Closed Bug 931444 Opened 11 years ago Closed 9 years ago

Intermittent browser_aboutHome.js | application crashed [@ js::ShapeTable::search(jsid,bool)] after Assertion failure: entries, Assertion failure: isEmpty()

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
Windows XP
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: philor, Unassigned)

References

Details

(Keywords: assertion, crash, intermittent-failure)

https://tbpl.mozilla.org/php/getParsedLog.php?id=29710633&tree=Fx-Team Windows XP 32-bit fx-team debug test mochitest-browser-chrome on 2013-10-26 06:45:26 PDT for push 60c2fea83c0f slave: t-xp32-ix-102 06:49:12 INFO - TEST-INFO | chrome://mochitests/content/browser/browser/base/content/test/general/browser_aboutHome.js | Got snippets map: { last-update: 1382795351971, cached-version: 4 } 06:49:12 INFO - Assertion failure: entries, at c:/builds/moz2_slave/fx-team-w32-d-0000000000000000/build/js/src/vm/Shape.cpp:183 06:49:12 INFO - nsStringStats 06:49:12 INFO - => mAllocCount: 120785 06:49:12 INFO - => mReallocCount: 12573 06:49:12 INFO - => mFreeCount: 101604 -- LEAKED 19181 !!! 06:49:12 INFO - => mShareCount: 178592 06:49:12 INFO - => mAdoptCount: 8453 06:49:12 INFO - => mAdoptFreeCount: 8449 -- LEAKED 4 !!! 06:49:12 INFO - Assertion failure: isEmpty(), at c:\builds\moz2_slave\fx-team-w32-d-0000000000000000\build\obj-firefox\dist\include\mozilla/LinkedList.h:304 06:49:12 INFO - WARNING: shutting down early because of crash!: file c:/builds/moz2_slave/fx-team-w32-d-0000000000000000/build/dom/plugins/ipc/PluginModuleChild.cpp, line 697 06:49:12 INFO - WARNING: plugin process _exit()ing: file c:/builds/moz2_slave/fx-team-w32-d-0000000000000000/build/dom/plugins/ipc/PluginModuleChild.cpp, line 662 06:49:12 INFO - NPP_Destroy 06:49:12 INFO - NPP_Destroy 06:49:12 INFO - NPP_Destroy 06:49:12 INFO - NPP_Destroy 06:49:12 INFO - NPP_Destroy 06:49:12 INFO - nsStringStats 06:49:12 INFO - => mAllocCount: 109 06:49:12 INFO - => mReallocCount: 1 06:49:12 INFO - => mFreeCount: 38 -- LEAKED 71 !!! 06:49:12 INFO - => mShareCount: 135 06:49:12 INFO - => mAdoptCount: 0 06:49:12 INFO - => mAdoptFreeCount: 0 06:49:12 WARNING - TEST-UNEXPECTED-FAIL | chrome://mochitests/content/browser/browser/base/content/test/general/browser_aboutHome.js | application terminated with exit code 2147483651 06:49:12 INFO - INFO | runtests.py | Application ran for: 0:00:42.713000 06:49:12 INFO - INFO | zombiecheck | Reading PID log: c:\docume~1\cltbld~1.t-x\locals~1\temp\tmpevcojnpidlog 06:49:12 INFO - ==> process 488 launched child process 3660 ("C:\slave\test\build\application\firefox\plugin-container.exe" --channel=488.cedb3f8.1938852667 "c:\docume~1\cltbld~1.t-x\locals~1\temp\tmpkkpgxn\plugins\nptest.dll" -greomni "C:\slave\test\build\application\firefox\omni.ja" -appomni "C:\slave\test\build\application\firefox\browser\omni.ja" -appdir "C:\slave\test\build\application\firefox\browser" - 488 "\\.\pipe\gecko-crash-server-pipe.488" plugin) 06:49:12 INFO - ==> process 488 launched child process 3724 ("C:\slave\test\build\application\firefox\plugin-container.exe" --channel=488.d287fd8.1339871235 "c:\docume~1\cltbld~1.t-x\locals~1\temp\tmpkkpgxn\plugins\nptest.dll" -greomni "C:\slave\test\build\application\firefox\omni.ja" -appomni "C:\slave\test\build\application\firefox\browser\omni.ja" -appdir "C:\slave\test\build\application\firefox\browser" - 488 "\\.\pipe\gecko-crash-server-pipe.488" plugin) 06:49:19 WARNING - PROCESS-CRASH | chrome://mochitests/content/browser/browser/base/content/test/general/browser_aboutHome.js | application crashed [@ js::ShapeTable::search(jsid,bool)] 06:49:19 INFO - Crash dump filename: c:\docume~1\cltbld~1.t-x\locals~1\temp\tmpkkpgxn\minidumps\9e6a4131-509d-4135-be03-05dd23e50a29.dmp 06:49:19 INFO - Operating system: Windows NT 06:49:19 INFO - 5.1.2600 Service Pack 3 06:49:19 INFO - CPU: x86 06:49:19 INFO - GenuineIntel family 6 model 30 stepping 5 06:49:19 INFO - 8 CPUs 06:49:19 INFO - Crash reason: EXCEPTION_BREAKPOINT 06:49:19 INFO - Crash address: 0xe3c63a 06:49:19 INFO - Thread 0 (crashed) 06:49:19 INFO - 0 mozjs.dll!js::ShapeTable::search(jsid,bool) [Shape.cpp:60c2fea83c0f : 183 + 0x3f] 06:49:19 INFO - eip = 0x00e3c63a esp = 0x0012d718 ebp = 0x0012d740 ebx = 0x00000000 06:49:19 INFO - esi = 0x10261440 edi = 0x0ce929f0 eax = 0x00000000 ecx = 0x95f2f5c2 06:49:19 INFO - edx = 0x10361f48 efl = 0x00000206 06:49:19 INFO - Found by: given as instruction pointer in context 06:49:19 INFO - 1 mozjs.dll!js::Shape::search(js::ExclusiveContext *,js::Shape *,jsid,js::Shape * * *,bool) [Shape-inl.h:60c2fea83c0f : 146 + 0x15] 06:49:19 INFO - eip = 0x00e11283 esp = 0x0012d748 ebp = 0x0012d754 06:49:19 INFO - Found by: call frame info 06:49:19 INFO - 2 mozjs.dll!js::ObjectImpl::nativeLookup(js::ExclusiveContext *,jsid) [ObjectImpl.cpp:60c2fea83c0f : 323 + 0x1b] 06:49:19 INFO - eip = 0x00e119af esp = 0x0012d75c ebp = 0x0012d7a0 06:49:19 INFO - Found by: call frame info 06:49:19 INFO - 3 mozjs.dll!LookupOwnPropertyWithFlagsInline<1> [jsobj.cpp:60c2fea83c0f : 3762 + 0xd] 06:49:19 INFO - eip = 0x00d463a7 esp = 0x0012d7a8 ebp = 0x0012d7b4 06:49:19 INFO - Found by: call frame info 06:49:19 INFO - 4 mozjs.dll!LookupPropertyWithFlagsInline<1> [jsobj.cpp:60c2fea83c0f : 3836 + 0x1f] 06:49:19 INFO - eip = 0x00d464a1 esp = 0x0012d7bc ebp = 0x0012d808 06:49:19 INFO - Found by: call frame info 06:49:19 INFO - 5 mozjs.dll!GetPropertyHelperInline<1> [jsobj.cpp:60c2fea83c0f : 4199 + 0x25] 06:49:19 INFO - eip = 0x00d469ff esp = 0x0012d810 ebp = 0x0012d88c 06:49:19 INFO - Found by: call frame info 06:49:19 INFO - 6 mozjs.dll!js::baseops::GetProperty(JSContext *,JS::Handle<JSObject *>,JS::Handle<JSObject *>,JS::Handle<jsid>,JS::MutableHandle<JS::Value>) [jsobj.cpp:60c2fea83c0f : 4301 + 0x17] 06:49:19 INFO - eip = 0x00d4806b esp = 0x0012d894 ebp = 0x0012d8a4 06:49:19 INFO - Found by: call frame info 06:49:19 INFO - 7 mozjs.dll!JSObject::getGeneric(JSContext *,JS::Handle<JSObject *>,JS::Handle<JSObject *>,JS::Handle<jsid>,JS::MutableHandle<JS::Value>) [jsobj.h:60c2fea83c0f : 991 + 0x15] 06:49:19 INFO - eip = 0x00be031a esp = 0x0012d8ac ebp = 0x0012d8c4 06:49:19 INFO - Found by: call frame info 06:49:19 INFO - 8 mozjs.dll!GetPropertyOperation [Interpreter.cpp:60c2fea83c0f : 264 + 0x2a] 06:49:19 INFO - eip = 0x00dffade esp = 0x0012d8cc ebp = 0x0012d920 06:49:19 INFO - Found by: call frame info 06:49:19 INFO - 9 mozjs.dll!Interpret [Interpreter.cpp:60c2fea83c0f : 2250 + 0x20]
Two assertions failed. I talked this over with bsmedberg. Apart from multiple threads/processes, we don't know how it's possible for multiple assertions to fail in this way. Possibly something to do with static destructors being called after the first assertion called MOZ_REALLY_CRASH, because Windows. Anyway bsmedberg thinks the second assertion failure is probably less important. Btw, the lines in the log from the plugin process are irrelevant --- the plugin process is just shutting down because its parent process crashed. Stack: A timeout fires (40-27), so we call the callback, a JS function (36-33), which puts us in the interpreter (29), which calls into dispatchEvent (26-14), which calls a JS function (13-10), which runs in the interpreter, and just in the course of doing ordinary interpreter stuff (9-1), this assertion fails. I'm not seeing the clues. Not taking.
There are some recent b2g emulator mochitest intermittent crashes with the same signature as this, e.g: https://tbpl.mozilla.org/php/getParsedLog.php?id=39292278&tree=B2g-Inbound See bug 1000883 for more.
I filed bug 1008357 for the js::ShapeTable crash. From the comments here, it appears to have started around 7-May.
Inactive; closing (see bug 1180138).
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.