949220 - Object creation should be an atomic operation, such that if it succeeds, and reserved slots are immediately written to, finalizers can depend upon those writes having happened

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 3ea3d3baa67b (run with --fuzzing-safe):


oomAfterAllocations(16);
Intl.DateTimeFormat.prototype.constructor;

Comment 1

[Christian Holler (:decoder)]

Jason is working on this one already :)

Comment 2

[Jeff Walden [:Waldo]]

Given UDATE_FORMAT_SLOT in DateTimeFormat objects is initialized immediately after object construction in every place, I think this is a duplicate of bug 915336 -- GlobalObject::createBlankPrototype can create an object that the GC can observe (and attempt to finalize, before its reserved slots have been initialized to be GC-safe) but still return nullptr.

Comment 3

[Christian Holler (:decoder)]

Jason and Waldo, I know you guys have been working on fixing these OOM crashes [@ u(num|col|dat)_close_50] in several bugs. Is there any progress on this? I'm still seeing pretty much all of them in the fuzzer. That wouldn't be such a big issue (although it's very annoying and costs processing time), but the assertion tied to this (the DOUBLE_IMPL) is quite generic and possibly covers other security bugs.

Comment 4

[Jeff Walden [:Waldo]]

Fine, I'll look.  The way type objects are set is honestly a disaster, so this is going to be a messy patch, and it might take awhile to finish it.

Comment 5

[Jason Orendorff [:jorendorff]]

Yeah, I only had the obvious (narrow) fix for this. Waldo's way is better.

Comment 6

[Jeff Walden [:Waldo]]

At this point, given a DOM work week next week, dealing with bug 948583 fallout/patch incompleteness before uplift, dealing with bug 961494 before (another) uplift, getting ICU updated before uplift, and probably one or two other things I've forgotten -- not to mention the incomplete patchwork isn't quite on a machine I can use -- this is not going to happen before the next uplift.  Once these other things wrap up, perhaps.  No sooner.

Comment 7

[Christian Holler (:decoder)]

JSBugMon: Cannot process bug: Error: Failed to compile specified revision 3ea3d3baa67b (maybe try another?)

Comment 8

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 3d34a3b6443a).

Comment 9

[Christian Holler (:decoder)]

JSBugMon: Fix Bisection requested, result:
=== Tinderbox Build Bisection Results by autoBisect ===

The "bad" changeset has the timestamp "20140414165901" and the hash "ba29a8ec2973".
The "good" changeset has the timestamp "20140414172403" and the hash "21aca7217e7a".

Likely fix window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=ba29a8ec2973&tochange=21aca7217e7a

Comment 11

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

:Waldo duped bug 1100480 here, and this seemed like it's going to fall off the radar, so assigning and setting needinfo? to him, as per real-life conversation.

Comment 12

[Jeff Walden [:Waldo]]

Attachment: Hackaround

The deal is that when we allocate Intl objects, *internally* we do so in a three-step process:

1) allocate the object
2) allocate a thing for its typeobject
3) init its reserved slot to privatevalue(nullptr)

or something like that, memory hazy.  If we succeed in step 1 but fail in step 2, then the reserved slot is still UndefinedValue() -- but the finalizer will get called when the object's GC'd.  Hack around this stupidity by detecting the still-undefined case.

Comment 14

[Eric Faust [:efaust]]

Comment on attachment 8554921 [details] [diff] [review]
Hackaround

Review of attachment 8554921 [details] [diff] [review]:
-----------------------------------------------------------------

OK, this is like the third dumbest thing. r=me

Comment 15

[Jeff Walden [:Waldo]]

Landed a hackaround for now.  The underlying issue still remains, just that these three finalizers defend against it happening.

https://hg.mozilla.org/integration/mozilla-inbound/rev/1c33995cc288

Hopefully I can get back to fixing the object-creation process to not have this visibly-two-step process in case of OOM after the first step at some point.  Leaving open until that happens and we can remove the extra defensive code this hack added.

Comment 16

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/1c33995cc288

Comment 17

[Sylvestre Ledru [:Sylvestre]]

Closing because no crash reported since 12 weeks.

Comment 18

[Sylvestre Ledru [:Sylvestre]]

Closing because no crash reported since 12 weeks.

Comment 19

[Jeff Walden [:Waldo]]

This issue still exists, and "no crash" is not an indicator of its having been fixed.  We're still just hacking around this everywhere.

Comment 20

[BugBot [:suhaib / :marco/ :calixte]]

The leave-open keyword is there and there is no activity for 6 months.
:sdetar, maybe it's time to close this bug?

Comment 21

[Steven DeTar [:sdetar]]

Jeff, should still leave this bug open (leave-open keyword)?

Comment 22

[BugBot [:suhaib / :marco/ :calixte]]

The leave-open keyword is there and there is no activity for 6 months.
:sdetar, maybe it's time to close this bug?

Comment 23

[Steven DeTar [:sdetar]]

Jeff could you help determine if the leave-open keyword should be removed from this bug?

Comment 24

[BugBot [:suhaib / :marco/ :calixte]]

The leave-open keyword is there and there is no activity for 6 months.
:Waldo, maybe it's time to close this bug?

Comment 25

[Jeff Walden [:Waldo]]

Going from code inspection, this is no longer a problem most of the time. js::NewObjectWithGivenTaggedProto now first creates and roots an ObjectGroup, then it creates the JSObject* that will use it.

However, "creates the JSObject*" expands to 1) get the initial shape (which is fine), 2) create the object (fine), 3) if we are creating a SingletonObject perform JSObject::setSingleton on it. And that last step is not fine, because it means if that last step fails, a finalizer can't rely on the user having initialized those reserved slots.

All of which means, for most object allocations, this doesn't matter -- but singleton objects still have problems. I don't immediately know how many places we allocate objects as singletons, that also have finalizers that when called want to assume post-creation initialization happens.

I have in the past wanted to fix up our singleton story, so that objects are allocated from the start as singletons -- not munged into singleton status after creation. It seems to me that's what we still need to do to fix this. Bug 987807 is one small instance of this, but I'm not sure we have a generalized bug dedicated to the entire problem just yet, at least not off the top of my head.

Comment 26

[Jan de Mooij [:jandem]]

Note that the singleton story will hopefully change quite a bit in the future so it might not be worth doing a lot of work here for now.

Comment 27

[BugBot [:suhaib / :marco/ :calixte]]

Bugbug thinks this bug is a regression, but please revert this change in case of error.

Comment 28

[Jeff Walden [:Waldo]]

Attachment: Bug 949220 - Change callers of |NewObjectWithGivenProto| that specify a constant |SingletonObject| to instead call a new |js::NewSingletonObjectWithGivenProto| that hides away that constant argument. r=jandem!

Comment 29

[Jeff Walden [:Waldo]]

Attachment: Bug 949220 - Split out of |NewObjectWithGivenProto<T>| variants that hard-code SingletonObject/TenuredObject behavior, and use them in all callers that currently pass either constant. r=jandem!

Depends on D70487

Comment 30

[Jeff Walden [:Waldo]]

Attachment: Bug 949220 - Remove |NewDensePartlyAllocatedArray| as unused. r=jandem!

Depends on D70488

Comment 31

[Jeff Walden [:Waldo]]

Attachment: Bug 949220 - Make |NewDenseFullyAllocatedArrayWithTemplate|'s template object argument have type |ArrayObject*|. r=jandem!

Depends on D70489

Comment 32

[Jeff Walden [:Waldo]]

Attachment: Bug 949220 - Split |NewTenuredDenseEmptyArray| out of |NewDenseEmptyArray|, and make the latter function invoke TenuredObject behavior. r=jandem!

Depends on D70490

Comment 33

[Jeff Walden [:Waldo]]

Attachment: Bug 949220 - Make all arguments to |NewArray| in Array.cpp mandatory. r=jandem!

Depends on D70491

Comment 34

[Jeff Walden [:Waldo]]

Attachment: Bug 949220 - Add |NewObjectWithGivenProtoAndKind| that accepts a kind, and make |NewObjectWithGivenProto| always specify GenericObject. r=jandem!

Depends on D70492

Comment 35

[Jeff Walden [:Waldo]]

Attachment: Bug 949220 - Try allocating map iterator objects first in the nursery, then tenured, without doing so using a loop. r=jandem!

Depends on D70493

Comment 36

[Jeff Walden [:Waldo]]

Attachment: Bug 949220 - Try allocating set iterator objects first in the nursery, then tenured, without doing so using a loop. r=jandem!

Depends on D70494

Comment 37

[Jeff Walden [:Waldo]]

Attachment: Bug 949220 - Split NewArrayIteratorObject into NewArrayIterator{,Template}. r=jandem!

Depends on D70495

Comment 38

[Jeff Walden [:Waldo]]

Attachment: Bug 949220 - Split out NewStringIteratorTemplate from NewStringIterator. r=jandem!

Depends on D70496

Comment 39

[Jeff Walden [:Waldo]]

Attachment: Bug 949220 - Split out NewRegExpStringIteratorTemplate from NewRegExpStringIteratorObject. r=jandem!

Depends on D70497

Comment 40

[Jeff Walden [:Waldo]]

Attachment: Bug 949220 - Remove NewObjectWithGivenProtoAndKind. r=jandem!

Depends on D70498

Comment 41

[Jeff Walden [:Waldo]]

Attachment: Bug 949220 - Remove |NewObjectWithNullTaggedProto<T>| in favor of just |NewObjectWithGivenProto<T>(cx, nullptr)|. r=jandem!

Depends on D70499

Comment 42

[Jeff Walden [:Waldo]]

Attachment: Bug 949220 - Split NewBuiltinClassInstance into a generic form, a tenured form, and a kind-specified form. r=jandem!

Depends on D70500

Comment 43

[Jeff Walden [:Waldo]]

Attachment: Bug 949220 - Make |NewProxyObject| return only non-singletons, and add |NewSingletonProxyObject| for the singleton case. r=jandem!

Depends on D70501

Comment 44

[Jeff Walden [:Waldo]]

Attachment: Bug 949220 - Make the |NewObjectKind| argument to |DeepCloneObjectLiteral| mandatory. r=jandem!

Depends on D70502

Comment 45

[Jeff Walden [:Waldo]]

Attachment: Bug 949220 - Remove the |NewObjectKind| argument from |DeepCloneObjectLiteral|. r=jandem!

Depends on D70503

Comment 46

[Jeff Walden [:Waldo]]

Attachment: Bug 949220 - Remove both |NewNativeObjectWithGivenProto| overloads. r=jandem!

Depends on D70504

Comment 47

[Jeff Walden [:Waldo]]

Attachment: Bug 949220 - Remove |NewNativeObjectWith{GivenTagged,Class}Proto| as unused. r=jandem!

Depends on D70505

Comment 48

[Jeff Walden [:Waldo]]

Attachment: Bug 949220 - Make |NewObjectWithGivenProto| (the overload that doesn't take an |allocKind|) use GenericObject. r=jandem!

Depends on D70506

Comment 49

[Jeff Walden [:Waldo]]

Attachment: Bug 949220 - Rename a |NewObjectWithGivenProto| overload to |NewObjectWithGivenProtoAndKinds| to better distinguish it as not hard-coding a |NewObjectKind|. r=jandem!

Depends on D70507

Comment 50

[Jeff Walden [:Waldo]]

Attachment: Bug 949220 - Fold |NewObjectWithClassProtoCommon| into its sole caller. r=jandem!

Depends on D70508

Comment 51

[Jeff Walden [:Waldo]]

Attachment: Bug 949220 - Split out a |NewObjectWithClassProtoAndKind| from |NewObjectWithClassProto| so the latter can always use |GenericObject| semantics. r=jandem!

Depends on D70509

Comment 52

[Jeff Walden [:Waldo]]

Attachment: Bug 949220 - Copy |ProxyObject::create| over to |ProxyObject::createSingleton|, preparing for simplifying both code paths. r=jandem!

Depends on D70510

Comment 53

[Jeff Walden [:Waldo]]

Attachment: Bug 949220 - Inline |Proxy::createSingleton| into its caller. r=jandem!

Depends on D70511

Comment 54

[Jeff Walden [:Waldo]]

Attachment: Bug 949220 - Introduce an |ObjectGroup::lazySingletonGroup| that doesn't require providing an old group. r=jandem!

Depends on D70512

Comment 55

[Jeff Walden [:Waldo]]

Attachment: Bug 949220 - Make |ProxyObject::NewSingleton| create a singleton |ObjectGroup| right from the start, avoiding the need to call |JSObject::setSingleton| after the fact. r=jandem!

Depends on D70513

Comment 56

[Jeff Walden [:Waldo]]

Attachment: Bug 949220 - Inline |ProxyObject::create| into its sole caller, and simplify the resulting code. r=jandem!

Depends on D70514

Comment 57

[Jeff Walden [:Waldo]]

Attachment: Bug 949220 - Remove |NurseryAllocatedProxy| now that it's unused. r=jandem!

Depends on D70515

Comment 58

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/2d677ae71924
Change callers of |NewObjectWithGivenProto| that specify a constant |SingletonObject| to instead call a new |js::NewSingletonObjectWithGivenProto| that hides away that constant argument.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/98ac0d0d392c
Split out of |NewObjectWithGivenProto<T>| variants that hard-code SingletonObject/TenuredObject behavior, and use them in all callers that currently pass either constant.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/c0d4d9557fac
Remove |NewDensePartlyAllocatedArray| as unused.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/54f48761a664
Make |NewDenseFullyAllocatedArrayWithTemplate|'s template object argument have type |ArrayObject*|.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/45e22642cd49
Split |NewTenuredDenseEmptyArray| out of |NewDenseEmptyArray|, and make the latter function invoke TenuredObject behavior.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/62fff9f3a631
Make all arguments to |NewArray| in Array.cpp mandatory.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/ddf62ab9e8cc
Add |NewObjectWithGivenProtoAndKind| that accepts a kind, and make |NewObjectWithGivenProto| always specify GenericObject.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/93b33661e87b
Try allocating map iterator objects first in the nursery, then tenured, without doing so using a loop.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/eda9a8e621b3
Try allocating set iterator objects first in the nursery, then tenured, without doing so using a loop.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/43ff0c2fc3dc
Split NewArrayIteratorObject into NewArrayIterator{,Template}.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/afb91f3ce31e
Split out NewStringIteratorTemplate from NewStringIterator.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/69e8d2e49ee1
Split out NewRegExpStringIteratorTemplate from NewRegExpStringIteratorObject.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/53a89cfb8c24
Remove NewObjectWithGivenProtoAndKind.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/a4a124e8f193
Remove |NewObjectWithNullTaggedProto<T>| in favor of just |NewObjectWithGivenProto<T>(cx, nullptr)|.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/53c4c74abb23
Split NewBuiltinClassInstance into a generic form, a tenured form, and a kind-specified form.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/cf4659d06791
Make |NewProxyObject| return only non-singletons, and add |NewSingletonProxyObject| for the singleton case.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/a2a3821dcc6e
Make the |NewObjectKind| argument to |DeepCloneObjectLiteral| mandatory.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/097d29b3ed26
Remove the |NewObjectKind| argument from |DeepCloneObjectLiteral|.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/817de77f7cf1
Remove both |NewNativeObjectWithGivenProto| overloads.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/c8322158294f
Remove |NewNativeObjectWith{GivenTagged,Class}Proto| as unused.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/ca28434cf70f
Make |NewObjectWithGivenProto| (the overload that doesn't take an |allocKind|) use GenericObject.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/42312dec52aa
Rename a |NewObjectWithGivenProto| overload to |NewObjectWithGivenProtoAndKinds| to better distinguish it as not hard-coding a |NewObjectKind|.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/5c07df930240
Fold |NewObjectWithClassProtoCommon| into its sole caller.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/e1ac27ee38e2
Split out a |NewObjectWithClassProtoAndKind| from |NewObjectWithClassProto| so the latter can always use |GenericObject| semantics.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/b7459076dbf5
Copy |ProxyObject::create| over to |ProxyObject::createSingleton|, preparing for simplifying both code paths.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/650ccbbc2e15
Inline |Proxy::createSingleton| into its caller.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/761005340836
Introduce an |ObjectGroup::lazySingletonGroup| that doesn't require providing an old group.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/9043d3f4ea6f
Make |ProxyObject::NewSingleton| create a singleton |ObjectGroup| right from the start, avoiding the need to call |JSObject::setSingleton| after the fact.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/437dc6f1a0b1
Inline |ProxyObject::create| into its sole caller, and simplify the resulting code.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/b077b434866d
Remove |NurseryAllocatedProxy| now that it's unused.  r=jandem

Comment 59

[Bogdan Tara[:bogdan_tara | bogdant]]

Backed out 30 changesets (bug 949220) for assertion failure on JSObject.cpp

Push with failures: https://treeherder.mozilla.org/#/jobs?repo=autoland&searchStr=windows%2C7%2Cdebug%2Cmochitests%2Ctest-windows7-32%2Fdebug-mochitest-plain-e10s-3%2Cm%283%29&fromchange=bf87ca5479978009e2c9ebcdd51db697cf11fdef&tochange=71f4061ed1ef409ca54176ddea93ddf04fcbe35b&selectedJob=297489863

Backout link: https://hg.mozilla.org/integration/autoland/rev/71f4061ed1ef409ca54176ddea93ddf04fcbe35b

Failure log: https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=297489863&repo=autoland&lineNumber=13753

[task 2020-04-14T09:48:33.714Z] 09:48:33     INFO - TEST-START | layout/style/test/test_value_cloning.html
[task 2020-04-14T09:48:35.478Z] 09:48:35     INFO - GECKO(4980) | [Child 1816, Main Thread] WARNING: We shouldn't be backing up more than once! Someone must have set a break opportunity beyond the available width, even though there were better break opportunities before it: file /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp, line 4345
[task 2020-04-14T09:48:35.673Z] 09:48:35     INFO - GECKO(4980) | [Child 1816, Main Thread] WARNING: We shouldn't be backing up more than once! Someone must have set a break opportunity beyond the available width, even though there were better break opportunities before it: file /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp, line 4345
[task 2020-04-14T09:48:38.028Z] 09:48:38     INFO - GECKO(4980) | Assertion failure: heap == gc::TenuredHeap, at /builds/worker/checkouts/gecko/js/src/vm/JSObject.cpp:4314
[task 2020-04-14T09:48:38.163Z] 09:48:38     INFO - GECKO(4980) | [Parent 1060, Main Thread] WARNING: IPC message discarded: actor cannot send: file /builds/worker/checkouts/gecko/ipc/glue/ProtocolUtils.cpp, line 475
[task 2020-04-14T09:48:38.163Z] 09:48:38     INFO - GECKO(4980) | [Parent 1060, Main Thread] WARNING: IPC message discarded: actor cannot send: file /builds/worker/checkouts/gecko/ipc/glue/ProtocolUtils.cpp, line 475
[task 2020-04-14T09:48:38.164Z] 09:48:38     INFO - GECKO(4980) | [Parent 1060, Main Thread] WARNING: IPC message discarded: actor cannot send: file /builds/worker/checkouts/gecko/ipc/glue/ProtocolUtils.cpp, line 475
[task 2020-04-14T09:48:38.267Z] 09:48:38    ERROR - GECKO(4980) | A content process crashed and MOZ_CRASHREPORTER_SHUTDOWN is set, shutting down
[task 2020-04-14T09:48:38.502Z] 09:48:38     INFO - GECKO(4980) | [Parent 1060, Main Thread] WARNING: '!inner', file /builds/worker/checkouts/gecko/dom/ipc/JSWindowActorService.cpp, line 188
[task 2020-04-14T09:48:38.502Z] 09:48:38     INFO - GECKO(4980) | [Parent 1060, Main Thread] WARNING: '!inner', file /builds/worker/checkouts/gecko/dom/ipc/JSWindowActorService.cpp, line 188
[task 2020-04-14T09:48:38.509Z] 09:48:38     INFO - GECKO(4980) | [Parent 1060, Gecko_IOThread] WARNING: file /builds/worker/checkouts/gecko/ipc/chromium/src/base/process_util_win.cc, line 166
[task 2020-04-14T09:48:38.549Z] 09:48:38     INFO - GECKO(4980) | [Parent 1060, Main Thread] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80040111 (NS_ERROR_NOT_AVAILABLE): file /builds/worker/checkouts/gecko/netwerk/cache/nsCacheService.cpp, line 853
[task 2020-04-14T09:48:38.549Z] 09:48:38     INFO - GECKO(4980) | [Parent 1060, Main Thread] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80040111 (NS_ERROR_NOT_AVAILABLE): file /builds/worker/checkouts/gecko/netwerk/cache/nsCacheService.cpp, line 816
[task 2020-04-14T09:48:38.549Z] 09:48:38     INFO - GECKO(4980) | [Parent 1060, Main Thread] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80040111 (NS_ERROR_NOT_AVAILABLE): file /builds/worker/checkouts/gecko/netwerk/cache/nsApplicationCacheService.cpp, line 161
[task 2020-04-14T09:48:38.632Z] 09:48:38     INFO - GECKO(4980) | [Child 5636, Main Thread] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80004005 (NS_ERROR_FAILURE): file /builds/worker/checkouts/gecko/netwerk/base/nsNetUtil.cpp, line 2307
[task 2020-04-14T09:48:38.632Z] 09:48:38     INFO - GECKO(4980) | [Child 5636, Main Thread] WARNING: 'NS_FAILED(rv)', file /builds/worker/checkouts/gecko/caps/ContentPrincipal.cpp, line 398
[task 2020-04-14T09:48:38.632Z] 09:48:38     INFO - GECKO(4980) | [Child 5636, Main Thread] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80004005 (NS_ERROR_FAILURE): file /builds/worker/checkouts/gecko/caps/ContentPrincipal.cpp, line 423
[task 2020-04-14T09:48:38.633Z] 09:48:38     INFO - GECKO(4980) | [Child 5636, Main Thread] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80004005 (NS_ERROR_FAILURE): file /builds/worker/checkouts/gecko/netwerk/base/nsNetUtil.cpp, line 2307
[task 2020-04-14T09:48:38.633Z] 09:48:38     INFO - GECKO(4980) | [Child 5636, Main Thread] WARNING: 'NS_FAILED(rv)', file /builds/worker/checkouts/gecko/caps/ContentPrincipal.cpp, line 398
[task 2020-04-14T09:48:38.633Z] 09:48:38     INFO - GECKO(4980) | [Child 5636, Main Thread] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80004005 (NS_ERROR_FAILURE): file /builds/worker/checkouts/gecko/caps/ContentPrincipal.cpp, line 423
[task 2020-04-14T09:48:38.636Z] 09:48:38     INFO - GECKO(4980) | [Child 5636, Main Thread] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80004005 (NS_ERROR_FAILURE): file /builds/worker/checkouts/gecko/netwerk/base/nsNetUtil.cpp, line 2307
[task 2020-04-14T09:48:38.636Z] 09:48:38     INFO - GECKO(4980) | [Child 5636, Main Thread] WARNING: 'NS_FAILED(rv)', file /builds/worker/checkouts/gecko/caps/ContentPrincipal.cpp, line 398
[task 2020-04-14T09:48:38.636Z] 09:48:38     INFO - GECKO(4980) | [Child 5636, Main Thread] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80004005 (NS_ERROR_FAILURE): file /builds/worker/checkouts/gecko/caps/ContentPrincipal.cpp, line 423
[task 2020-04-14T09:48:38.636Z] 09:48:38     INFO - GECKO(4980) | [Child 5636, Main Thread] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80004005 (NS_ERROR_FAILURE): file /builds/worker/checkouts/gecko/netwerk/base/nsNetUtil.cpp, line 2307
[task 2020-04-14T09:48:38.636Z] 09:48:38     INFO - GECKO(4980) | [Child 5636, Main Thread] WARNING: 'NS_FAILED(rv)', file /builds/worker/checkouts/gecko/caps/ContentPrincipal.cpp, line 398
[task 2020-04-14T09:48:38.636Z] 09:48:38     INFO - GECKO(4980) | [Child 5636, Main Thread] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80004005 (NS_ERROR_FAILURE): file /builds/worker/checkouts/gecko/caps/ContentPrincipal.cpp, line 423
[task 2020-04-14T09:48:38.655Z] 09:48:38     INFO - GECKO(4980) | [Child 5636, Main Thread] WARNING: Extra shutdown CC: 'i < NORMAL_SHUTDOWN_COLLECTIONS', file /builds/worker/checkouts/gecko/xpcom/base/nsCycleCollector.cpp, line 3352
[task 2020-04-14T09:48:38.690Z] 09:48:38     INFO - GECKO(4980) | [2020-04-14T09:48:38Z WARN  xulstore::persist] tried to remove key that isn't in the store
[task 2020-04-14T09:48:38.690Z] 09:48:38     INFO - GECKO(4980) | [2020-04-14T09:48:38Z WARN  xulstore::persist] tried to remove key that isn't in the store
[task 2020-04-14T09:48:38.910Z] 09:48:38     INFO - GECKO(4980) | [Child 5076, Main Thread] WARNING: 'NS_FAILED(GetAccentColor(unused))', file /builds/worker/checkouts/gecko/widget/windows/nsLookAndFeel.cpp, line 481
[task 2020-04-14T09:48:39.089Z] 09:48:39     INFO - GECKO(4980) | [Child 2636, Main Thread] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80004005 (NS_ERROR_FAILURE): file /builds/worker/checkouts/gecko/netwerk/base/nsNetUtil.cpp, line 2307
[task 2020-04-14T09:48:39.089Z] 09:48:39     INFO - GECKO(4980) | [Child 2636, Main Thread] WARNING: 'NS_FAILED(rv)', file /builds/worker/checkouts/gecko/caps/ContentPrincipal.cpp, line 398
[task 2020-04-14T09:48:39.089Z] 09:48:39     INFO - GECKO(4980) | [Child 2636, Main Thread] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80004005 (NS_ERROR_FAILURE): file /builds/worker/checkouts/gecko/caps/ContentPrincipal.cpp, line 423
[task 2020-04-14T09:48:39.104Z] 09:48:39     INFO - GECKO(4980) | [Child 2636, Main Thread] WARNING: Extra shutdown CC: 'i < NORMAL_SHUTDOWN_COLLECTIONS', file /builds/worker/checkouts/gecko/xpcom/base/nsCycleCollector.cpp, line 3352
[task 2020-04-14T09:48:39.343Z] 09:48:39     INFO - GECKO(4980) | 1586857719317	Marionette	TRACE	Received observer notification xpcom-will-shutdown
[task 2020-04-14T09:48:39.343Z] 09:48:39     INFO - GECKO(4980) | 1586857719318	Marionette	INFO	Stopped listening on port 2828
[task 2020-04-14T09:48:39.343Z] 09:48:39     INFO - GECKO(4980) | 1586857719318	Marionette	DEBUG	Marionette stopped listening
[task 2020-04-14T09:48:39.398Z] 09:48:39     INFO - GECKO(4980) | [Parent 1060, Main Thread] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80004005 (NS_ERROR_FAILURE): file /builds/worker/checkouts/gecko/js/xpconnect/loader/mozJSComponentLoader.cpp, line 228
[task 2020-04-14T09:48:39.399Z] 09:48:39     INFO - GECKO(4980) | [Parent 1060, Main Thread] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80004005 (NS_ERROR_FAILURE): file /builds/worker/checkouts/gecko/js/xpconnect/loader/mozJSComponentLoader.cpp, line 255
[task 2020-04-14T09:48:40.154Z] 09:48:40     INFO - GECKO(4980) | [Parent 1060, Main Thread] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80004005 (NS_ERROR_FAILURE): file /builds/worker/checkouts/gecko/netwerk/base/nsNetUtil.cpp, line 2307
[task 2020-04-14T09:48:40.154Z] 09:48:40     INFO - GECKO(4980) | [Parent 1060, Main Thread] WARNING: 'NS_FAILED(rv)', file /builds/worker/checkouts/gecko/caps/ContentPrincipal.cpp, line 398
[task 2020-04-14T09:48:40.154Z] 09:48:40     INFO - GECKO(4980) | [Parent 1060, Main Thread] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80004005 (NS_ERROR_FAILURE): file /builds/worker/checkouts/gecko/caps/ContentPrincipal.cpp, line 423
[task 2020-04-14T09:48:40.161Z] 09:48:40     INFO - GECKO(4980) | [Parent 1060, Main Thread] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80004005 (NS_ERROR_FAILURE): file /builds/worker/checkouts/gecko/netwerk/base/nsNetUtil.cpp, line 2307
[task 2020-04-14T09:48:40.161Z] 09:48:40     INFO - GECKO(4980) | [Parent 1060, Main Thread] WARNING: 'NS_FAILED(rv)', file /builds/worker/checkouts/gecko/caps/ContentPrincipal.cpp, line 398
[task 2020-04-14T09:48:40.161Z] 09:48:40     INFO - GECKO(4980) | [Parent 1060, Main Thread] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80004005 (NS_ERROR_FAILURE): file /builds/worker/checkouts/gecko/caps/ContentPrincipal.cpp, line 423
[task 2020-04-14T09:48:40.182Z] 09:48:40     INFO - GECKO(4980) | [Parent 1060, Main Thread] WARNING: Extra shutdown CC: 'i < NORMAL_SHUTDOWN_COLLECTIONS', file /builds/worker/checkouts/gecko/xpcom/base/nsCycleCollector.cpp, line 3352
[task 2020-04-14T09:48:40.297Z] 09:48:40     INFO - TEST-INFO | Main app process: exit 0
[task 2020-04-14T09:48:40.297Z] 09:48:40     INFO - runtests.py | Application ran for: 0:04:00.545000
[task 2020-04-14T09:48:40.297Z] 09:48:40     INFO - zombiecheck | Reading PID log: c:\users\task_1586855817\appdata\local\temp\tmpbdpupopidlog
[task 2020-04-14T09:48:40.297Z] 09:48:40     INFO - ==> process 1060 launched child process 5076 ("Z:\task_1586855817\build\application\firefox\firefox.exe" -contentproc --channel="1060.0.1945827918\477124026" -childID 1 -isForBrowser -prefsHandle 2164 -prefMapHandle 2156 -prefsLen 1 -prefMapSize 232373 -parentBuildID 20200414084730 -appdir "Z:\task_1586855817\build\application\firefox\browser" - 1060 "\\.\pipe\gecko-crash-server-pipe.1060" 2208 tab)
[task 2020-04-14T09:48:40.297Z] 09:48:40     INFO - ==> process 1060 launched child process 5636 ("Z:\task_1586855817\build\application\firefox\firefox.exe" -contentproc --channel="1060.6.2139818494\1979809957" -childID 2 -isForBrowser -prefsHandle 2468 -prefMapHandle 2464 -prefsLen 507 -prefMapSize 232373 -parentBuildID 20200414084730 -appdir "Z:\task_1586855817\build\application\firefox\browser" - 1060 "\\.\pipe\gecko-crash-server-pipe.1060" 2480 tab)
[task 2020-04-14T09:48:40.297Z] 09:48:40     INFO - ==> process 1060 launched child process 1816 ("Z:\task_1586855817\build\application\firefox\firefox.exe" -contentproc --channel="1060.12.1425078889\1157077265" -childID 3 -isForBrowser -prefsHandle 4700 -prefMapHandle 4696 -prefsLen 568 -prefMapSize 232373 -parentBuildID 20200414084730 -appdir "Z:\task_1586855817\build\application\firefox\browser" - 1060 "\\.\pipe\gecko-crash-server-pipe.1060" 4712 tab)
[task 2020-04-14T09:48:40.298Z] 09:48:40     INFO - ==> process 1060 launched child process 2636 ("Z:\task_1586855817\build\application\firefox\firefox.exe" -contentproc --channel="1060.18.253357977\1089895843" -childID 4 -isForBrowser -prefsHandle 3668 -prefMapHandle 3664 -prefsLen 10636 -prefMapSize 232373 -parentBuildID 20200414084730 -appdir "Z:\task_1586855817\build\application\firefox\browser" - 1060 "\\.\pipe\gecko-crash-server-pipe.1060" 3612 tab)
[task 2020-04-14T09:48:40.298Z] 09:48:40     INFO - zombiecheck | Checking for orphan process with PID: 1816
[task 2020-04-14T09:48:40.298Z] 09:48:40     INFO - zombiecheck | Checking for orphan process with PID: 5636
[task 2020-04-14T09:48:40.298Z] 09:48:40     INFO - zombiecheck | Checking for orphan process with PID: 2636
[task 2020-04-14T09:48:40.298Z] 09:48:40     INFO - zombiecheck | Checking for orphan process with PID: 5076
[task 2020-04-14T09:48:40.298Z] 09:48:40     INFO - mozcrash Copy/paste: Z:/task_1586855817/fetches\minidump_stackwalk\minidump_stackwalk.exe c:\users\task_1586855817\appdata\local\temp\tmpouaspb.mozrunner\minidumps\188e0ec9-fc03-42df-9c55-862d762116f4.dmp Z:\task_1586855817\build\symbols
[task 2020-04-14T09:48:56.521Z] 09:48:56     INFO - mozcrash Saved minidump as Z:\task_1586855817\build\blobber_upload_dir\188e0ec9-fc03-42df-9c55-862d762116f4.dmp
[task 2020-04-14T09:48:56.524Z] 09:48:56     INFO - mozcrash Saved app info as Z:\task_1586855817\build\blobber_upload_dir\188e0ec9-fc03-42df-9c55-862d762116f4.extra
[task 2020-04-14T09:48:56.593Z] 09:48:56     INFO - PROCESS-CRASH | Main app process exited normally | application crashed [@ static JSObject::debugCheckNewObject(js::ObjectGroup*, js::Shape*, js::gc::AllocKind, js::gc::InitialHeap)]
[task 2020-04-14T09:48:56.593Z] 09:48:56     INFO - Mozilla crash reason: MOZ_ASSERT(heap == gc::TenuredHeap)
[task 2020-04-14T09:48:56.593Z] 09:48:56     INFO - Crash dump filename: c:\users\task_1586855817\appdata\local\temp\tmpouaspb.mozrunner\minidumps\188e0ec9-fc03-42df-9c55-862d762116f4.dmp
[task 2020-04-14T09:48:56.593Z] 09:48:56     INFO - Operating system: Windows NT
[task 2020-04-14T09:48:56.593Z] 09:48:56     INFO -                   6.1.7601 Service Pack 1
[task 2020-04-14T09:48:56.594Z] 09:48:56     INFO - CPU: x86
[task 2020-04-14T09:48:56.594Z] 09:48:56     INFO -      GenuineIntel family 6 model 63 stepping 2
[task 2020-04-14T09:48:56.594Z] 09:48:56     INFO -      8 CPUs
[task 2020-04-14T09:48:56.594Z] 09:48:56     INFO - 
[task 2020-04-14T09:48:56.594Z] 09:48:56     INFO - GPU: UNKNOWN
[task 2020-04-14T09:48:56.594Z] 09:48:56     INFO - 
[task 2020-04-14T09:48:56.594Z] 09:48:56     INFO - Crash reason:  EXCEPTION_BREAKPOINT
[task 2020-04-14T09:48:56.594Z] 09:48:56     INFO - Crash address: 0x59e1e4f2
[task 2020-04-14T09:48:56.594Z] 09:48:56     INFO - Assertion: Unknown assertion type 0x00000000
[task 2020-04-14T09:48:56.594Z] 09:48:56     INFO - Process uptime: 236 seconds
[task 2020-04-14T09:48:56.594Z] 09:48:56     INFO - 
[task 2020-04-14T09:48:56.594Z] 09:48:56     INFO - Thread 0 (crashed)
[task 2020-04-14T09:48:56.594Z] 09:48:56     INFO -  0  xul.dll!static JSObject::debugCheckNewObject(js::ObjectGroup*, js::Shape*, js::gc::AllocKind, js::gc::InitialHeap) [JSObject.cpp:b077b434866d8522790e29a10b47bd9ef46d4d2e : 0 + 0x6]
[task 2020-04-14T09:48:56.594Z] 09:48:56     INFO -     eip = 0x59e1e4f2   esp = 0x001ac11c   ebp = 0x001ac128   ebx = 0x0d50baa8
[task 2020-04-14T09:48:56.594Z] 09:48:56     INFO -     esi = 0x00000000   edi = 0x00000000   eax = 0x6a6ce8ac   ecx = 0x000010da
[task 2020-04-14T09:48:56.594Z] 09:48:56     INFO -     edx = 0x6a5fe340   efl = 0x00000202
[task 2020-04-14T09:48:56.595Z] 09:48:56     INFO -     Found by: given as instruction pointer in context
[task 2020-04-14T09:48:56.595Z] 09:48:56     INFO -  1  xul.dll!static js::ProxyObject::New(JSContext*, js::BaseProxyHandler const*, JS::Handle<JS::Value>, js::TaggedProto, JSClass const*) [ProxyObject.cpp:b077b434866d8522790e29a10b47bd9ef46d4d2e : 134 + 0x17]
[task 2020-04-14T09:48:56.595Z] 09:48:56     INFO -     eip = 0x59ea91fc   esp = 0x001ac130   ebp = 0x001ac1b4   ebx = 0x00000004
[task 2020-04-14T09:48:56.595Z] 09:48:56     INFO -     esi = 0x06a09800   edi = 0x00000000
[task 2020-04-14T09:48:56.595Z] 09:48:56     INFO -     Found by: call frame info
[task 2020-04-14T09:48:56.595Z] 09:48:56     INFO -  2  xul.dll!js::NewProxyObject(JSContext*, js::BaseProxyHandler const*, JS::Handle<JS::Value>, JSObject*, js::ProxyOptions const&) [Proxy.cpp:b077b434866d8522790e29a10b47bd9ef46d4d2e : 795 + 0x10]
[task 2020-04-14T09:48:56.595Z] 09:48:56     INFO -     eip = 0x59cb087f   esp = 0x001ac1bc   ebp = 0x001ac1e4   ebx = 0x001ac210
[task 2020-04-14T09:48:56.595Z] 09:48:56     INFO -     esi = 0x06a09800   edi = 0x0cf565d0
[task 2020-04-14T09:48:56.595Z] 09:48:56     INFO -     Found by: call frame info
[task 2020-04-14T09:48:56.595Z] 09:48:56     INFO -  3  xul.dll!mozilla::dom::BindingJSObjectCreator<nsDOMCSSDeclaration>::CreateProxyObject(JSContext*, JSClass const*, mozilla::dom::DOMProxyHandler const*, JS::Handle<JSObject *>, bool, nsDOMCSSDeclaration*, JS::Handle<JS::Value>, JS::MutableHandle<JSObject *>) [BindingUtils.h:b077b434866d8522790e29a10b47bd9ef46d4d2e : 2633 + 0xb]
[task 2020-04-14T09:48:56.595Z] 09:48:56     INFO -     eip = 0x562d0400   esp = 0x001ac1ec   ebp = 0x001ac230   esi = 0x001ac2d8
[task 2020-04-14T09:48:56.595Z] 09:48:56     INFO -     edi = 0x001ac278
[task 2020-04-14T09:48:56.595Z] 09:48:56     INFO -     Found by: call frame info
[task 2020-04-14T09:48:56.595Z] 09:48:56     INFO -  4  xul.dll!mozilla::dom::CSS2Properties_Binding::Wrap(JSContext*, nsDOMCSSDeclaration*, nsWrapperCache*, JS::Handle<JSObject *>, JS::MutableHandle<JSObject *>) [CSS2PropertiesBinding.cpp: : 56852 + 0x24]
[task 2020-04-14T09:48:56.595Z] 09:48:56     INFO -     eip = 0x562d0088   esp = 0x001ac238   ebp = 0x001ac2b4   ebx = 0x19ff4244
[task 2020-04-14T09:48:56.595Z] 09:48:56     INFO -     esi = 0x19ff4240   edi = 0x001ac2d8
[task 2020-04-14T09:48:56.595Z] 09:48:56     INFO -     Found by: call frame info
[task 2020-04-14T09:48:56.596Z] 09:48:56     INFO -  5  xul.dll!nsDOMCSSDeclaration::WrapObject(JSContext*, JS::Handle<JSObject *>) [nsDOMCSSDeclaration.cpp:b077b434866d8522790e29a10b47bd9ef46d4d2e : 31 + 0x2c]
[task 2020-04-14T09:48:56.596Z] 09:48:56     INFO -     eip = 0x58428c22   esp = 0x001ac2bc   ebp = 0x001ac2e8   ebx = 0x06a09800
[task 2020-04-14T09:48:56.596Z] 09:48:56     INFO -     esi = 0x001ac2d8   edi = 0x001ac2d0
[task 2020-04-14T09:48:56.596Z] 09:48:56     INFO -     Found by: call frame info
[task 2020-04-14T09:48:56.596Z] 09:48:56     INFO -  6  xul.dll!mozilla::dom::binding_detail::DoGetOrCreateDOMReflector<nsICSSDeclaration,mozilla::dom::binding_detail::eWrapIntoContextCompartment>(JSContext*, nsICSSDeclaration*, JS::Handle<JSObject *>, JS::MutableHandle<JS::Value>) [BindingUtils.h:b077b434866d8522790e29a10b47bd9ef46d4d2e : 1056 + 0xf]
[task 2020-04-14T09:48:56.596Z] 09:48:56     INFO -     eip = 0x563e371b   esp = 0x001ac2f0   ebp = 0x001ac318   esi = 0x19ff4244
[task 2020-04-14T09:48:56.596Z] 09:48:56     INFO -     edi = 0x19ff4240
[task 2020-04-14T09:48:56.596Z] 09:48:56     INFO -     Found by: call frame info
[task 2020-04-14T09:48:56.596Z] 09:48:56     INFO -  7  xul.dll!mozilla::dom::Window_Binding::getComputedStyle(JSContext*, JS::Handle<JSObject *>, void*, JSJitMethodCallArgs const&) [WindowBinding.cpp: : 3790 + 0x17]
[task 2020-04-14T09:48:56.596Z] 09:48:56     INFO -     eip = 0x56cb9e14   esp = 0x001ac320   ebp = 0x001ac438   ebx = 0x001ac301
[task 2020-04-14T09:48:56.596Z] 09:48:56     INFO -     esi = 0x001ac454   edi = 0x19ff4240
[task 2020-04-14T09:48:56.596Z] 09:48:56     INFO -     Found by: call frame info
[task 2020-04-14T09:48:56.596Z] 09:48:56     INFO -  8  xul.dll!mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::MaybeCrossOriginObjectThisPolicy,mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) [BindingUtils.cpp:b077b434866d8522790e29a10b47bd9ef46d4d2e : 3205 + 0xa]
[task 2020-04-14T09:48:56.596Z] 09:48:56     INFO -     eip = 0x5718bfff   esp = 0x001ac440   ebp = 0x001ac49c   ebx = 0x001ac400
[task 2020-04-14T09:48:56.596Z] 09:48:56     INFO -     esi = 0x5c1f3170   edi = 0x00000001
[task 2020-04-14T09:48:56.596Z] 09:48:56     INFO -     Found by: call frame info
[task 2020-04-14T09:48:56.596Z] 09:48:56     INFO -  9  xul.dll!CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) [Interpreter.cpp:b077b434866d8522790e29a10b47bd9ef46d4d2e : 490 + 0x7]
[task 2020-04-14T09:48:56.597Z] 09:48:56     INFO -     eip = 0x59b8f790   esp = 0x001ac4a4   ebp = 0x001ac508   ebx = 0x06a09800
[task 2020-04-14T09:48:56.597Z] 09:48:56     INFO -     esi = 0x5718bd80   edi = 0x001ac640
[task 2020-04-14T09:48:56.597Z] 09:48:56     INFO -     Found by: call frame info
[task 2020-04-14T09:48:56.597Z] 09:48:56     INFO - 10  xul.dll!js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) [Interpreter.cpp:b077b434866d8522790e29a10b47bd9ef46d4d2e : 582 + 0xb]
[task 2020-04-14T09:48:56.597Z] 09:48:56     INFO -     eip = 0x59b8f182   esp = 0x001ac510   ebp = 0x001ac570   ebx = 0x00000000
[task 2020-04-14T09:48:56.597Z] 09:48:56     INFO -     esi = 0x001ac640   edi = 0x5718bd80
[task 2020-04-14T09:48:56.597Z] 09:48:56     INFO -     Found by: call frame info
[task 2020-04-14T09:48:56.597Z] 09:48:56     INFO - 11  xul.dll!InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) [Interpreter.cpp:b077b434866d8522790e29a10b47bd9ef46d4d2e : 645 + 0xc]
[task 2020-04-14T09:48:56.597Z] 09:48:56     INFO -     eip = 0x59b904ef   esp = 0x001ac578   ebp = 0x001ac5b8   ebx = 0x00000000
[task 2020-04-14T09:48:56.597Z] 09:48:56     INFO -     esi = 0x001ac590   edi = 0x001ac640
[task 2020-04-14T09:48:56.597Z] 09:48:56     INFO -     Found by: call frame info
[task 2020-04-14T09:48:56.597Z] 09:48:56     INFO - 12  xul.dll!js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) [Interpreter.cpp:b077b434866d8522790e29a10b47bd9ef46d4d2e : 662 + 0x6]
[task 2020-04-14T09:48:56.597Z] 09:48:56     INFO -     eip = 0x59b90721   esp = 0x001ac5c0   ebp = 0x001ac5d0   ebx = 0x00000008
[task 2020-04-14T09:48:56.597Z] 09:48:56     INFO -     esi = 0x001ac640   edi = 0x00000001
[task 2020-04-14T09:48:56.597Z] 09:48:56     INFO -     Found by: call frame info
[task 2020-04-14T09:48:56.597Z] 09:48:56     INFO - 13  xul.dll!js::jit::InvokeFunction(JSContext*, JS::Handle<JSObject *>, bool, bool, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) [VMFunctions.cpp:b077b434866d8522790e29a10b47bd9ef46d4d2e : 267 + 0x14]
[task 2020-04-14T09:48:56.597Z] 09:48:56     INFO -     eip = 0x5acfe7f9   esp = 0x001ac5d8   ebp = 0x001ac73c   ebx = 0x00000008
[task 2020-04-14T09:48:56.598Z] 09:48:56     INFO -     esi = 0x001ac6c0
[task 2020-04-14T09:48:56.598Z] 09:48:56     INFO -     Found by: call frame info
[task 2020-04-14T09:48:56.598Z] 09:48:56     INFO - 14  xul.dll!truncf + 0x10766b8
[task 2020-04-14T09:48:56.598Z] 09:48:56     INFO -     eip = 0x5cc74d00   esp = 0x001ac770   ebp = 0x001acd00   ebx = 0x001ac764
[task 2020-04-14T09:48:56.598Z] 09:48:56     INFO -     esi = 0xffffff8c   edi = 0x00000001
[task 2020-04-14T09:48:56.598Z] 09:48:56     INFO -     Found by: call frame info with scanning
[task 2020-04-14T09:48:56.598Z] 09:48:56     INFO - 15  0x6a09838
[task 2020-04-14T09:48:56.598Z] 09:48:56     INFO -     eip = 0x06a09838   esp = 0x001acd08   ebp = 0x001ad220
[task 2020-04-14T09:48:56.598Z] 09:48:56     INFO -     Found by: previous frame's frame pointer
[task 2020-04-14T09:48:56.598Z] 09:48:56     INFO - 16  0x6a09838
[task 2020-04-14T09:48:56.598Z] 09:48:56     INFO -     eip = 0x06a09838   esp = 0x001ad228   ebp = 0x00000000
[task 2020-04-14T09:48:56.598Z] 09:48:56     INFO -     Found by: previous frame's frame pointer
[task 2020-04-14T09:48:56.598Z] 09:48:56     INFO - 17  xul.dll!js::ProxyGetProperty(JSContext*, JS::Handle<JSObject *>, JS::Handle<JS::PropertyKey>, JS::MutableHandle<JS::Value>) [Proxy.cpp:b077b434866d8522790e29a10b47bd9ef46d4d2e : 345 + 0x10]
[task 2020-04-14T09:48:56.598Z] 09:48:56     INFO -     eip = 0x59cb2566   esp = 0x001ad23c   ebp = 0x00000000
[task 2020-04-14T09:48:56.598Z] 09:48:56     INFO -     Found by: stack scanning
[task 2020-04-14T09:48:56.598Z] 09:48:56     INFO - 18  xul.dll + 0x2554d0
[task 2020-04-14T09:48:56.598Z] 09:48:56     INFO -     eip = 0x549954d0   esp = 0x001ad25c   ebp = 0x001ad288
[task 2020-04-14T09:48:56.599Z] 09:48:56     INFO -     Found by: stack scanning
[task 2020-04-14T09:48:56.599Z] 09:48:56     INFO - 19  0xffffff8c
[task 2020-04-14T09:48:56.599Z] 09:48:56     INFO -     eip = 0xffffff8c   esp = 0x001ad290   ebp = 0x0c2751c0
[task 2020-04-14T09:48:56.599Z] 09:48:56     INFO -     Found by: stack scanning
...

Comment 60

[Jeff Walden [:Waldo]]

wut

This has tryservered at various times in the past, so I am confuse. Will do some testing and relanding piecemeal, I guess.

Comment 61

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/0c40d004b57c
Change callers of |NewObjectWithGivenProto| that specify a constant |SingletonObject| to instead call a new |js::NewSingletonObjectWithGivenProto| that hides away that constant argument.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/f43782ba7d9b
Split out of |NewObjectWithGivenProto<T>| variants that hard-code SingletonObject/TenuredObject behavior, and use them in all callers that currently pass either constant.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/0effb22db897
Remove |NewDensePartlyAllocatedArray| as unused.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/5ee921665bfe
Make |NewDenseFullyAllocatedArrayWithTemplate|'s template object argument have type |ArrayObject*|.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/8a54c7c199dc
Split |NewTenuredDenseEmptyArray| out of |NewDenseEmptyArray|, and make the latter function invoke TenuredObject behavior.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/459ac8a6fc25
Make all arguments to |NewArray| in Array.cpp mandatory.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/fb2826055610
Add |NewObjectWithGivenProtoAndKind| that accepts a kind, and make |NewObjectWithGivenProto| always specify GenericObject.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/6bfc66e2dd9a
Try allocating map iterator objects first in the nursery, then tenured, without doing so using a loop.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/ef8c9f8eaa0e
Try allocating set iterator objects first in the nursery, then tenured, without doing so using a loop.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/d72d52e40733
Split NewArrayIteratorObject into NewArrayIterator{,Template}.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/9c74164ea82f
Split out NewStringIteratorTemplate from NewStringIterator.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/5ef5c4e6b312
Split out NewRegExpStringIteratorTemplate from NewRegExpStringIteratorObject.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/ee062bce8602
Remove NewObjectWithGivenProtoAndKind.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/ddf3ed2c3a1b
Remove |NewObjectWithNullTaggedProto<T>| in favor of just |NewObjectWithGivenProto<T>(cx, nullptr)|.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/01ced0fd2198
Split NewBuiltinClassInstance into a generic form, a tenured form, and a kind-specified form.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/7ad1607be0b8
Make |NewProxyObject| return only non-singletons, and add |NewSingletonProxyObject| for the singleton case.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/0df9f2cf61a8
Make the |NewObjectKind| argument to |DeepCloneObjectLiteral| mandatory.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/673d41c6f7bb
Remove the |NewObjectKind| argument from |DeepCloneObjectLiteral|.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/396397bcb38b
Remove both |NewNativeObjectWithGivenProto| overloads.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/8d6c7503f22f
Remove |NewNativeObjectWith{GivenTagged,Class}Proto| as unused.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/c9deed70f209
Make |NewObjectWithGivenProto| (the overload that doesn't take an |allocKind|) use GenericObject.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/39566c2dd7c7
Rename a |NewObjectWithGivenProto| overload to |NewObjectWithGivenProtoAndKinds| to better distinguish it as not hard-coding a |NewObjectKind|.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/0721eefdd313
Fold |NewObjectWithClassProtoCommon| into its sole caller.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/6f104bf1520f
Split out a |NewObjectWithClassProtoAndKind| from |NewObjectWithClassProto| so the latter can always use |GenericObject| semantics.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/b9ba8d904b0f
Copy |ProxyObject::create| over to |ProxyObject::createSingleton|, preparing for simplifying both code paths.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/0d355fc784ab
Inline |Proxy::createSingleton| into its caller.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/68876db19421
Introduce an |ObjectGroup::lazySingletonGroup| that doesn't require providing an old group.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/bf2723998f5c
Make |ProxyObject::NewSingleton| create a singleton |ObjectGroup| right from the start, avoiding the need to call |JSObject::setSingleton| after the fact.  r=jandem

Comment 62

[Stefan Hindli [:stefan_hindli]]

https://hg.mozilla.org/mozilla-central/rev/0c40d004b57c
https://hg.mozilla.org/mozilla-central/rev/f43782ba7d9b
https://hg.mozilla.org/mozilla-central/rev/0effb22db897
https://hg.mozilla.org/mozilla-central/rev/5ee921665bfe
https://hg.mozilla.org/mozilla-central/rev/8a54c7c199dc
https://hg.mozilla.org/mozilla-central/rev/459ac8a6fc25
https://hg.mozilla.org/mozilla-central/rev/fb2826055610
https://hg.mozilla.org/mozilla-central/rev/6bfc66e2dd9a
https://hg.mozilla.org/mozilla-central/rev/ef8c9f8eaa0e
https://hg.mozilla.org/mozilla-central/rev/d72d52e40733
https://hg.mozilla.org/mozilla-central/rev/9c74164ea82f
https://hg.mozilla.org/mozilla-central/rev/5ef5c4e6b312
https://hg.mozilla.org/mozilla-central/rev/ee062bce8602
https://hg.mozilla.org/mozilla-central/rev/ddf3ed2c3a1b
https://hg.mozilla.org/mozilla-central/rev/01ced0fd2198
https://hg.mozilla.org/mozilla-central/rev/7ad1607be0b8
https://hg.mozilla.org/mozilla-central/rev/0df9f2cf61a8
https://hg.mozilla.org/mozilla-central/rev/673d41c6f7bb
https://hg.mozilla.org/mozilla-central/rev/396397bcb38b
https://hg.mozilla.org/mozilla-central/rev/8d6c7503f22f
https://hg.mozilla.org/mozilla-central/rev/c9deed70f209
https://hg.mozilla.org/mozilla-central/rev/39566c2dd7c7
https://hg.mozilla.org/mozilla-central/rev/0721eefdd313
https://hg.mozilla.org/mozilla-central/rev/6f104bf1520f
https://hg.mozilla.org/mozilla-central/rev/b9ba8d904b0f
https://hg.mozilla.org/mozilla-central/rev/0d355fc784ab
https://hg.mozilla.org/mozilla-central/rev/68876db19421
https://hg.mozilla.org/mozilla-central/rev/bf2723998f5c

Comment 63

[Jeff Walden [:Waldo]]

Attachment: Bug 949220 - Move PlainObject to vm/PlainObject{,-inl}.h. r=jandem!

Comment 64

[Jeff Walden [:Waldo]]

Attachment: Bug 949220 - Move various create-this functions that deal in |PlainObject*| to PlainObject.*. r=jandem!

Depends on D71111

Comment 65

[Phabricator Automation]

Comment on attachment 9140895 [details]
Bug 949220 - Move PlainObject to vm/PlainObject{,-inl}.h. r=jandem!

Revision D71111 was moved to bug 1630346. Setting attachment 9140895 [details] to obsolete.

Comment 66

[Phabricator Automation]

Comment on attachment 9140896 [details]
Bug 949220 - Move various create-this functions that deal in |PlainObject*| to PlainObject.*. r=jandem!

Revision D71112 was moved to bug 1630346. Setting attachment 9140896 [details] to obsolete.

Comment 67

[Jeff Walden [:Waldo]]

Attachment: Bug 949220 - Adjust some |NewObjectWithGivenTaggedProto| overloads so fewer users must specify an object kind. r=jandem!

Depends on D70516

Comment 68

[Jeff Walden [:Waldo]]

Attachment: Bug 949220 - Add |NewSingletonObjectWithGivenTaggedProtoAndKind| to encode singleton-ness into function name for one caller. r=jandem!

Depends on D71270

Comment 69

[Jeff Walden [:Waldo]]

Attachment: Bug 949220 - Make |js::CloneObject| take a |JSObject*| prototype argument, not a |TaggedProto|. r=jandem!

Depends on D71271

Comment 70

[Jeff Walden [:Waldo]]

Attachment: Bug 949220 - Inline |js::CloneObject| into its sole caller. r=jandem!

Depends on D71272

Comment 71

[Jeff Walden [:Waldo]]

Attachment: Bug 949220 - Make |NewObjectWithGivenTaggedProto| accept three arguments and take |NewObjectKind| as template parameter. r=jandem!

Depends on D71273

Comment 72

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/b25d763a3d67
Inline |ProxyObject::create| into its sole caller, and simplify the resulting code.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/6c60e7fceaa0
Remove |NurseryAllocatedProxy| now that it's unused.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/d85d4d198864
Adjust some |NewObjectWithGivenTaggedProto| overloads so fewer users must specify an object kind.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/ba0ef525da5d
Add |NewSingletonObjectWithGivenTaggedProtoAndKind| to encode singleton-ness into function name for one caller.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/0c6e7d41cb06
Make |js::CloneObject| take a |JSObject*| prototype argument, not a |TaggedProto|.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/50526bdc2a82
Inline |js::CloneObject| into its sole caller.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/f44d32cba0ec
Make |NewObjectWithGivenTaggedProto| accept three arguments and take |NewObjectKind| as template parameter.  r=jandem

Comment 73

[Alexandru Michis [:malexandru]]

Backed out 7 changesets for causing failures in Compartment.h

Backout link: https://hg.mozilla.org/integration/autoland/rev/5befd8ec1e64755f779bd64517938219cf899193

Push with failures: https://treeherder.mozilla.org/#/jobs?repo=autoland&resultStatus=testfailed%2Cbusted%2Cexception%2Crunnable&revision=f44d32cba0ece1254c2c65286be2fdc9472bce22&selectedJob=298156457

Failure log: https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=298156457&repo=autoland&lineNumber=5213

Comment 74

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/5c98ae55c819
Inline |ProxyObject::create| into its sole caller, and simplify the resulting code.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/b22d46e3f075
Remove |NurseryAllocatedProxy| now that it's unused.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/f218f8a4397f
Adjust some |NewObjectWithGivenTaggedProto| overloads so fewer users must specify an object kind.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/e35319d52752
Add |NewSingletonObjectWithGivenTaggedProtoAndKind| to encode singleton-ness into function name for one caller.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/3730826d5f09
Make |js::CloneObject| take a |JSObject*| prototype argument, not a |TaggedProto|.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/785f96e2d9ca
Inline |js::CloneObject| into its sole caller.  r=jandem
https://hg.mozilla.org/integration/autoland/rev/c0376a215632
Make |NewObjectWithGivenTaggedProto| accept three arguments and take |NewObjectKind| as template parameter.  r=jandem

Comment 75

[Noemi Erli[:noemi_erli]]

https://hg.mozilla.org/mozilla-central/rev/5c98ae55c819
https://hg.mozilla.org/mozilla-central/rev/b22d46e3f075
https://hg.mozilla.org/mozilla-central/rev/f218f8a4397f
https://hg.mozilla.org/mozilla-central/rev/e35319d52752
https://hg.mozilla.org/mozilla-central/rev/3730826d5f09
https://hg.mozilla.org/mozilla-central/rev/785f96e2d9ca
https://hg.mozilla.org/mozilla-central/rev/c0376a215632

Comment 76

[BugBot [:suhaib / :marco/ :calixte]]

The leave-open keyword is there and there is no activity for 6 months.
:sdetar, maybe it's time to close this bug?

Comment 77

[Nicolas B. Pierron [:nbp]]

Jan / Waldo, can you close this bug if it is completed, and remove the leave-open tag?
Otherwise mention what remains to be done, and maybe open another bug.

Comment 78

[Jan de Mooij [:jandem]]

Leaving the NI for Waldo, but it might make sense to close this bug so that we don't have a bug with patches spanning multiple releases (over 6+ months even).

Comment 79

[BugBot [:suhaib / :marco/ :calixte]]

The leave-open keyword is there and there is no activity for 6 months.
:sdetar, maybe it's time to close this bug?

Comment 80

[Steven DeTar [:sdetar]]

Waldo, can we close this bug now?

Comment 81

[BugBot [:suhaib / :marco/ :calixte]]

The leave-open keyword is there and there is no activity for 6 months.
:sdetar, maybe it's time to close this bug?

Comment 82

[BugBot [:suhaib / :marco/ :calixte]]

The bug assignee didn't login in Bugzilla in the last months and this bug has severity 'critical'.
:sdetar, could you have a look please?
For more information, please visit auto_nag documentation.

Comment 83

[BugBot [:suhaib / :marco/ :calixte]]

Redirect a needinfo that is pending on an inactive user to the triage owner.
:sdetar, since the bug has high severity, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 84

[Jan de Mooij [:jandem]]

Singleton objects no longer exist, so setSingleton is not an issue anymore. Also, a lot of changes landed in this bug a long time ago, I think we should close this.