Closed Bug 927939 Opened 12 years ago Closed 12 years ago

GenerationalGC: Mochitest test_bug773962.xul crashes with assertion failure on IsBackgroundFinalized()

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
Linux
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla28

People

(Reporter: jonco, Assigned: jonco)

References

Details

Attachments

(2 files)

always_tenure_to_background-v0.diff
1.12 KB, patch
jonco
: review+
terrence
: checkin+
Details | Diff | Splinter Review
2 - finalize-in-background
1.29 KB, patch
terrence
: review+
Details | Diff | Splinter Review
From: https://tbpl.mozilla.org/php/getParsedLog.php?id=29201618&full=1&branch=try#error0 11:08:21 INFO - 12717 INFO TEST-START | chrome://mochitests/content/chrome/js/xpconnect/tests/chrome ... 11:08:22 INFO - [Parent 2315] WARNING: Refusing to create a location in the wrong scope because the docshell is being destroyed: file ../../../dom/base/nsDOMClassInfo.cpp, line 3804 11:08:22 INFO - [Parent 2315] WARNING: NS_ENSURE_SUCCESS(rv, DoubleWrap(cx, obj, flags)) failed with result 0x8000FFFF: file ../../../../js/xpconnect/wrappers/WrapperFactory.cpp, line 225 11:08:22 INFO - [Parent 2315] WARNING: Refusing to create a location in the wrong scope because the docshell is being destroyed: file ../../../dom/base/nsDOMClassInfo.cpp, line 3804 11:08:22 INFO - [Parent 2315] WARNING: NS_ENSURE_SUCCESS(rv, DoubleWrap(cx, obj, flags)) failed with result 0x8000FFFF: file ../../../../js/xpconnect/wrappers/WrapperFactory.cpp, line 225 11:08:22 INFO - [Parent 2315] WARNING: Refusing to create a location in the wrong scope because the docshell is being destroyed: file ../../../dom/base/nsDOMClassInfo.cpp, line 3804 11:08:22 INFO - [Parent 2315] WARNING: NS_ENSURE_SUCCESS(rv, DoubleWrap(cx, obj, flags)) failed with result 0x8000FFFF: file ../../../../js/xpconnect/wrappers/WrapperFactory.cpp, line 225 11:08:22 INFO - [Parent 2315] WARNING: Refusing to create a location in the wrong scope because the docshell is being destroyed: file ../../../dom/base/nsDOMClassInfo.cpp, line 3804 11:08:22 INFO - [Parent 2315] WARNING: NS_ENSURE_SUCCESS(rv, DoubleWrap(cx, obj, flags)) failed with result 0x8000FFFF: file ../../../../js/xpconnect/wrappers/WrapperFactory.cpp, line 225 11:08:22 INFO - Assertion failure: IsBackgroundFinalized(a->tenuredGetAllocKind()) == IsBackgroundFinalized(b->tenuredGetAllocKind()), at ../../../js/src/jsobj.cpp:2157 11:08:23 INFO - WARNING: shutting down early because of crash!: file ../../../../dom/plugins/ipc/PluginModuleChild.cpp, line 697 11:08:23 INFO - WARNING: plugin process _exit()ing: file ../../../../dom/plugins/ipc/PluginModuleChild.cpp, line 662 11:08:23 INFO - INFO | runtests.py | exit 2816 11:08:23 INFO - INFO | runtests.py | Application ran for: 0:13:03.003471 11:08:23 INFO - INFO | zombiecheck | Reading PID log: /tmp/tmpKm1NaNpidlog 11:08:23 INFO - ==> process 2315 launched child process 2369 11:08:23 INFO - ==> process 2315 launched child process 2399 11:08:23 INFO - ==> process 2315 launched child process 2408 11:08:23 INFO - ==> process 2315 launched child process 2413 11:08:23 INFO - ==> process 2315 launched child process 2417 11:08:23 INFO - ==> process 2315 launched child process 2421 11:08:23 INFO - ==> process 2315 launched child process 2427 11:08:23 INFO - INFO | zombiecheck | Checking for orphan process with PID: 2369 11:08:23 INFO - INFO | zombiecheck | Checking for orphan process with PID: 2399 11:08:23 INFO - INFO | zombiecheck | Checking for orphan process with PID: 2408 11:08:23 INFO - INFO | zombiecheck | Checking for orphan process with PID: 2413 11:08:23 INFO - INFO | zombiecheck | Checking for orphan process with PID: 2417 11:08:23 INFO - INFO | zombiecheck | Checking for orphan process with PID: 2421 11:08:23 INFO - INFO | zombiecheck | Checking for orphan process with PID: 2427 11:08:33 WARNING - PROCESS-CRASH | chrome://mochitests/content/chrome/js/xpconnect/tests/chrome/test_bug773962.xul | application crashed [@ js::detail::HashTable<js::HashMapEntry<JSObject*, unsigned long long>, js::HashMap<JSObject*, unsigned long long, js::PointerHasher<JSObject*, 3u>, js::SystemAllocPolicy>::MapHashPolicy, js::SystemAllocPolicy>::lookup(JSObject* const&, unsigned int, unsigned int) const] 11:08:33 INFO - Crash dump filename: /tmp/tmp0roQgi/minidumps/2dc2a386-5239-9d6b-7d9ab1bb-673c9cb2.dmp 11:08:33 INFO - Operating system: Linux 11:08:33 INFO - 0.0.0 Linux 3.2.0-23-generic-pae #36-Ubuntu SMP Tue Apr 10 22:19:09 UTC 2012 i686 11:08:33 INFO - CPU: x86 11:08:33 INFO - GenuineIntel family 6 model 45 stepping 7 11:08:33 INFO - 1 CPU 11:08:33 INFO - Crash reason: SIGSEGV 11:08:33 INFO - Crash address: 0x0 11:08:33 INFO - Thread 0 (crashed) 11:08:33 INFO - 0 libxul.so!js::detail::HashTable<js::HashMapEntry<JSObject*, unsigned long long>, js::HashMap<JSObject*, unsigned long long, js::PointerHasher<JSObject*, 3u>, js::SystemAllocPolicy>::MapHashPolicy, js::SystemAllocPolicy>::lookup(JSObject* const&, unsigned int, unsigned int) const [HashTable.h:c7bfbb5bf23d : 1079 + 0x19] 11:08:33 INFO - eip = 0xb44b9598 esp = 0xbf8b3a50 ebp = 0xbf8b3a88 ebx = 0xb716d8a8 11:08:33 INFO - esi = 0x09b1c8d0 edi = 0xbf8b3aec eax = 0x00000000 ecx = 0xb2f498ac 11:08:33 INFO - edx = 0x00000000 efl = 0x00210282 11:08:33 INFO - Found by: given as instruction pointer in context 11:08:33 INFO - 1 libxul.so!js::detail::HashTable<js::HashMapEntry<JSObject*, unsigned long long>, js::HashMap<JSObject*, unsigned long long, js::PointerHasher<JSObject*, 3u>, js::SystemAllocPolicy>::MapHashPolicy, js::SystemAllocPolicy>::lookup(JSObject* const&) const [HashTable.h:c7bfbb5bf23d : 1395 + 0x9] 11:08:33 INFO - eip = 0xb44b972c esp = 0xbf8b3a90 ebp = 0xbf8b3ab8 ebx = 0xb716d8a8 11:08:33 INFO - esi = 0xbf8b3aa8 edi = 0xbf8b3aec 11:08:33 INFO - Found by: call frame info 11:08:33 INFO - 2 libxul.so!mozilla::jsipc::ObjectIdCache::keyMarkCallback(JSTracer*, void*, void*) [HashTable.h:c7bfbb5bf23d : 92 + 0xe] 11:08:33 INFO - eip = 0xb44ba8bd esp = 0xbf8b3ac0 ebp = 0xbf8b3b08 ebx = 0xb716d8a8 11:08:33 INFO - esi = 0x09b1c8d0 edi = 0xbf8b3ae8 11:08:33 INFO - Found by: call frame info 11:08:33 INFO - 3 libxul.so!js::gc::StoreBuffer::CallbackRef::mark(JSTracer*) [StoreBuffer.h:c7bfbb5bf23d : 340 + 0x16] 11:08:33 INFO - eip = 0xb51e6270 esp = 0xbf8b3b10 ebp = 0xbf8b3b28 ebx = 0xb716d8a8 11:08:33 INFO - esi = 0x09aeeb50 edi = 0x09aee478 11:08:33 INFO - Found by: call frame info 11:08:33 INFO - 4 libxul.so!js::gc::StoreBuffer::GenericBuffer::mark(JSTracer*) [StoreBuffer.cpp:c7bfbb5bf23d : 184 + 0x10] 11:08:33 INFO - eip = 0xb50f4708 esp = 0xbf8b3b30 ebp = 0xbf8b3b68 ebx = 0xb716d8a8 11:08:33 INFO - esi = 0x09aeeb50 edi = 0x09aee478 11:08:33 INFO - Found by: call frame info 11:08:33 INFO - 5 libxul.so!js::Nursery::collect(JSRuntime*, JS::gcreason::Reason) [Nursery.cpp:c7bfbb5bf23d : 603 + 0x14] 11:08:33 INFO - eip = 0xb55d3f3b esp = 0xbf8b3b70 ebp = 0xbf8b3c08 ebx = 0xb716d8a8 11:08:33 INFO - esi = 0xbf8b3ba4 edi = 0x099389b0 11:08:33 INFO - Found by: call frame info 11:08:33 INFO - 6 libxul.so!js::MinorGC(JSRuntime*, JS::gcreason::Reason) [jsgc.cpp:c7bfbb5bf23d : 4769 + 0x17] 11:08:33 INFO - eip = 0xb51fc2b1 esp = 0xbf8b3c10 ebp = 0xbf8b3c28 ebx = 0xb716d8a8 11:08:33 INFO - esi = 0x09932ed8 edi = 0x099389b0 11:08:33 INFO - Found by: call frame info 11:08:33 INFO - 7 libxul.so!Collect [jsgc.cpp:c7bfbb5bf23d : 4627 + 0xb] 11:08:33 INFO - eip = 0xb521519c esp = 0xbf8b3c30 ebp = 0xbf8b3cd8 ebx = 0xb716d8a8 11:08:33 INFO - esi = 0x09932ed8 edi = 0x099389b0 11:08:33 INFO - Found by: call frame info 11:08:33 INFO - 8 libxul.so!js::GC(JSRuntime*, js::JSGCInvocationKind, JS::gcreason::Reason) [jsgc.cpp:c7bfbb5bf23d : 4694 + 0x22] 11:08:33 INFO - eip = 0xb521582b esp = 0xbf8b3ce0 ebp = 0xbf8b3cf8 ebx = 0xb716d8a8 11:08:33 INFO - esi = 0x09932ed8 edi = 0x00000033 11:08:33 INFO - Found by: call frame info 11:08:33 INFO - 9 libxul.so!JS::GCForReason(JSRuntime*, JS::gcreason::Reason) [jsfriendapi.cpp:c7bfbb5bf23d : 192 + 0x17] 11:08:33 INFO - eip = 0xb51e7aee esp = 0xbf8b3d00 ebp = 0xbf8b3d18 ebx = 0xb716d8a8 11:08:33 INFO - esi = 0x09932ed8 edi = 0x00000033 11:08:33 INFO - Found by: call frame info 11:08:33 INFO - 10 libxul.so!mozilla::CycleCollectedJSRuntime::Collect(unsigned int) const [CycleCollectedJSRuntime.cpp:c7bfbb5bf23d : 945 + 0xa] 11:08:33 INFO - eip = 0xb49c1211 esp = 0xbf8b3d20 ebp = 0xbf8b3d48 ebx = 0xb716d8a8 11:08:33 INFO - esi = 0x09932ed8 edi = 0x00000033 11:08:33 INFO - Found by: call frame info 11:08:33 INFO - 11 libxul.so!nsCycleCollector::BeginCollection(ccType, nsICycleCollectorListener*) [nsCycleCollector.cpp:c7bfbb5bf23d : 2761 + 0xf] 11:08:33 INFO - eip = 0xb49cad93 esp = 0xbf8b3d50 ebp = 0xbf8b3e08 ebx = 0xb716d8a8 11:08:33 INFO - esi = 0x09831600 edi = 0x00000000 11:08:33 INFO - Found by: call frame info 11:08:33 INFO - 12 libxul.so!nsCycleCollector::Collect(ccType, nsTArray<PtrInfo*>*, nsCycleCollectorResults*, nsICycleCollectorListener*) [nsCycleCollector.cpp:c7bfbb5bf23d : 2693 + 0xe] 11:08:33 INFO - eip = 0xb49caee4 esp = 0xbf8b3e10 ebp = 0xbf8b3e38 ebx = 0xb716d8a8 11:08:33 INFO - esi = 0x09831600 edi = 0xb5b95134 11:08:33 INFO - Found by: call frame info 11:08:33 INFO - 13 libxul.so!nsCycleCollector::ShutdownCollect() [nsCycleCollector.cpp:c7bfbb5bf23d : 2673 + 0x17] 11:08:33 INFO - eip = 0xb49cb070 esp = 0xbf8b3e40 ebp = 0xbf8b7d08 ebx = 0xb716d8a8 11:08:33 INFO - esi = 0x00000000 edi = 0xb5b95134 11:08:33 INFO - Found by: call frame info 11:08:33 INFO - 14 libxul.so!nsCycleCollector_shutdown() [nsCycleCollector.cpp:c7bfbb5bf23d : 3169 + 0x7] 11:08:33 INFO - eip = 0xb49cb139 esp = 0xbf8b7d10 ebp = 0xbf8b7d48 ebx = 0xb716d8a8 11:08:33 INFO - esi = 0x09835668 edi = 0xbf8b7d6c 11:08:33 INFO - Found by: call frame info 11:08:33 INFO - 15 libxul.so!mozilla::ShutdownXPCOM(nsIServiceManager*) [nsXPComInit.cpp:c7bfbb5bf23d : 751 + 0x4] 11:08:33 INFO - eip = 0xb49762f6 esp = 0xbf8b7d50 ebp = 0xbf8b7d98 ebx = 0xb716d8a8 11:08:34 INFO - esi = 0xbf8b7d6c edi = 0xbf8b7d6c 11:08:34 INFO - Found by: call frame info 11:08:34 INFO - 16 libxul.so!XRE_TermEmbedding [nsEmbedFunctions.cpp:c7bfbb5bf23d : 199 + 0xb] 11:08:34 INFO - eip = 0xb34414b0 esp = 0xbf8b7da0 ebp = 0xbf8b7db8 ebx = 0xb716d8a8 11:08:34 INFO - esi = 0x097af11c edi = 0xbf8b7e68 11:08:34 INFO - Found by: call frame info 11:08:34 INFO - 17 libxul.so!mozilla::ipc::ScopedXREEmbed::Stop() [ScopedXREEmbed.cpp:c7bfbb5bf23d : 110 + 0x4] 11:08:34 INFO - eip = 0xb450e5e9 esp = 0xbf8b7dc0 ebp = 0xbf8b7dc8 ebx = 0xb716d8a8 11:08:34 INFO - esi = 0x097af11c edi = 0xbf8b7e68 11:08:34 INFO - Found by: call frame info 11:08:34 INFO - 18 libxul.so!XRE_InitChildProcess [nsEmbedFunctions.cpp:c7bfbb5bf23d : 555 + 0xf] 11:08:34 INFO - eip = 0xb3442630 esp = 0xbf8b7dd0 ebp = 0xbf8b88f8 ebx = 0xb716d8a8 11:08:34 INFO - esi = 0xbf8b7e08 edi = 0xbf8b7e68 11:08:34 INFO - Found by: call frame info 11:08:34 INFO - 19 plugin-container!main [MozillaRuntimeMain.cpp:c7bfbb5bf23d : 116 + 0xa] 11:08:34 INFO - eip = 0x0804a0bb esp = 0xbf8b8900 ebp = 0xbf8b8928 ebx = 0x0805a5e4 11:08:34 INFO - esi = 0x00000009 edi = 0xbf8b89d4 11:08:34 INFO - Found by: call frame info 11:08:34 INFO - 20 libc-2.15.so + 0x194d2 11:08:34 INFO - eip = 0xb2dc04d3 esp = 0xbf8b8930 ebp = 0x00000000 11:08:34 INFO - Found by: previous frame's frame pointer 11:08:34 INFO - 21 libc-2.15.so + 0x194d2 11:08:34 INFO - eip = 0xb2dc04d3 esp = 0xbf8b8940 ebp = 0x00000000 11:08:34 INFO - Found by: stack scanning 11:08:34 INFO - 22 libc-2.15.so + 0x1a0ff3 11:08:34 INFO - eip = 0xb2f47ff4 esp = 0xbf8b8968 ebp = 0x00000000 11:08:34 INFO - Found by: stack scanning 11:08:34 INFO - 23 ld-2.15.so + 0x1469f 11:08:34 INFO - eip = 0xb772f6a0 esp = 0xbf8b8998 ebp = 0x00000000 11:08:34 INFO - Found by: stack scanning 11:08:34 INFO - 24 libc-2.15.so + 0x193e8 11:08:34 INFO - eip = 0xb2dc03e9 esp = 0xbf8b899c ebp = 0x00000000 11:08:34 INFO - Found by: stack scanning 11:08:34 INFO - 25 ld-2.15.so + 0x20ff3 11:08:34 INFO - eip = 0xb773bff4 esp = 0xbf8b89a0 ebp = 0x00000000 11:08:34 INFO - Found by: stack scanning 11:08:34 INFO - 26 plugin-container + 0x207b 11:08:34 INFO - eip = 0x0804a07c esp = 0xbf8b89b4 ebp = 0x00000000 11:08:34 INFO - Found by: stack scanning 11:08:34 INFO - 27 ld-2.15.so + 0xf26f 11:08:34 INFO - eip = 0xb772a270 esp = 0xbf8b89c8 ebp = 0x00000000 11:08:34 INFO - Found by: stack scanning 11:08:34 INFO - 28 ld-2.15.so + 0x21917 11:08:34 INFO - eip = 0xb773c918 esp = 0xbf8b89d0 ebp = 0x00000000 11:08:34 INFO - Found by: stack scanning
Assignee: nobody → terrence
I can repro this fairly reliably on the first run, even under gdb. Subsequent runs or runs with watchpoints set do not repro, sadly. My first hypothesis was that this must be caused by proxy using the virtual finalizeInBackground for creation whereas the nursery is using CanBeFinalizedInBackground when tenuring. This is dumb: we know all things in the nursery are background finalizable, so we shouldn't ever tenure into a foreground finalizable arena in any case. I've attached a patch for this issue. Sadly, this doesn't fix the problem, however. I'll keep looking.
Attachment #826121 - Flags: review?(jcoppeard)
Hey, I just saw your patch at [1] and figured it would fix this. Went to dup and found it's the same bug number. ;-) 1 - https://hg.mozilla.org/try/rev/dc50523091d8
Comment on attachment 826121 [details] [diff] [review] always_tenure_to_background-v0.diff Review of attachment 826121 [details] [diff] [review]: ----------------------------------------------------------------- Looks good! For the purposes of documentation as much as anything else, can we also assert |CanBeFinalizedInBackground(kind, obj->getClass())| ?
Attachment #826121 - Flags: review?(jcoppeard) → review+
As you saw, I had a patch for this :)
Assignee: terrence → jcoppeard
Status: NEW → ASSIGNED
Attachment #826686 - Flags: review?(terrence)
Component: JavaScript Engine → Developer Tools
Product: Core → Firefox
Oops, wrong bug...
Component: Developer Tools → JavaScript Engine
Product: Firefox → Core
Comment on attachment 826686 [details] [diff] [review] 2 - finalize-in-background Review of attachment 826686 [details] [diff] [review]: ----------------------------------------------------------------- r=me
Attachment #826686 - Flags: review?(terrence) → review+
(In reply to Jon Coppeard (:jonco) from comment #3) > Comment on attachment 826121 [details] [diff] [review] > always_tenure_to_background-v0.diff > > Review of attachment 826121 [details] [diff] [review]: > ----------------------------------------------------------------- > > Looks good! > > For the purposes of documentation as much as anything else, can we also > assert |CanBeFinalizedInBackground(kind, obj->getClass())| ? Good idea! https://hg.mozilla.org/integration/mozilla-inbound/rev/e8c9664d36d2
Attachment #826121 - Flags: checkin+
Whiteboard: [leave open
https://hg.mozilla.org/mozilla-central/rev/e8c9664d36d2
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla28
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: