = 0x000000012ca25000   r12 = 0x0000000000009c40
    r13 = 0x0000000000009c40   r14 = 0x0000000000000000
    r15 = 0x0000000106a9b000   rip = 0x000000010261fea4
    rsp = 0x00007fff5fbfce90   rbp = 0x00007fff5fbfced0
    Found by: call frame info
 4  XUL!Collect [jsgc.cpp : 4663 + 0x14]
    rbx = 0x0000000000000019   r12 = 0x0000000106a9b000
    r13 = 0x0000000106a9b2e0   r14 = 0x0000000000000001
    r15 = 0x0000000106a9b9b0   rip = 0x000000010261d71c
    rsp = 0x00007fff5fbfcee0   rbp = 0x00007fff5fbfcf20
    Found by: call frame info
 5  XUL!nsJSContext::GarbageCollectNow(js::gcreason::Reason, nsJSContext::IsIncremental, nsJSContext::IsCompartment, nsJSContext::IsShrinking, long long) [nsJSEnvironment.cpp : 2942 + 0xa]
    rbx = 0x0000000100395000   r12 = 0x0000000000000019
    r13 = 0x0000000000000001   r14 = 0x0000000000000028
    r15 = 0x0000000000000000   rip = 0x00000001016e8e9a
    rsp = 0x00007fff5fbfcf30   rbp = 0x00007fff5fbfcf70
    Found by: call frame info
 6  XUL!nsTimerImpl::Fire() [nsTimerImpl.cpp : 472 + 0x9]
    rbx = 0x0000000155bbbe20   r12 = 0x0000000000000002
    r13 = 0x0000000100328902   r14 = 0x00000001016ee390
}

Comment 1

[IU]

Attachment: stack trace

I can't provide an STR as I'm having trouble recreating the crash in a new profile, as I can't determine what unique parameter exists in my profile that is necessary for the crash.

However, I am able to reproduce consistently with my profile.

Basically I:
1. Install the Print Edit extension: https://addons.mozilla.org/en-US/firefox/addon/print-edit/
2. Click File --> Print Edit
3. Wait for the browser to crash with the subject signature.

I've reproduced this on both Windows 7 x64 and Windows 8 x64, using 32-bit Firefox.  I have not tried any other platform.

http://crash-stats.mozilla.com/report/index/bp-da0b6941-aaee-4977-aa90-fe7372121201

Comment 2

[IU]

With regards to Step 2 above, I was actually on the Firefox default browser home page when I performed the step.  Pretty much any page with content can be used.

Comment 3

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

(In reply to IU from comment #2)
> With regards to Step 2 above, I was actually on the Firefox default browser
> home page when I performed the step.  Pretty much any page with content can
> be used.

Anything you can do to figure out how to reproduce this would be very helpful. Some ideas:
1. Copy your session restore file to a new profile and see if that makes it reproduce.
2. Same for your prefs.js file.
3. Try enabling/disabling addons and plugins to find the smallest set in which it happens.

Also, if this started happening recently, it would be great to have a regression range.

Comment 4

[IU]

(In reply to Bill McCloskey (:billm) from comment #3)
> (In reply to IU from comment #2)
> > With regards to Step 2 above, I was actually on the Firefox default browser
> > home page when I performed the step.  Pretty much any page with content can
> > be used.
> 
> Anything you can do to figure out how to reproduce this would be very
> helpful. Some ideas:
> 1. Copy your session restore file to a new profile and see if that makes it
> reproduce.
> 2. Same for your prefs.js file.

I'll try those when I get a chance

> 3. Try enabling/disabling addons and plugins to find the smallest set in
> which it happens.

Already did this.  Even with everything disabled down to just Print Edit, I couldn't find what else was required.
 
> Also, if this started happening recently, it would be great to have a
> regression range.

Unfortunately, every attempt to use an older build on Windows 8 results in Firefox locking up.  I will try and see if I have better success on Windows 7.

I'll post more once I've completed more testing.

Comment 5

[IU]

Just reproduced in a Windows XP VM, so I should have more options for tracking this down.

Comment 6

[IU]

Strangely, the crash I'm experiencing matches this signature but is recent.  I managed to ping it down to the following regression range which identifies bug 790338 as the cause: http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=7e6ac3bfbae9&tochange=26172ff887ae

Should I split this off into a new bug?  I still do not yet have an STR I can provide.

Comment 7

[Ed Morley [:emorley]]

(In reply to IU from comment #6)
> Should I split this off into a new bug?  I still do not yet have an STR I
> can provide.

Please :-)

File in core::js, cc :jonco and :billm , mark as blocking bug 790338 please. Thank you for tracking this down!

Comment 8

[IU]

Comment on attachment 687354 [details]
stack trace

Filed bug 817342.  Also finally managed to determine STR.

Comment 9

[Andrew McCreight [:mccr8]]

IU's bug was really helpful, but the original random orange filed here appeared once, 3 months ago, so I'm going to mark this WFM.

Comment 10

[Legacy TBPL/Treeherder Robot]

philor
https://tbpl.mozilla.org/php/getParsedLog.php?id=21841036&tree=Mozilla-Aurora
Rev4 MacOSX Snow Leopard 10.6 mozilla-aurora opt test mochitest-browser-chrome on 2013-04-15 18:48:48
slave: talos-r4-snow-066

19:06:36  WARNING -  TEST-UNEXPECTED-FAIL | chrome://mochitests/content/browser/browser/devtools/styleinspector/test/browser_csslogic_inherited.js | Exited with code 1 during test run
19:07:06  WARNING -  PROCESS-CRASH | chrome://mochitests/content/browser/browser/devtools/styleinspector/test/browser_csslogic_inherited.js | application crashed [@ js::GCMarker::processMarkStackTop(js::SliceBudget&)]
19:07:06    ERROR - Return code: 1

Comment 11

[Legacy TBPL/Treeherder Robot]

msucan
https://tbpl.mozilla.org/php/getParsedLog.php?id=23447564&tree=Try
Rev5 MacOSX Mountain Lion 10.8 try opt test mochitest-2 on 2013-05-27 11:37:17
slave: talos-mtnlion-r5-089

11:43:43  WARNING -  TEST-UNEXPECTED-FAIL | /tests/dom/imptests/editing/conformancetest/test_runtest.html | Exited with code 1 during test run
11:44:14  WARNING -  PROCESS-CRASH | /tests/dom/imptests/editing/conformancetest/test_runtest.html | application crashed [@ js::GCMarker::processMarkStackTop(js::SliceBudget&)]
11:44:15    ERROR - Return code: 1