816046 - Intermittent "Assertion failure: key.kind != CrossCompartmentKey::StringWrapper, at ../../../js/src/jscompartment.cpp:710" in browser_InlineSpellChecker.js, browser_bug295977_autoscroll_overflow.js [@ JSCompartment::sweepCrossCompartmentWrappers()]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Ed Morley [:emorley]]

Rev4 MacOSX Lion 10.7 mozilla-inbound debug test mochitest-browser-chrome on 2012-11-27 18:46:39 PST for push a2ee1d41edff

slave: talos-r4-lion-078

https://tbpl.mozilla.org/php/getParsedLog.php?id=17395300&tree=Mozilla-Inbound

{
TEST-PASS | chrome://mochitests/content/browser/toolkit/content/tests/browser/browser_InlineSpellChecker.js | 'en-x-ignore' should display as 'English'
TEST-PASS | chrome://mochitests/content/browser/toolkit/content/tests/browser/browser_InlineSpellChecker.js | 'en-x-ignore-this' should display as 'English'
TEST-PASS | chrome://mochitests/content/browser/toolkit/content/tests/browser/browser_InlineSpellChecker.js | 'en-x-ignore-this-subtag' should display as 'English'
TEST-KNOWN-FAIL | chrome://mochitests/content/browser/toolkit/content/tests/browser/browser_InlineSpellChecker.js | 'en-Cyrl-t-en-latn-m0-ungegn-2007-x-ignore-this-subtag' should display as 'English / Cyrillic'
INFO TEST-END | chrome://mochitests/content/browser/toolkit/content/tests/browser/browser_InlineSpellChecker.js | finished in 81ms
TEST-INFO | checking window state
Assertion failure: key.kind != CrossCompartmentKey::StringWrapper, at ../../../js/src/jscompartment.cpp:710
TEST-UNEXPECTED-FAIL | chrome://mochitests/content/browser/toolkit/content/tests/browser/browser_InlineSpellChecker.js | Exited with code 1 during test run
INFO | automation.py | Application ran for: 0:53:20.861355
INFO | automation.py | Reading PID log: /var/folders/qd/srwd5f710sj0fcl9z464lkj00000gn/T/tmpX_zxqJpidlog
Downloading symbols from: http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-inbound-macosx64-debug/1354068813/firefox-20.0a1.en-US.mac64.crashreporter-symbols.zip
PROCESS-CRASH | chrome://mochitests/content/browser/toolkit/content/tests/browser/browser_InlineSpellChecker.js | application crashed (minidump found)
Crash dump filename: /var/folders/qd/srwd5f710sj0fcl9z464lkj00000gn/T/tmpHcS8AF/minidumps/75636F79-7E1E-4BF6-9A94-3D8B8FCB5E51.dmp
Operating system: Mac OS X
                  10.7.2 11C74
CPU: amd64
     family 6 model 23 stepping 10
     2 CPUs

Crash reason:  EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
Crash address: 0x0

Thread 0 (crashed)
 0  XUL!JSCompartment::sweepCrossCompartmentWrappers() [HashTable.h : 1223 + 0x0]
    rbx = 0x00007fff748e9630   r12 = 0x000000010d28cd00
    r13 = 0x00007fff5fbfcdf8   r14 = 0x00007fff5fbfce28
    r15 = 0x00007fff5fbfce20   rip = 0x0000000102ff2dec
    rsp = 0x00007fff5fbfcdd0   rbp = 0x00007fff5fbfce70
    Found by: given as instruction pointer in context
 1  XUL!JSCompartment::sweep(js::FreeOp*, bool) [jscompartment.cpp : 594 + 0x7]
    rbx = 0x00007fff5fbfcfb8   r12 = 0x0000000000000000
    r13 = 0x00000001052e7000   r14 = 0x0004cf85f0ff48a6
    r15 = 0x00000001062f63f8   rip = 0x0000000102ff26b9
    rsp = 0x00007fff5fbfce80   rbp = 0x00007fff5fbfcf80
    Found by: call frame info
 2  XUL!BeginSweepingCompartmentGroup [jsgc.cpp : 4068 + 0xe]
    rbx = 0x00000001052e7000   r12 = 0x0000000000000000
    r13 = 0x00000001062f63f8   r14 = 0x0004cf85f0ff48a6
    r15 = 0x0000000000000196   rip = 0x000000010302ea08
    rsp = 0x00007fff5fbfcf90   rbp = 0x00007fff5fbfcff0
    Found by: call frame info
 3  XUL!IncrementalCollectSlice [jsgc.cpp : 4207 + 0x7]
    rbx = 0x00007fff5fbfd108   r12 = 0x00000001062f6000
    r13 = 0x0000000103883c20   r14 = 0x00007fff5fbfd040
    r15 = 0x00000001062f6000   rip = 0x000000010302b5ac
    rsp = 0x00007fff5fbfd000   rbp = 0x00007fff5fbfd180
    Found by: call frame info
 4  XUL!GCCycle [jsgc.cpp : 4816 + 0x10]
    rbx = 0x00000001062f6001   r12 = 0x0000000000009c40
    r13 = 0x0000000000000000   r14 = 0x00000001062f63f8
    r15 = 0x00000001062f6000   rip = 0x000000010302a9de
    rsp = 0x00007fff5fbfd190   rbp = 0x00007fff5fbfd1d0
    Found by: call frame info
 5  XUL!Collect [jsgc.cpp : 4931 + 0x14]
    rbx = 0x00000001062f6000   r12 = 0x0000000000000001
    r13 = 0x00000001062f63f8   r14 = 0x0000000000000019
    r15 = 0x0000000000000000   rip = 0x000000010302739c
    rsp = 0x00007fff5fbfd1e0   rbp = 0x00007fff5fbfd220
    Found by: call frame info
 6  XUL!nsJSContext::GarbageCollectNow(js::gcreason::Reason, nsJSContext::IsIncremental, nsJSContext::IsCompartment, nsJSContext::IsShrinking, long long) [nsJSEnvironment.cpp : 2939 + 0xa]
    rbx = 0x0000000000000000   r12 = 0x0000000000000019
    r13 = 0x0000000000000001   r14 = 0x0000000000000028
}

Comment 1

[Ed Morley [:emorley]]

https://tbpl.mozilla.org/php/getParsedLog.php?id=17397474&tree=Mozilla-Inbound

Comment 2

[Ed Morley [:emorley]]

https://tbpl.mozilla.org/php/getParsedLog.php?id=17407043&tree=Mozilla-Inbound

Comment 3

[Legacy TBPL/Treeherder Robot]

edmorley
https://tbpl.mozilla.org/php/getParsedLog.php?id=17411542&tree=Mozilla-Inbound
Rev4 MacOSX Lion 10.7 mozilla-inbound debug test mochitest-browser-chrome on 2012-11-28 05:37:56
slave: talos-r4-lion-074

Assertion failure: key.kind != CrossCompartmentKey::StringWrapper, at ../../../js/src/jscompartment.cpp:710
TEST-UNEXPECTED-FAIL | chrome://mochitests/content/browser/services/aitc/tests/browser_id_simple.js | Exited with code 1 during test run
PROCESS-CRASH | chrome://mochitests/content/browser/services/aitc/tests/browser_id_simple.js | application crashed (minidump found)
Thread 0 (crashed)
TEST-UNEXPECTED-FAIL | automationutils.processLeakLog() | missing output line for total leaks!

Comment 4

[Jon Coppeard (:jonco)]

Attachment: Possible fix

When a string in a compartment that is currently being marked is wrapped, mark the string to prevent it being finalized in this collection.

Comment 5

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Comment on attachment 686116 [details] [diff] [review]
Possible fix

Looks good with the assertion about not moving.

Comment 6

[Jon Coppeard (:jonco)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/b2175d0f4770

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/b2175d0f4770