Closed Bug 816054 Opened 7 years ago Closed 7 years ago

Intermittent "Assertion failure: allocated(), at ../../../js/src/gc/Heap.h:589" in test_focus_doc.html [@ js::gc::ArenaHeader::getThingSize()]

Categories

(Core :: JavaScript Engine, defect, critical)

x86_64
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla20

People

(Reporter: emorley, Assigned: jonco)

Details

(Keywords: assertion, intermittent-failure, Whiteboard: [js:p2])

Crash Data

Attachments

(1 file)

Rev3 Fedora 12x64 mozilla-inbound debug test mochitest-other on 2012-11-27 19:53:32 PST for push 109e402b0b24

slave: talos-r3-fed64-063

https://tbpl.mozilla.org/php/getParsedLog.php?id=17396714&tree=Mozilla-Inbound

{
4368 INFO TEST-PASS | chrome://mochitests/content/a11y/accessible/events/test_focus_doc.html | test with ID = '['input@id="input" node', address: [object HTMLInputElement], role: entry, address: 0x4f74a80] focus' failed. No focus event.
4369 INFO TEST-PASS | chrome://mochitests/content/a11y/accessible/events/test_focus_doc.html | test with ID = '['input@id="input" node', address: [object HTMLInputElement], role: entry, address: 0x4f74a80] focus' failed. There is unexpected focus event.
4370 INFO TEST-INFO | chrome://mochitests/content/a11y/accessible/events/test_focus_doc.html | Invoke the '['document node', address: [object HTMLDocument], role: document, name: 'data:text/html,<html><input%20id='input'></html>', address: 0x498c1c8] 'tab shift ' key' test { expected 'focus' event; unexpected 'focus' event;  }
4371 INFO TEST-PASS | chrome://mochitests/content/a11y/accessible/events/test_focus_doc.html | wrong state bits for ['document node', address: [object HTMLDocument], role: document, name: 'data:text/html,<html><input%20id='input'></html>', address: 0x498c1c8]!
4372 INFO TEST-PASS | chrome://mochitests/content/a11y/accessible/events/test_focus_doc.html | Focussed ['document node', address: [object HTMLDocument], role: document, name: 'data:text/html,<html><input%20id='input'></html>', address: 0x498c1c8] must be focusable!
Assertion failure: allocated(), at ../../../js/src/gc/Heap.h:589
WARNING: shutting down early because of crash!: file ../../../../dom/plugins/ipc/PluginModuleChild.cpp, line 704
WARNING: plugin process _exit()ing: file ../../../../dom/plugins/ipc/PluginModuleChild.cpp, line 669
TEST-UNEXPECTED-FAIL | chrome://mochitests/content/a11y/accessible/events/test_focus_doc.html | Exited with code 11 during test run
INFO | automation.py | Application ran for: 0:01:37.727874
INFO | automation.py | Reading PID log: /tmp/tmpNPf20-pidlog
==> process 2633 launched child process 2701
INFO | automation.py | Checking for orphan process with PID: 2701
Downloading symbols from: http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-inbound-linux64-debug/1354071333/firefox-20.0a1.en-US.linux-x86_64.crashreporter-symbols.zip
PROCESS-CRASH | chrome://mochitests/content/a11y/accessible/events/test_focus_doc.html | application crashed (minidump found)
Crash dump filename: /tmp/tmp9i3nCS/minidumps/0566c8ad-2030-6f80-30289e66-5776fa70.dmp
Operating system: Linux
                  0.0.0 Linux 2.6.31.5-127.fc12.x86_64 #1 SMP Sat Nov 7 21:11:14 EST 2009 x86_64
CPU: amd64
     family 6 model 23 stepping 10
     2 CPUs

Crash reason:  SIGSEGV
Crash address: 0x0

Thread 0 (crashed)
 0  libxul.so!js::gc::ArenaHeader::getThingSize() const [Heap.h : 589 + 0x18]
    rbx = 0x00007fa242a71020   r12 = 0x0000000000000001
    r13 = 0x00007fff729146c0   r14 = 0xfffa7fffffffffff
    r15 = 0x00007fff729146f0   rip = 0x00007fa29a92bd8d
    rsp = 0x00007fff72914650   rbp = 0x00007fff72914650
    Found by: given as instruction pointer in context
 1  libxul.so!js::gc::Cell::isMarked(unsigned int) const [Heap.h : 937 + 0x4]
    rbx = 0x00007fa242a71020   r12 = 0x0000000000000001
    r13 = 0x00007fff729146c0   r14 = 0xfffa7fffffffffff
    r15 = 0x00007fff729146f0   rip = 0x00007fa29a97af5c
    rsp = 0x00007fff72914660   rbp = 0x00007fff72914670
    Found by: call frame info
 2  libxul.so!EndMarkingCompartmentGroup [jsgc.cpp : 4009 + 0xc]
    rbx = 0x0000000005bec6f0   r12 = 0x00007fa242a71020
    r13 = 0x00007fff729146c0   r14 = 0xfffa7fffffffffff
    r15 = 0x00007fff729146f0   rip = 0x00007fa29a99c0b3
    rsp = 0x00007fff72914680   rbp = 0x00007fff72914730
    Found by: call frame info
 3  libxul.so!IncrementalCollectSlice [jsgc.cpp : 4206 + 0x7]
    rbx = 0x0000000001fbdc40   r12 = 0x0000000004cf2710
    r13 = 0x00007fa29bd48c40   r14 = 0x00007fa29b1e7d28
    r15 = 0x00007fff72914820   rip = 0x00007fa29a9a10c8
    rsp = 0x00007fff72914740   rbp = 0x00007fff72914890
    Found by: call frame info
 4  libxul.so!GCCycle [jsgc.cpp : 4816 + 0x10]
    rbx = 0x0000000001fbdc40   r12 = 0x0000000000009c40
    r13 = 0x0000000000000019   r14 = 0x0000000000000000
    r15 = 0x00007fff729148b0   rip = 0x00007fa29a9a2758
    rsp = 0x00007fff729148a0   rbp = 0x00007fff729148f0
    Found by: call frame info
 5  libxul.so!Collect [jsgc.cpp : 4931 + 0x10]
    rbx = 0x0000000001fbdc40   r12 = 0x0000000000000019
    r13 = 0x0000000000000000   r14 = 0x0000000001fbe038
    r15 = 0x0000000000009c40   rip = 0x00007fa29a9a2c7f
    rsp = 0x00007fff72914900   rbp = 0x00007fff72914940
    Found by: call frame info
 6  libxul.so!nsJSContext::GarbageCollectNow(js::gcreason::Reason, nsJSContext::IsIncremental, nsJSContext::IsCompartment, nsJSContext::IsShrinking, long) [nsJSEnvironment.cpp : 2939 + 0x9]
    rbx = 0x0000000000000019   r12 = 0x0000000000000000
    r13 = 0x0000000000000000   r14 = 0x0000000000000028
}
(In reply to Ed Morley [:edmorley, UTC, email: emorley@moco] from comment #2)
> https://tbpl.mozilla.org/php/getParsedLog.php?id=17396714&tree=Mozilla-
> Inbound

Sorry this log is a dupe of comment 0; the UI hadn't refreshed yet.
This is failing in the same place as bug 815999, except this is finding either a wrapper that's not a markable thing or wrapped thing that is NULL.
Patch makes JSCompartment::crossCompartmentWrappers private to ensures we assert the sanity of all wrappers added.

This won't fix the problem but it should help track down where the dodgy wrapper is coming from.
Attachment #687110 - Flags: review?(wmccloskey)
Assignee: general → jcoppeard
Whiteboard: [js:p2]
Comment on attachment 687110 [details] [diff] [review]
Assert wrappers are sensible when added to compartment map

Review of attachment 687110 [details] [diff] [review]:
-----------------------------------------------------------------

Thanks, this is great.

::: js/src/jscompartment.cpp
@@ +226,5 @@
>      return true;
>  }
>  
>  bool
> +JSCompartment::putWrapper(const CrossCompartmentKey& wrapped, const js::Value& wrapper)

Ampersands go after the spaces.
Attachment #687110 - Flags: review?(wmccloskey) → review+
https://hg.mozilla.org/mozilla-central/rev/9d0e73213774
Status: NEW → RESOLVED
Closed: 7 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla20
You need to log in before you can comment on or make changes to this bug.