934435 - GenerationalGC: mochitest browser_offlineQuotaNotification.js crashes [@ JS::Value::toGCThing() const]

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Jon Coppeard (:jonco)]

In GGC browser builds, on MacOSX.

Full log here: https://tbpl.mozilla.org/php/getParsedLog.php?id=29997000&full=1&branch=try#error1

16:07:27     INFO -  OpenGL version detected: 210
16:07:27     INFO -  WARNING: depth_texture marked as unsupported: file ../../../gfx/gl/GLContextFeatures.cpp, line 412
16:07:27     INFO -  WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80040111: file ../../../../content/events/src/nsContentEventHandler.cpp, line 94
16:07:27     INFO -  Assertion failure: (ptrBits & 0x7) == 0, at ../../../dist/include/js/Value.h:774
16:07:27     INFO -  WARNING: shutting down early because of crash!: file ../../../../dom/plugins/ipc/PluginModuleChild.cpp, line 697
16:07:27     INFO -  WARNING: plugin process _exit()ing: file ../../../../dom/plugins/ipc/PluginModuleChild.cpp, line 662
16:07:27  WARNING -  TEST-UNEXPECTED-FAIL | chrome://mochitests/content/browser/browser/base/content/test/general/browser_offlineQuotaNotification.js | application terminated with exit code 256
16:07:27     INFO -  INFO | runtests.py | Application ran for: 0:06:53.760371
16:07:27     INFO -  INFO | zombiecheck | Reading PID log: /var/folders/Rb/Rb6VE8vkHxy2HzfHy8N34++++-k/-Tmp-/tmpagRhB5pidlog
16:07:45  WARNING -  PROCESS-CRASH | chrome://mochitests/content/browser/browser/base/content/test/general/browser_offlineQuotaNotification.js | application crashed [@ JS::Value::toGCThing() const]
16:07:45     INFO -  Crash dump filename: /var/folders/Rb/Rb6VE8vkHxy2HzfHy8N34++++-k/-Tmp-/tmp5oquSI/minidumps/3024D657-762D-43AA-B69B-F675E6EF970B.dmp
16:07:45     INFO -  Operating system: Mac OS X
16:07:45     INFO -                    10.6.8 10K549
16:07:45     INFO -  CPU: amd64
16:07:45     INFO -       family 6 model 23 stepping 10
16:07:45     INFO -       2 CPUs
16:07:45     INFO -  Crash reason:  EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
16:07:45     INFO -  Crash address: 0x0
16:07:45     INFO -  Thread 0 (crashed)
16:07:45     INFO -   0  XUL!JS::Value::toGCThing() const [Value.h:64651a1a79ca : 1138 + 0x0]
16:07:45     INFO -      rbx = 0x00007fff707dd2f8   r12 = 0x000000010481a826
16:07:45     INFO -      r13 = 0x00007fff5fbfcdf0   r14 = 0x0000000100992f08
16:07:45     INFO -      r15 = 0x00007fff5fbfceb0   rip = 0x0000000102a18cbc
16:07:45     INFO -      rsp = 0x00007fff5fbfcdd0   rbp = 0x00007fff5fbfcde0
16:07:45     INFO -      Found by: given as instruction pointer in context
16:07:45     INFO -   1  XUL!js::gc::StoreBuffer::MonoTypeBuffer<js::gc::StoreBuffer::ValueEdge>::mark(JSTracer*) [StoreBuffer.h:64651a1a79ca : 259 + 0x10]
16:07:45     INFO -      rbx = 0x0000000131e90500   r12 = 0x000000010481a826
16:07:45     INFO -      r13 = 0x00007fff5fbfcdf0   r14 = 0x0000000100992f08
16:07:45     INFO -      r15 = 0x00007fff5fbfceb0   rip = 0x0000000103e7a437
16:07:45     INFO -      rsp = 0x00007fff5fbfcdf0   rbp = 0x00007fff5fbfce30
16:07:45     INFO -      Found by: call frame info
16:07:45     INFO -   2  XUL!js::gc::StoreBuffer::mark(JSTracer*) [StoreBuffer.cpp:64651a1a79ca : 280 + 0xe]
16:07:45     INFO -      rbx = 0x0000000100992dc8   r12 = 0x0000000100992dc8
16:07:45     INFO -      r13 = 0x0000000100992000   r14 = 0x00007fff5fbfceb0
16:07:45     INFO -      r15 = 0x0000000100992000   rip = 0x0000000103e79a2a
16:07:45     INFO -      rsp = 0x00007fff5fbfce40   rbp = 0x00007fff5fbfce50
16:07:45     INFO -      Found by: call frame info
16:07:45     INFO -   3  XUL!js::Nursery::collect(JSRuntime*, JS::gcreason::Reason) [Nursery.cpp:64651a1a79ca : 597 + 0xa]
16:07:45     INFO -      rbx = 0x00007fff5fbfceb0   r12 = 0x0000000100992dc8
16:07:45     INFO -      r13 = 0x0000000100992000   r14 = 0x0000000100992d58
16:07:45     INFO -      r15 = 0x0000000100992000   rip = 0x0000000103e7096e
16:07:45     INFO -      rsp = 0x00007fff5fbfce60   rbp = 0x00007fff5fbfcf60
16:07:45     INFO -      Found by: call frame info
16:07:45     INFO -   4  XUL!Collect [jsgc.cpp:64651a1a79ca : 4799 + 0x9]
16:07:45     INFO -      rbx = 0x000000000000002a   r12 = 0x000000012e4cf9a0
16:07:45     INFO -      r13 = 0x00007fff5fbfd100   r14 = 0x00007fff5fbfcfc0
16:07:45     INFO -      r15 = 0x0000000100992000   rip = 0x0000000103f096a2
16:07:45     INFO -      rsp = 0x00007fff5fbfcf70   rbp = 0x00007fff5fbfd030
16:07:45     INFO -      Found by: call frame info
16:07:45     INFO -   5  XUL!nsJSContext::GarbageCollectNow(JS::gcreason::Reason, nsJSContext::IsIncremental, nsJSContext::IsCompartment, nsJSContext::IsShrinking, long long) [nsJSEnvironment.cpp:64651a1a79ca : 1946 + 0xa]
16:07:45     INFO -      rbx = 0x0000000000000000   r12 = 0x000000012e4cf9a0
16:07:45     INFO -      r13 = 0x00007fff5fbfd100   r14 = 0x0000000000000000
16:07:45     INFO -      r15 = 0x000000000000002a   rip = 0x000000010249e444
16:07:45     INFO -      rsp = 0x00007fff5fbfd040   rbp = 0x00007fff5fbfd060
16:07:45     INFO -      Found by: call frame info
16:07:45     INFO -   6  XUL!nsTimerImpl::Fire() [nsTimerImpl.cpp:64651a1a79ca : 546 + 0x9]
16:07:45     INFO -      rbx = 0x00000001024a4540   r12 = 0x000000012e4cf9a0
16:07:45     INFO -      r13 = 0x00007fff5fbfd100   r14 = 0x0000000000000002
16:07:45     INFO -      r15 = 0x0000000000000002   rip = 0x0000000103592c89
16:07:45     INFO -      rsp = 0x00007fff5fbfd070   rbp = 0x00007fff5fbfd0e0
16:07:45     INFO -      Found by: call frame info
16:07:45     INFO -   7  XUL!nsTimerEvent::Run() [nsTimerImpl.cpp:64651a1a79ca : 630 + 0x4]
16:07:45     INFO -      rbx = 0x0000000100c464f0   r12 = 0x0000000100213430
16:07:45     INFO -      r13 = 0x00007fff5fbfd1e7   r14 = 0x0000000000006ae5
16:07:45     INFO -      r15 = 0x0000000000000000   rip = 0x0000000103592f40
16:07:45     INFO -      rsp = 0x00007fff5fbfd0f0   rbp = 0x00007fff5fbfd110
16:07:45     INFO -      Found by: call frame info

Comment 1

[Jon Coppeard (:jonco)]

This is no longer crashing.