934430 - GenerationalGC: mochitest browser_disablechrome.js crashes [@ js::CurrentThreadCanAccessZone(JS::Zone*)]

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Jon Coppeard (:jonco)]

In GGC browser builds, seen on MacOSX 10.8

Full log: https://tbpl.mozilla.org/php/getParsedLog.php?id=29996666&full=1&branch=try

16:00:04  WARNING -  TEST-UNEXPECTED-FAIL | chrome://mochitests/content/browser/browser/base/content/test/general/browser_disablechrome.js | application terminated with exit code 256
16:00:04     INFO -  INFO | runtests.py | Application ran for: 0:06:38.097952
16:00:04     INFO -  INFO | zombiecheck | Reading PID log: /var/folders/k1/llk26x893t14rvtt5b6c5rf000000w/T/tmprvjaWipidlog
16:00:17  WARNING -  PROCESS-CRASH | chrome://mochitests/content/browser/browser/base/content/test/general/browser_disablechrome.js | application crashed [@ js::CurrentThreadCanAccessZone(JS::Zone*)]
16:00:17     INFO -  Crash dump filename: /var/folders/k1/llk26x893t14rvtt5b6c5rf000000w/T/tmpf2yjPw/minidumps/8BB60F21-10DC-4046-A1FB-4A19342AF74A.dmp
16:00:17     INFO -  Operating system: Mac OS X
16:00:17     INFO -                    10.8.0 12A269
16:00:17     INFO -  CPU: amd64
16:00:17     INFO -       family 6 model 42 stepping 7
16:00:17     INFO -       8 CPUs
16:00:17     INFO -  Crash reason:  EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
16:00:17     INFO -  Crash address: 0x0
16:00:17     INFO -  Thread 0 (crashed)
16:00:17     INFO -   0  XUL!js::CurrentThreadCanAccessZone(JS::Zone*) [Runtime.h:64651a1a79ca : 593 + 0x7]
16:00:17     INFO -      rbx = 0x0000000000000000   r12 = 0x000000010401a826
16:00:17     INFO -      r13 = 0x000000015cfb0000   r14 = 0x0000000000000000
16:00:17     INFO -      r15 = 0x00007fff5fbf7f00   rip = 0x00000001038681ca
16:00:17     INFO -      rsp = 0x00007fff5fbf7d80   rbp = 0x00007fff5fbf7d90
16:00:17     INFO -      Found by: given as instruction pointer in context
16:00:17     INFO -   1  XUL!js::gc::Cell::tenuredZone() const [Heap.h:64651a1a79ca : 1021 + 0x7]
16:00:17     INFO -      rbx = 0x0000000106d93400   r12 = 0x000000010401a826
16:00:17     INFO -      r13 = 0x000000015cfb0000   r14 = 0x0000000000000000
16:00:17     INFO -      r15 = 0x00007fff5fbf7f00   rip = 0x00000001036f670a
16:00:17     INFO -      rsp = 0x00007fff5fbf7da0   rbp = 0x00007fff5fbf7db0
16:00:17     INFO -      Found by: call frame info
16:00:17     INFO -   2  XUL!MarkInternal<JSObject> [Barrier.h:64651a1a79ca : 153 + 0x4]
16:00:17     INFO -      rbx = 0x000000015df36fd0   r12 = 0x000000010401a826
16:00:17     INFO -      r13 = 0x000000015cfb0000   r14 = 0x00007fff5fbf7f00
16:00:17     INFO -      r15 = 0x00007fff5fbf7f00   rip = 0x0000000103660577
16:00:17     INFO -      rsp = 0x00007fff5fbf7dc0   rbp = 0x00007fff5fbf7e00
16:00:17     INFO -      Found by: call frame info
16:00:17     INFO -   3  XUL!MarkValueInternal [Marking.cpp:64651a1a79ca : 528 + 0x7]
16:00:17     INFO -      rbx = 0x000000015df36fd0   r12 = 0x000000010401a826
16:00:17     INFO -      r13 = 0x00007fff5fbf7e40   r14 = 0x00007fff5fbf7f00
16:00:17     INFO -      r15 = 0x00007fff5fbf7f00   rip = 0x00000001036688e0
16:00:17     INFO -      rsp = 0x00007fff5fbf7e10   rbp = 0x00007fff5fbf7e30
16:00:17     INFO -      Found by: call frame info
16:00:17     INFO -   4  XUL!js::gc::StoreBuffer::MonoTypeBuffer<js::gc::StoreBuffer::ValueEdge>::mark(JSTracer*) [StoreBuffer.cpp:64651a1a79ca : 201 + 0xd]
16:00:17     INFO -      rbx = 0x00000001600b8a20   r12 = 0x000000010401a826
16:00:17     INFO -      r13 = 0x00007fff5fbf7e40   r14 = 0x0000000107136b08
16:00:17     INFO -      r15 = 0x00007fff5fbf7f00   rip = 0x000000010367a44a
16:00:17     INFO -      rsp = 0x00007fff5fbf7e40   rbp = 0x00007fff5fbf7e80
16:00:17     INFO -      Found by: call frame info

Comment 1

[Jon Coppeard (:jonco)]

This has stopped happening in recent try runs.