Closed Bug 927939 Opened 11 years ago Closed 11 years ago

GenerationalGC: Mochitest test_bug773962.xul crashes with assertion failure on IsBackgroundFinalized()

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
Linux
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla28

People

(Reporter: jonco, Assigned: jonco)

References

Details

Attachments

(2 files)

always_tenure_to_background-v0.diff
1.12 KB, patch
jonco
: review+
terrence
: checkin+
Details | Diff | Splinter Review
2 - finalize-in-background
1.29 KB, patch
terrence
: review+
Details | Diff | Splinter Review 
From: https://tbpl.mozilla.org/php/getParsedLog.php?id=29201618&full=1&branch=try#error0

11:08:21     INFO -  12717 INFO TEST-START | chrome://mochitests/content/chrome/js/xpconnect/tests/chrome
...
11:08:22     INFO -  [Parent 2315] WARNING: Refusing to create a location in the wrong scope because the docshell is being destroyed: file ../../../dom/base/nsDOMClassInfo.cpp, line 3804
11:08:22     INFO -  [Parent 2315] WARNING: NS_ENSURE_SUCCESS(rv, DoubleWrap(cx, obj, flags)) failed with result 0x8000FFFF: file ../../../../js/xpconnect/wrappers/WrapperFactory.cpp, line 225
11:08:22     INFO -  [Parent 2315] WARNING: Refusing to create a location in the wrong scope because the docshell is being destroyed: file ../../../dom/base/nsDOMClassInfo.cpp, line 3804
11:08:22     INFO -  [Parent 2315] WARNING: NS_ENSURE_SUCCESS(rv, DoubleWrap(cx, obj, flags)) failed with result 0x8000FFFF: file ../../../../js/xpconnect/wrappers/WrapperFactory.cpp, line 225
11:08:22     INFO -  [Parent 2315] WARNING: Refusing to create a location in the wrong scope because the docshell is being destroyed: file ../../../dom/base/nsDOMClassInfo.cpp, line 3804
11:08:22     INFO -  [Parent 2315] WARNING: NS_ENSURE_SUCCESS(rv, DoubleWrap(cx, obj, flags)) failed with result 0x8000FFFF: file ../../../../js/xpconnect/wrappers/WrapperFactory.cpp, line 225
11:08:22     INFO -  [Parent 2315] WARNING: Refusing to create a location in the wrong scope because the docshell is being destroyed: file ../../../dom/base/nsDOMClassInfo.cpp, line 3804
11:08:22     INFO -  [Parent 2315] WARNING: NS_ENSURE_SUCCESS(rv, DoubleWrap(cx, obj, flags)) failed with result 0x8000FFFF: file ../../../../js/xpconnect/wrappers/WrapperFactory.cpp, line 225
11:08:22     INFO -  Assertion failure: IsBackgroundFinalized(a->tenuredGetAllocKind()) == IsBackgroundFinalized(b->tenuredGetAllocKind()), at ../../../js/src/jsobj.cpp:2157
11:08:23     INFO -  WARNING: shutting down early because of crash!: file ../../../../dom/plugins/ipc/PluginModuleChild.cpp, line 697
11:08:23     INFO -  WARNING: plugin process _exit()ing: file ../../../../dom/plugins/ipc/PluginModuleChild.cpp, line 662
11:08:23     INFO -  INFO | runtests.py | exit 2816
11:08:23     INFO -  INFO | runtests.py | Application ran for: 0:13:03.003471
11:08:23     INFO -  INFO | zombiecheck | Reading PID log: /tmp/tmpKm1NaNpidlog
11:08:23     INFO -  ==> process 2315 launched child process 2369
11:08:23     INFO -  ==> process 2315 launched child process 2399
11:08:23     INFO -  ==> process 2315 launched child process 2408
11:08:23     INFO -  ==> process 2315 launched child process 2413
11:08:23     INFO -  ==> process 2315 launched child process 2417
11:08:23     INFO -  ==> process 2315 launched child process 2421
11:08:23     INFO -  ==> process 2315 launched child process 2427
11:08:23     INFO -  INFO | zombiecheck | Checking for orphan process with PID: 2369
11:08:23     INFO -  INFO | zombiecheck | Checking for orphan process with PID: 2399
11:08:23     INFO -  INFO | zombiecheck | Checking for orphan process with PID: 2408
11:08:23     INFO -  INFO | zombiecheck | Checking for orphan process with PID: 2413
11:08:23     INFO -  INFO | zombiecheck | Checking for orphan process with PID: 2417
11:08:23     INFO -  INFO | zombiecheck | Checking for orphan process with PID: 2421
11:08:23     INFO -  INFO | zombiecheck | Checking for orphan process with PID: 2427
11:08:33  WARNING -  PROCESS-CRASH | chrome://mochitests/content/chrome/js/xpconnect/tests/chrome/test_bug773962.xul | application crashed [@ js::detail::HashTable<js::HashMapEntry<JSObject*, unsigned long long>, js::HashMap<JSObject*, unsigned long long, js::PointerHasher<JSObject*, 3u>, js::SystemAllocPolicy>::MapHashPolicy, js::SystemAllocPolicy>::lookup(JSObject* const&, unsigned int, unsigned int) const]
11:08:33     INFO -  Crash dump filename: /tmp/tmp0roQgi/minidumps/2dc2a386-5239-9d6b-7d9ab1bb-673c9cb2.dmp
11:08:33     INFO -  Operating system: Linux
11:08:33     INFO -                    0.0.0 Linux 3.2.0-23-generic-pae #36-Ubuntu SMP Tue Apr 10 22:19:09 UTC 2012 i686
11:08:33     INFO -  CPU: x86
11:08:33     INFO -       GenuineIntel family 6 model 45 stepping 7
11:08:33     INFO -       1 CPU
11:08:33     INFO -  Crash reason:  SIGSEGV
11:08:33     INFO -  Crash address: 0x0
11:08:33     INFO -  Thread 0 (crashed)
11:08:33     INFO -   0  libxul.so!js::detail::HashTable<js::HashMapEntry<JSObject*, unsigned long long>, js::HashMap<JSObject*, unsigned long long, js::PointerHasher<JSObject*, 3u>, js::SystemAllocPolicy>::MapHashPolicy, js::SystemAllocPolicy>::lookup(JSObject* const&, unsigned int, unsigned int) const [HashTable.h:c7bfbb5bf23d : 1079 + 0x19]
11:08:33     INFO -      eip = 0xb44b9598   esp = 0xbf8b3a50   ebp = 0xbf8b3a88   ebx = 0xb716d8a8
11:08:33     INFO -      esi = 0x09b1c8d0   edi = 0xbf8b3aec   eax = 0x00000000   ecx = 0xb2f498ac
11:08:33     INFO -      edx = 0x00000000   efl = 0x00210282
11:08:33     INFO -      Found by: given as instruction pointer in context
11:08:33     INFO -   1  libxul.so!js::detail::HashTable<js::HashMapEntry<JSObject*, unsigned long long>, js::HashMap<JSObject*, unsigned long long, js::PointerHasher<JSObject*, 3u>, js::SystemAllocPolicy>::MapHashPolicy, js::SystemAllocPolicy>::lookup(JSObject* const&) const [HashTable.h:c7bfbb5bf23d : 1395 + 0x9]
11:08:33     INFO -      eip = 0xb44b972c   esp = 0xbf8b3a90   ebp = 0xbf8b3ab8   ebx = 0xb716d8a8
11:08:33     INFO -      esi = 0xbf8b3aa8   edi = 0xbf8b3aec
11:08:33     INFO -      Found by: call frame info
11:08:33     INFO -   2  libxul.so!mozilla::jsipc::ObjectIdCache::keyMarkCallback(JSTracer*, void*, void*) [HashTable.h:c7bfbb5bf23d : 92 + 0xe]
11:08:33     INFO -      eip = 0xb44ba8bd   esp = 0xbf8b3ac0   ebp = 0xbf8b3b08   ebx = 0xb716d8a8
11:08:33     INFO -      esi = 0x09b1c8d0   edi = 0xbf8b3ae8
11:08:33     INFO -      Found by: call frame info
11:08:33     INFO -   3  libxul.so!js::gc::StoreBuffer::CallbackRef::mark(JSTracer*) [StoreBuffer.h:c7bfbb5bf23d : 340 + 0x16]
11:08:33     INFO -      eip = 0xb51e6270   esp = 0xbf8b3b10   ebp = 0xbf8b3b28   ebx = 0xb716d8a8
11:08:33     INFO -      esi = 0x09aeeb50   edi = 0x09aee478
11:08:33     INFO -      Found by: call frame info
11:08:33     INFO -   4  libxul.so!js::gc::StoreBuffer::GenericBuffer::mark(JSTracer*) [StoreBuffer.cpp:c7bfbb5bf23d : 184 + 0x10]
11:08:33     INFO -      eip = 0xb50f4708   esp = 0xbf8b3b30   ebp = 0xbf8b3b68   ebx = 0xb716d8a8
11:08:33     INFO -      esi = 0x09aeeb50   edi = 0x09aee478
11:08:33     INFO -      Found by: call frame info
11:08:33     INFO -   5  libxul.so!js::Nursery::collect(JSRuntime*, JS::gcreason::Reason) [Nursery.cpp:c7bfbb5bf23d : 603 + 0x14]
11:08:33     INFO -      eip = 0xb55d3f3b   esp = 0xbf8b3b70   ebp = 0xbf8b3c08   ebx = 0xb716d8a8
11:08:33     INFO -      esi = 0xbf8b3ba4   edi = 0x099389b0
11:08:33     INFO -      Found by: call frame info
11:08:33     INFO -   6  libxul.so!js::MinorGC(JSRuntime*, JS::gcreason::Reason) [jsgc.cpp:c7bfbb5bf23d : 4769 + 0x17]
11:08:33     INFO -      eip = 0xb51fc2b1   esp = 0xbf8b3c10   ebp = 0xbf8b3c28   ebx = 0xb716d8a8
11:08:33     INFO -      esi = 0x09932ed8   edi = 0x099389b0
11:08:33     INFO -      Found by: call frame info
11:08:33     INFO -   7  libxul.so!Collect [jsgc.cpp:c7bfbb5bf23d : 4627 + 0xb]
11:08:33     INFO -      eip = 0xb521519c   esp = 0xbf8b3c30   ebp = 0xbf8b3cd8   ebx = 0xb716d8a8
11:08:33     INFO -      esi = 0x09932ed8   edi = 0x099389b0
11:08:33     INFO -      Found by: call frame info
11:08:33     INFO -   8  libxul.so!js::GC(JSRuntime*, js::JSGCInvocationKind, JS::gcreason::Reason) [jsgc.cpp:c7bfbb5bf23d : 4694 + 0x22]
11:08:33     INFO -      eip = 0xb521582b   esp = 0xbf8b3ce0   ebp = 0xbf8b3cf8   ebx = 0xb716d8a8
11:08:33     INFO -      esi = 0x09932ed8   edi = 0x00000033
11:08:33     INFO -      Found by: call frame info
11:08:33     INFO -   9  libxul.so!JS::GCForReason(JSRuntime*, JS::gcreason::Reason) [jsfriendapi.cpp:c7bfbb5bf23d : 192 + 0x17]
11:08:33     INFO -      eip = 0xb51e7aee   esp = 0xbf8b3d00   ebp = 0xbf8b3d18   ebx = 0xb716d8a8
11:08:33     INFO -      esi = 0x09932ed8   edi = 0x00000033
11:08:33     INFO -      Found by: call frame info
11:08:33     INFO -  10  libxul.so!mozilla::CycleCollectedJSRuntime::Collect(unsigned int) const [CycleCollectedJSRuntime.cpp:c7bfbb5bf23d : 945 + 0xa]
11:08:33     INFO -      eip = 0xb49c1211   esp = 0xbf8b3d20   ebp = 0xbf8b3d48   ebx = 0xb716d8a8
11:08:33     INFO -      esi = 0x09932ed8   edi = 0x00000033
11:08:33     INFO -      Found by: call frame info
11:08:33     INFO -  11  libxul.so!nsCycleCollector::BeginCollection(ccType, nsICycleCollectorListener*) [nsCycleCollector.cpp:c7bfbb5bf23d : 2761 + 0xf]
11:08:33     INFO -      eip = 0xb49cad93   esp = 0xbf8b3d50   ebp = 0xbf8b3e08   ebx = 0xb716d8a8
11:08:33     INFO -      esi = 0x09831600   edi = 0x00000000
11:08:33     INFO -      Found by: call frame info
11:08:33     INFO -  12  libxul.so!nsCycleCollector::Collect(ccType, nsTArray<PtrInfo*>*, nsCycleCollectorResults*, nsICycleCollectorListener*) [nsCycleCollector.cpp:c7bfbb5bf23d : 2693 + 0xe]
11:08:33     INFO -      eip = 0xb49caee4   esp = 0xbf8b3e10   ebp = 0xbf8b3e38   ebx = 0xb716d8a8
11:08:33     INFO -      esi = 0x09831600   edi = 0xb5b95134
11:08:33     INFO -      Found by: call frame info
11:08:33     INFO -  13  libxul.so!nsCycleCollector::ShutdownCollect() [nsCycleCollector.cpp:c7bfbb5bf23d : 2673 + 0x17]
11:08:33     INFO -      eip = 0xb49cb070   esp = 0xbf8b3e40   ebp = 0xbf8b7d08   ebx = 0xb716d8a8
11:08:33     INFO -      esi = 0x00000000   edi = 0xb5b95134
11:08:33     INFO -      Found by: call frame info
11:08:33     INFO -  14  libxul.so!nsCycleCollector_shutdown() [nsCycleCollector.cpp:c7bfbb5bf23d : 3169 + 0x7]
11:08:33     INFO -      eip = 0xb49cb139   esp = 0xbf8b7d10   ebp = 0xbf8b7d48   ebx = 0xb716d8a8
11:08:33     INFO -      esi = 0x09835668   edi = 0xbf8b7d6c
11:08:33     INFO -      Found by: call frame info
11:08:33     INFO -  15  libxul.so!mozilla::ShutdownXPCOM(nsIServiceManager*) [nsXPComInit.cpp:c7bfbb5bf23d : 751 + 0x4]
11:08:33     INFO -      eip = 0xb49762f6   esp = 0xbf8b7d50   ebp = 0xbf8b7d98   ebx = 0xb716d8a8
11:08:34     INFO -      esi = 0xbf8b7d6c   edi = 0xbf8b7d6c
11:08:34     INFO -      Found by: call frame info
11:08:34     INFO -  16  libxul.so!XRE_TermEmbedding [nsEmbedFunctions.cpp:c7bfbb5bf23d : 199 + 0xb]
11:08:34     INFO -      eip = 0xb34414b0   esp = 0xbf8b7da0   ebp = 0xbf8b7db8   ebx = 0xb716d8a8
11:08:34     INFO -      esi = 0x097af11c   edi = 0xbf8b7e68
11:08:34     INFO -      Found by: call frame info
11:08:34     INFO -  17  libxul.so!mozilla::ipc::ScopedXREEmbed::Stop() [ScopedXREEmbed.cpp:c7bfbb5bf23d : 110 + 0x4]
11:08:34     INFO -      eip = 0xb450e5e9   esp = 0xbf8b7dc0   ebp = 0xbf8b7dc8   ebx = 0xb716d8a8
11:08:34     INFO -      esi = 0x097af11c   edi = 0xbf8b7e68
11:08:34     INFO -      Found by: call frame info
11:08:34     INFO -  18  libxul.so!XRE_InitChildProcess [nsEmbedFunctions.cpp:c7bfbb5bf23d : 555 + 0xf]
11:08:34     INFO -      eip = 0xb3442630   esp = 0xbf8b7dd0   ebp = 0xbf8b88f8   ebx = 0xb716d8a8
11:08:34     INFO -      esi = 0xbf8b7e08   edi = 0xbf8b7e68
11:08:34     INFO -      Found by: call frame info
11:08:34     INFO -  19  plugin-container!main [MozillaRuntimeMain.cpp:c7bfbb5bf23d : 116 + 0xa]
11:08:34     INFO -      eip = 0x0804a0bb   esp = 0xbf8b8900   ebp = 0xbf8b8928   ebx = 0x0805a5e4
11:08:34     INFO -      esi = 0x00000009   edi = 0xbf8b89d4
11:08:34     INFO -      Found by: call frame info
11:08:34     INFO -  20  libc-2.15.so + 0x194d2
11:08:34     INFO -      eip = 0xb2dc04d3   esp = 0xbf8b8930   ebp = 0x00000000
11:08:34     INFO -      Found by: previous frame's frame pointer
11:08:34     INFO -  21  libc-2.15.so + 0x194d2
11:08:34     INFO -      eip = 0xb2dc04d3   esp = 0xbf8b8940   ebp = 0x00000000
11:08:34     INFO -      Found by: stack scanning
11:08:34     INFO -  22  libc-2.15.so + 0x1a0ff3
11:08:34     INFO -      eip = 0xb2f47ff4   esp = 0xbf8b8968   ebp = 0x00000000
11:08:34     INFO -      Found by: stack scanning
11:08:34     INFO -  23  ld-2.15.so + 0x1469f
11:08:34     INFO -      eip = 0xb772f6a0   esp = 0xbf8b8998   ebp = 0x00000000
11:08:34     INFO -      Found by: stack scanning
11:08:34     INFO -  24  libc-2.15.so + 0x193e8
11:08:34     INFO -      eip = 0xb2dc03e9   esp = 0xbf8b899c   ebp = 0x00000000
11:08:34     INFO -      Found by: stack scanning
11:08:34     INFO -  25  ld-2.15.so + 0x20ff3
11:08:34     INFO -      eip = 0xb773bff4   esp = 0xbf8b89a0   ebp = 0x00000000
11:08:34     INFO -      Found by: stack scanning
11:08:34     INFO -  26  plugin-container + 0x207b
11:08:34     INFO -      eip = 0x0804a07c   esp = 0xbf8b89b4   ebp = 0x00000000
11:08:34     INFO -      Found by: stack scanning
11:08:34     INFO -  27  ld-2.15.so + 0xf26f
11:08:34     INFO -      eip = 0xb772a270   esp = 0xbf8b89c8   ebp = 0x00000000
11:08:34     INFO -      Found by: stack scanning
11:08:34     INFO -  28  ld-2.15.so + 0x21917
11:08:34     INFO -      eip = 0xb773c918   esp = 0xbf8b89d0   ebp = 0x00000000
11:08:34     INFO -      Found by: stack scanning
Assignee: nobody → terrence
I can repro this fairly reliably on the first run, even under gdb. Subsequent runs or runs with watchpoints set do not repro, sadly.

My first hypothesis was that this must be caused by proxy using the virtual finalizeInBackground for creation whereas the nursery is using CanBeFinalizedInBackground when tenuring. This is dumb: we know all things in the nursery are background finalizable, so we shouldn't ever tenure into a foreground finalizable arena in any case. I've attached a patch for this issue.

Sadly, this doesn't fix the problem, however. I'll keep looking.
Attachment #826121 - Flags: review?(jcoppeard)
Hey, I just saw your patch at [1] and figured it would fix this. Went to dup and found it's the same bug number. ;-)

1 - https://hg.mozilla.org/try/rev/dc50523091d8
Comment on attachment 826121 [details] [diff] [review]
always_tenure_to_background-v0.diff

Review of attachment 826121 [details] [diff] [review]:
-----------------------------------------------------------------

Looks good!

For the purposes of documentation as much as anything else, can we also assert |CanBeFinalizedInBackground(kind, obj->getClass())| ?
Attachment #826121 - Flags: review?(jcoppeard) → review+
As you saw, I had a patch for this :)
Assignee: terrence → jcoppeard
Status: NEW → ASSIGNED
Attachment #826686 - Flags: review?(terrence)
Component: JavaScript Engine → Developer Tools
Product: Core → Firefox
Oops, wrong bug...
Component: Developer Tools → JavaScript Engine
Product: Firefox → Core
Comment on attachment 826686 [details] [diff] [review]
2 - finalize-in-background

Review of attachment 826686 [details] [diff] [review]:
-----------------------------------------------------------------

r=me
Attachment #826686 - Flags: review?(terrence) → review+
(In reply to Jon Coppeard (:jonco) from comment #3)
> Comment on attachment 826121 [details] [diff] [review]
> always_tenure_to_background-v0.diff
> 
> Review of attachment 826121 [details] [diff] [review]:
> -----------------------------------------------------------------
> 
> Looks good!
> 
> For the purposes of documentation as much as anything else, can we also
> assert |CanBeFinalizedInBackground(kind, obj->getClass())| ?

Good idea!

https://hg.mozilla.org/integration/mozilla-inbound/rev/e8c9664d36d2
Attachment #826121 - Flags: checkin+
Whiteboard: [leave open
https://hg.mozilla.org/mozilla-central/rev/e8c9664d36d2
Status: ASSIGNED → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla28
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: