Closed Bug 816054 Opened 13 years ago Closed 13 years ago

Intermittent "Assertion failure: allocated(), at ../../../js/src/gc/Heap.h:589" in test_focus_doc.html [@ js::gc::ArenaHeader::getThingSize()]

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86_64
Linux
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla20

People

(Reporter: emorley, Assigned: jonco)

Details

(Keywords: assertion, intermittent-failure, Whiteboard: [js:p2])

Crash Data

Attachments

(1 file)

Assert wrappers are sensible when added to compartment map
24.66 KB, patch
billm
: review+
Details | Diff | Splinter Review
Rev3 Fedora 12x64 mozilla-inbound debug test mochitest-other on 2012-11-27 19:53:32 PST for push 109e402b0b24 slave: talos-r3-fed64-063 https://tbpl.mozilla.org/php/getParsedLog.php?id=17396714&tree=Mozilla-Inbound { 4368 INFO TEST-PASS | chrome://mochitests/content/a11y/accessible/events/test_focus_doc.html | test with ID = '['input@id="input" node', address: [object HTMLInputElement], role: entry, address: 0x4f74a80] focus' failed. No focus event. 4369 INFO TEST-PASS | chrome://mochitests/content/a11y/accessible/events/test_focus_doc.html | test with ID = '['input@id="input" node', address: [object HTMLInputElement], role: entry, address: 0x4f74a80] focus' failed. There is unexpected focus event. 4370 INFO TEST-INFO | chrome://mochitests/content/a11y/accessible/events/test_focus_doc.html | Invoke the '['document node', address: [object HTMLDocument], role: document, name: 'data:text/html,<html><input%20id='input'></html>', address: 0x498c1c8] 'tab shift ' key' test { expected 'focus' event; unexpected 'focus' event; } 4371 INFO TEST-PASS | chrome://mochitests/content/a11y/accessible/events/test_focus_doc.html | wrong state bits for ['document node', address: [object HTMLDocument], role: document, name: 'data:text/html,<html><input%20id='input'></html>', address: 0x498c1c8]! 4372 INFO TEST-PASS | chrome://mochitests/content/a11y/accessible/events/test_focus_doc.html | Focussed ['document node', address: [object HTMLDocument], role: document, name: 'data:text/html,<html><input%20id='input'></html>', address: 0x498c1c8] must be focusable! Assertion failure: allocated(), at ../../../js/src/gc/Heap.h:589 WARNING: shutting down early because of crash!: file ../../../../dom/plugins/ipc/PluginModuleChild.cpp, line 704 WARNING: plugin process _exit()ing: file ../../../../dom/plugins/ipc/PluginModuleChild.cpp, line 669 TEST-UNEXPECTED-FAIL | chrome://mochitests/content/a11y/accessible/events/test_focus_doc.html | Exited with code 11 during test run INFO | automation.py | Application ran for: 0:01:37.727874 INFO | automation.py | Reading PID log: /tmp/tmpNPf20-pidlog ==> process 2633 launched child process 2701 INFO | automation.py | Checking for orphan process with PID: 2701 Downloading symbols from: http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-inbound-linux64-debug/1354071333/firefox-20.0a1.en-US.linux-x86_64.crashreporter-symbols.zip PROCESS-CRASH | chrome://mochitests/content/a11y/accessible/events/test_focus_doc.html | application crashed (minidump found) Crash dump filename: /tmp/tmp9i3nCS/minidumps/0566c8ad-2030-6f80-30289e66-5776fa70.dmp Operating system: Linux 0.0.0 Linux 2.6.31.5-127.fc12.x86_64 #1 SMP Sat Nov 7 21:11:14 EST 2009 x86_64 CPU: amd64 family 6 model 23 stepping 10 2 CPUs Crash reason: SIGSEGV Crash address: 0x0 Thread 0 (crashed) 0 libxul.so!js::gc::ArenaHeader::getThingSize() const [Heap.h : 589 + 0x18] rbx = 0x00007fa242a71020 r12 = 0x0000000000000001 r13 = 0x00007fff729146c0 r14 = 0xfffa7fffffffffff r15 = 0x00007fff729146f0 rip = 0x00007fa29a92bd8d rsp = 0x00007fff72914650 rbp = 0x00007fff72914650 Found by: given as instruction pointer in context 1 libxul.so!js::gc::Cell::isMarked(unsigned int) const [Heap.h : 937 + 0x4] rbx = 0x00007fa242a71020 r12 = 0x0000000000000001 r13 = 0x00007fff729146c0 r14 = 0xfffa7fffffffffff r15 = 0x00007fff729146f0 rip = 0x00007fa29a97af5c rsp = 0x00007fff72914660 rbp = 0x00007fff72914670 Found by: call frame info 2 libxul.so!EndMarkingCompartmentGroup [jsgc.cpp : 4009 + 0xc] rbx = 0x0000000005bec6f0 r12 = 0x00007fa242a71020 r13 = 0x00007fff729146c0 r14 = 0xfffa7fffffffffff r15 = 0x00007fff729146f0 rip = 0x00007fa29a99c0b3 rsp = 0x00007fff72914680 rbp = 0x00007fff72914730 Found by: call frame info 3 libxul.so!IncrementalCollectSlice [jsgc.cpp : 4206 + 0x7] rbx = 0x0000000001fbdc40 r12 = 0x0000000004cf2710 r13 = 0x00007fa29bd48c40 r14 = 0x00007fa29b1e7d28 r15 = 0x00007fff72914820 rip = 0x00007fa29a9a10c8 rsp = 0x00007fff72914740 rbp = 0x00007fff72914890 Found by: call frame info 4 libxul.so!GCCycle [jsgc.cpp : 4816 + 0x10] rbx = 0x0000000001fbdc40 r12 = 0x0000000000009c40 r13 = 0x0000000000000019 r14 = 0x0000000000000000 r15 = 0x00007fff729148b0 rip = 0x00007fa29a9a2758 rsp = 0x00007fff729148a0 rbp = 0x00007fff729148f0 Found by: call frame info 5 libxul.so!Collect [jsgc.cpp : 4931 + 0x10] rbx = 0x0000000001fbdc40 r12 = 0x0000000000000019 r13 = 0x0000000000000000 r14 = 0x0000000001fbe038 r15 = 0x0000000000009c40 rip = 0x00007fa29a9a2c7f rsp = 0x00007fff72914900 rbp = 0x00007fff72914940 Found by: call frame info 6 libxul.so!nsJSContext::GarbageCollectNow(js::gcreason::Reason, nsJSContext::IsIncremental, nsJSContext::IsCompartment, nsJSContext::IsShrinking, long) [nsJSEnvironment.cpp : 2939 + 0x9] rbx = 0x0000000000000019 r12 = 0x0000000000000000 r13 = 0x0000000000000000 r14 = 0x0000000000000028 }
(In reply to Ed Morley [:edmorley, UTC, email: emorley@moco] from comment #2) > https://tbpl.mozilla.org/php/getParsedLog.php?id=17396714&tree=Mozilla- > Inbound Sorry this log is a dupe of comment 0; the UI hadn't refreshed yet.
This is failing in the same place as bug 815999, except this is finding either a wrapper that's not a markable thing or wrapped thing that is NULL.
Patch makes JSCompartment::crossCompartmentWrappers private to ensures we assert the sanity of all wrappers added. This won't fix the problem but it should help track down where the dodgy wrapper is coming from.
Attachment #687110 - Flags: review?(wmccloskey)
Assignee: general → jcoppeard
Whiteboard: [js:p2]
Comment on attachment 687110 [details] [diff] [review] Assert wrappers are sensible when added to compartment map Review of attachment 687110 [details] [diff] [review]: ----------------------------------------------------------------- Thanks, this is great. ::: js/src/jscompartment.cpp @@ +226,5 @@ > return true; > } > > bool > +JSCompartment::putWrapper(const CrossCompartmentKey& wrapped, const js::Value& wrapper) Ampersands go after the spaces.
Attachment #687110 - Flags: review?(wmccloskey) → review+
https://hg.mozilla.org/mozilla-central/rev/9d0e73213774
Status: NEW → RESOLVED
Closed: 13 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla20
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: