Closed
Bug 852912
Opened 11 years ago
Closed 11 years ago
Intermittent Windows ecma_5/JSON/parse-array-gc.js | application crashed [@ MarkValueInternal]
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
mozilla22
People
(Reporter: emorley, Assigned: billm)
References
Details
(Keywords: crash, intermittent-failure)
Crash Data
Attachments
(1 file)
971 bytes,
patch
|
bhackett1024
:
review+
|
Details | Diff | Splinter Review |
Rev3 WINNT 6.2 mozilla-inbound debug test jsreftest on 2013-03-19 16:01:14 PDT for push d72d29f6a92c slave: t-w864-ix-087 https://tbpl.mozilla.org/php/getParsedLog.php?id=20849257&tree=Mozilla-Inbound { 16:13:11 INFO - --DOMWINDOW == 99 (0E5777C0) [serial = 1970] [outer = 00000000] [url = data:text/html;charset=UTF-8,%3C%21%2D%2DCLEAR%2D%2D%3E] 16:13:11 INFO - --DOMWINDOW == 98 (0E576680) [serial = 1969] [outer = 00000000] [url = file:///C:/slave/test/build/tests/jsreftest/tests/jsreftest.html?test=ecma_3/String/15.5.4.11.js] 16:13:11 INFO - --DOMWINDOW == 97 (0E574628) [serial = 1968] [outer = 00000000] [url = data:text/html;charset=UTF-8,%3C%21%2D%2DCLEAR%2D%2D%3E] 16:13:11 INFO - --DOMWINDOW == 96 (0E576230) [serial = 1967] [outer = 00000000] [url = file:///C:/slave/test/build/tests/jsreftest/tests/jsreftest.html?test=ecma_3/Statements/switch-002.js] 16:13:11 INFO - --DOMWINDOW == 95 (0E5750F0) [serial = 1966] [outer = 00000000] [url = data:text/html;charset=UTF-8,%3C%21%2D%2DCLEAR%2D%2D%3E] 16:13:15 WARNING - TEST-UNEXPECTED-FAIL | file:///C:/slave/test/build/tests/jsreftest/tests/jsreftest.html?test=ecma_5/JSON/parse-array-gc.js | Exited with code -1073741819 during test run 16:13:15 INFO - INFO | automation.py | Application ran for: 0:07:26.338000 16:13:15 INFO - INFO | automation.py | Reading PID log: c:\users\cltbld~1.t-w\appdata\local\temp\tmpxke5htpidlog 16:13:21 INFO - PROCESS-CRASH | file:///C:/slave/test/build/tests/jsreftest/tests/jsreftest.html?test=ecma_5/JSON/parse-array-gc.js | application crashed [@ MarkValueInternal] 16:13:21 INFO - Crash dump filename: c:\users\cltbld~1.t-w\appdata\local\temp\tmpytn8gv\minidumps\9d10bd17-defe-4fe1-bde4-46ac7eecc464.dmp 16:13:21 INFO - Operating system: Windows NT 16:13:21 INFO - 6.2.9200 16:13:21 INFO - CPU: x86 16:13:21 INFO - GenuineIntel family 6 model 30 stepping 5 16:13:21 INFO - 8 CPUs 16:13:21 INFO - Crash reason: EXCEPTION_ACCESS_VIOLATION_READ 16:13:21 INFO - Crash address: 0x0 16:13:21 INFO - Thread 0 (crashed) 16:13:21 INFO - 0 mozjs.dll!MarkValueInternal [Marking.cpp:d72d29f6a92c : 471 + 0x0] 16:13:21 INFO - eip = 0x73378146 esp = 0x00adc794 ebp = 0x00adc7a4 ebx = 0x00000000 16:13:21 INFO - esi = 0x00000000 edi = 0x03bb5fec eax = 0x00000001 ecx = 0x737f4034 16:13:21 INFO - edx = 0x03bb5fec efl = 0x00010202 16:13:21 INFO - Found by: given as instruction pointer in context 16:13:21 INFO - 1 mozjs.dll!js::gc::MarkValueRootRange(JSTracer *,unsigned int,JS::Value *,char const *) [Marking.cpp:d72d29f6a92c : 550 + 0x12] 16:13:21 INFO - eip = 0x73378777 esp = 0x00adc7ac ebp = 0x00adc7bc 16:13:21 INFO - Found by: call frame info 16:13:21 INFO - 2 mozjs.dll!JS::AutoGCRooter::trace(JSTracer *) [RootMarking.cpp:d72d29f6a92c : 632 + 0x15] 16:13:21 INFO - eip = 0x733514b3 esp = 0x00adc7c4 ebp = 0x00adc824 16:13:21 INFO - Found by: call frame info 16:13:21 INFO - 3 mozjs.dll!js::gc::MarkRuntime(JSTracer *,bool) [RootMarking.cpp:d72d29f6a92c : 687 + 0x1c] 16:13:21 INFO - eip = 0x733519ac esp = 0x00adc82c ebp = 0x00adc8f4 16:13:21 INFO - Found by: call frame info 16:13:21 INFO - 4 mozjs.dll!BeginMarkPhase [jsgc.cpp:d72d29f6a92c : 2873 + 0xf] 16:13:21 INFO - eip = 0x73029c3f esp = 0x00adc8fc ebp = 0x00adc9f0 16:13:21 INFO - Found by: call frame info 16:13:21 INFO - 5 mozjs.dll!IncrementalCollectSlice [jsgc.cpp:d72d29f6a92c : 4285 + 0x6] 16:13:21 INFO - eip = 0x73033ed4 esp = 0x00adc9f8 ebp = 0x00adca34 16:13:21 INFO - Found by: call frame info 16:13:21 INFO - 6 mozjs.dll!GCCycle [jsgc.cpp:d72d29f6a92c : 4463 + 0xe] 16:13:21 INFO - eip = 0x7303545c esp = 0x00adca3c ebp = 0x00adca78 16:13:21 INFO - Found by: call frame info 16:13:21 INFO - 7 mozjs.dll!Collect [jsgc.cpp:d72d29f6a92c : 4591 + 0x20] 16:13:21 INFO - eip = 0x730358f9 esp = 0x00adca80 ebp = 0x00adcb10 16:13:21 INFO - Found by: call frame info 16:13:21 INFO - 8 mozjs.dll!js::gc::RunDebugGC(JSContext *) [jsgc.cpp:d72d29f6a92c : 4797 + 0x13] 16:13:21 INFO - eip = 0x73035d6a esp = 0x00adcb18 ebp = 0x00adcb34 16:13:21 INFO - Found by: call frame info 16:13:21 INFO - 9 mozjs.dll!js::gc::NewGCThing<js::Shape,1>(JSContext *,js::gc::AllocKind,unsigned int,js::gc::InitialHeap) [jsgcinlines.h:d72d29f6a92c : 490 + 0x5] }
Reporter | ||
Comment 1•11 years ago
|
||
https://tbpl.mozilla.org/php/getParsedLog.php?id=20850277&tree=Mozilla-Inbound https://tbpl.mozilla.org/php/getParsedLog.php?id=20853517&tree=Mozilla-Inbound https://tbpl.mozilla.org/php/getParsedLog.php?id=20855108&tree=Mozilla-Inbound https://tbpl.mozilla.org/php/getParsedLog.php?id=20859823&tree=Mozilla-Inbound https://tbpl.mozilla.org/php/getParsedLog.php?id=20862845&tree=Mozilla-Inbound https://tbpl.mozilla.org/php/getParsedLog.php?id=20866356&tree=Mozilla-Inbound https://tbpl.mozilla.org/php/getParsedLog.php?id=20867930&tree=Mozilla-Inbound
Reporter | ||
Comment 2•11 years ago
|
||
Before https://tbpl.mozilla.org/?tree=Mozilla-Inbound&jobname=Rev3%20WINNT%206.2%20mozilla-inbound%20debug%20test%20jsreftest&rev=41789248e1e6 we had ~15 greens in a row; after it's crashing ~1 in 3 runs. Jeff, which needs backing out?
Comment 3•11 years ago
|
||
This is almost certainly bug 852563, but that is adding a needed fix and shouldn't be backed out. parse-array-gc.js is added by that bug and could be removed itself I guess.
Comment hidden (Legacy TBPL/Treeherder Robot) |
Comment hidden (Legacy TBPL/Treeherder Robot) |
Comment hidden (Legacy TBPL/Treeherder Robot) |
Comment hidden (Legacy TBPL/Treeherder Robot) |
Comment hidden (Legacy TBPL/Treeherder Robot) |
Comment hidden (Legacy TBPL/Treeherder Robot) |
Assignee | ||
Comment 11•11 years ago
|
||
We saw a bunch of crashes like this on ARM in February, but then they mysteriously stopped. It does seem like a compiler issue, but it could still be our fault.
Comment hidden (Legacy TBPL/Treeherder Robot) |
Comment hidden (Legacy TBPL/Treeherder Robot) |
Comment hidden (Legacy TBPL/Treeherder Robot) |
Comment hidden (Legacy TBPL/Treeherder Robot) |
Comment hidden (Legacy TBPL/Treeherder Robot) |
Comment hidden (Legacy TBPL/Treeherder Robot) |
Comment hidden (Legacy TBPL/Treeherder Robot) |
Comment hidden (Legacy TBPL/Treeherder Robot) |
Comment hidden (Legacy TBPL/Treeherder Robot) |
Comment hidden (Legacy TBPL/Treeherder Robot) |
Comment 22•11 years ago
|
||
Give WinXP enough opportunities to fail, and it will do so.
Summary: Intermittent Windows 8 ecma_5/JSON/parse-array-gc.js | application crashed [@ MarkValueInternal] → Intermittent Windows ecma_5/JSON/parse-array-gc.js | application crashed [@ MarkValueInternal]
Comment hidden (Legacy TBPL/Treeherder Robot) |
Assignee | ||
Comment 24•11 years ago
|
||
The stack for this crash looks like this: mozjs.dll!js::gc::MarkValueRootRange(JSTracer *,unsigned int,JS::Value *,char const *) [Marking.cpp:d72d29f6a92c : 550 + 0x12] mozjs.dll!JS::AutoGCRooter::trace(JSTracer *) [RootMarking.cpp:d72d29f6a92c : 632 + 0x15] ... mozjs.dll!JS_NewArrayObject(JSContext *,int,JS::Value *) [jsapi.cpp:d72d29f6a92c : 4677 + 0xb] xul.dll!nsFrameMessageManager::SendSyncMessage(nsAString_internal const &,JS::Value const &,JSContext *,unsigned char,JS::Value *) [nsFrameMessageManager.cpp:d72d29f6a92c : 383 + 0xb] If you look at nsFrameMessageManager::SendSyncMessage, it passes NULL for the Value* argument to JS_NewArrayObject. That seems to be an okay thing for that function since it explicitly checks for NULL. However, it also tries to root the array, which is wrong if it's NULL. As far as I can tell, this has been a longstanding (though rare) NULL crash. It seems like the easiest fix is to NULL check the array during root marking.
Assignee: general → wmccloskey
Status: NEW → ASSIGNED
Attachment #727410 -
Flags: review?(bhackett1024)
Assignee | ||
Comment 25•11 years ago
|
||
RyanVM said he already disabled the test, so we need to re-enable it when this problem is fixed.
Comment 26•11 years ago
|
||
Comment on attachment 727410 [details] [diff] [review] patch Review of attachment 727410 [details] [diff] [review]: ----------------------------------------------------------------- Ack, I should have looked more closely at the stack trace. ::: js/src/gc/RootMarking.cpp @@ +627,5 @@ > return; > } > > JS_ASSERT(tag_ >= 0); > + if (static_cast<AutoArrayRooter *>(this)->array) { Maybe add a temp to avoid the duplicate static_cast?
Attachment #727410 -
Flags: review?(bhackett1024) → review+
Comment hidden (Legacy TBPL/Treeherder Robot) |
Comment hidden (Legacy TBPL/Treeherder Robot) |
Comment hidden (Legacy TBPL/Treeherder Robot) |
Comment hidden (Legacy TBPL/Treeherder Robot) |
Comment hidden (Legacy TBPL/Treeherder Robot) |
Comment 32•11 years ago
|
||
Disabled on all Windows debug builds. Bill, make sure to take the [leave open] off when your push your fix. https://hg.mozilla.org/integration/mozilla-inbound/rev/65bbddd22ef0
Whiteboard: [leave open]
Comment hidden (Legacy TBPL/Treeherder Robot) |
Comment hidden (Legacy TBPL/Treeherder Robot) |
Comment hidden (Legacy TBPL/Treeherder Robot) |
Comment hidden (Legacy TBPL/Treeherder Robot) |
Comment hidden (Legacy TBPL/Treeherder Robot) |
Comment hidden (Legacy TBPL/Treeherder Robot) |
Reporter | ||
Comment 39•11 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/c87a88a0591d https://hg.mozilla.org/mozilla-central/rev/603217b33196 https://hg.mozilla.org/mozilla-central/rev/65bbddd22ef0
Assignee | ||
Comment 40•11 years ago
|
||
I looked more closely at those Android crashes, and it looks like the same problem. It was harder to see in those stacks because they had a lot more junk in them. I'll land this whenever the tree reopens.
Assignee | ||
Comment 41•11 years ago
|
||
https://hg.mozilla.org/integration/mozilla-inbound/rev/d3f79c7dc180
Whiteboard: [leave open]
Updated•11 years ago
|
Flags: needinfo?(jwalden+bmo)
Reporter | ||
Comment 42•11 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/d3f79c7dc180
Status: ASSIGNED → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla22
You need to log in
before you can comment on or make changes to this bug.
Description
•