Closed Bug 975849 (needcollect) Opened 12 years ago Closed 12 years ago

Intermittent test_423060.xul,test_event_local_key.html | application crashed [@ mozilla::CycleCollectedJSRuntime::TraverseRoots(nsCycleCollectionNoteRootCallback &)] after Assertion failure: !NeedCollect() (Cannot cycle collect if GC has not run first!)

Categories

(Core :: XPCOM, defect)

Product:
Core
Component:
XPCOM
Platform:
x86
Windows 8
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla30
Tracking Flags:
Tracking Status
firefox28 --- unaffected
firefox29 --- unaffected
firefox30 --- fixed
firefox-esr24 --- unaffected

People

(Reporter: philor, Assigned: mccr8)

References

Details

(Keywords: assertion, intermittent-failure)

Attachments

(1 file)

Remove overly strict assertion from CycleCollectedJSRuntime::TraverseRoots to restore previous behavior.
875 bytes, patch
smaug
: review+
Details | Diff | Splinter Review
https://tbpl.mozilla.org/php/getParsedLog.php?id=35119710&tree=Mozilla-Central WINNT 6.2 mozilla-central debug test mochitest-other on 2014-02-23 10:33:18 PST for push 31113754db3b slave: t-w864-ix-112 10:37:16 INFO - 7 INFO TEST-START | chrome://mochitests/content/chrome/browser/components/feeds/test/chrome/test_423060.xul 10:37:16 INFO - --DOMWINDOW == 31 (0FF22BC0) [pid = 2256] [serial = 9] [outer = 0FF20740] [url = about:blank] 10:37:16 INFO - --DOMWINDOW == 30 (12579DE0) [pid = 2256] [serial = 21] [outer = 12578DE8] [url = about:blank] 10:37:16 INFO - --DOMWINDOW == 29 (12579B98) [pid = 2256] [serial = 22] [outer = 125794C0] [url = about:blank] 10:37:16 INFO - --DOMWINDOW == 28 (12149038) [pid = 2256] [serial = 31] [outer = 10780D90] [url = about:blank] 10:37:16 INFO - Assertion failure: !NeedCollect() (Cannot cycle collect if GC has not run first!), at c:\builds\moz2_slave\m-cen-w32-d-000000000000000000\build\xpcom\base\CycleCollectedJSRuntime.cpp:880 10:37:17 WARNING - TEST-UNEXPECTED-FAIL | chrome://mochitests/content/chrome/browser/components/feeds/test/chrome/test_423060.xul | application terminated with exit code 2147483651 10:37:17 INFO - INFO | runtests.py | Application ran for: 0:00:15.701000 10:37:17 INFO - INFO | zombiecheck | Reading PID log: c:\users\cltbld~1.t-w\appdata\local\temp\tmpt7044vpidlog 10:37:24 WARNING - PROCESS-CRASH | chrome://mochitests/content/chrome/browser/components/feeds/test/chrome/test_423060.xul | application crashed [@ mozilla::CycleCollectedJSRuntime::TraverseRoots(nsCycleCollectionNoteRootCallback &)] 10:37:24 INFO - Crash dump filename: c:\users\cltbld~1.t-w\appdata\local\temp\tmpwnxtcr\minidumps\6d2e9cdb-53a9-4191-8bd6-2bf1eb892a7b.dmp 10:37:24 INFO - Operating system: Windows NT 10:37:24 INFO - 6.2.9200 10:37:24 INFO - CPU: x86 10:37:24 INFO - GenuineIntel family 6 model 30 stepping 5 10:37:24 INFO - 8 CPUs 10:37:24 INFO - Crash reason: EXCEPTION_BREAKPOINT 10:37:24 INFO - Crash address: 0x71cd6b62 10:37:24 INFO - Thread 0 (crashed) 10:37:24 INFO - 0 xul.dll!mozilla::CycleCollectedJSRuntime::TraverseRoots(nsCycleCollectionNoteRootCallback &) [CycleCollectedJSRuntime.cpp:31113754db3b : 880 + 0x20] 10:37:24 INFO - eip = 0x71cd6b62 esp = 0x004fc260 ebp = 0x004fc2a0 ebx = 0x0074a780 10:37:24 INFO - esi = 0x0650b180 edi = 0x00000000 eax = 0x00000000 ecx = 0x160d34d3 10:37:24 INFO - edx = 0x71c6e4d8 efl = 0x00000216 10:37:24 INFO - Found by: given as instruction pointer in context 10:37:24 INFO - 1 xul.dll!nsCycleCollector::BeginCollection(ccType,nsICycleCollectorListener *) [nsCycleCollector.cpp:31113754db3b : 3361 + 0x1e] 10:37:24 INFO - eip = 0x71cdfc79 esp = 0x004fc2a8 ebp = 0x004fc2e0 10:37:24 INFO - Found by: call frame info 10:37:24 INFO - 2 xul.dll!nsCycleCollector::Collect(ccType,js::SliceBudget &,nsICycleCollectorListener *) [nsCycleCollector.cpp:31113754db3b : 3211 + 0xc] 10:37:24 INFO - eip = 0x71ce0383 esp = 0x004fc2e8 ebp = 0x004fc30c 10:37:24 INFO - Found by: call frame info 10:37:24 INFO - 3 xul.dll!nsCycleCollector_collect(nsICycleCollectorListener *) [nsCycleCollector.cpp:31113754db3b : 3760 + 0x16] 10:37:24 INFO - eip = 0x71ce04af esp = 0x004fc314 ebp = 0x004fc338 10:37:24 INFO - Found by: call frame info 10:37:24 INFO - 4 xul.dll!nsJSContext::CycleCollectNow(nsICycleCollectorListener *,int) [nsJSEnvironment.cpp:31113754db3b : 2109 + 0x7] 10:37:24 INFO - eip = 0x7290e882 esp = 0x004fc340 ebp = 0x004fc34c 10:37:24 INFO - Found by: call frame info 10:37:24 INFO - 5 xul.dll!nsDOMWindowUtils::GarbageCollect(nsICycleCollectorListener *,int) [nsDOMWindowUtils.cpp:31113754db3b : 1402 + 0xa] 10:37:24 INFO - eip = 0x728d97a0 esp = 0x004fc354 ebp = 0x004fc388 10:37:24 INFO - Found by: call frame info 10:37:24 INFO - 6 xul.dll!NS_InvokeByIndex [xptcinvoke.cpp:31113754db3b : 70 + 0x2] 10:37:24 INFO - eip = 0x71d29859 esp = 0x004fc390 ebp = 0x004fc3a4 10:37:24 INFO - Found by: call frame info 10:37:24 INFO - 7 xul.dll!CallMethodHelper::Invoke() [XPCWrappedNative.cpp:31113754db3b : 2403 + 0xe] 10:37:24 INFO - eip = 0x7286c5cf esp = 0x004fc3ac ebp = 0x004fc3d0 10:37:24 INFO - Found by: call frame info 10:37:24 INFO - 8 xul.dll!CallMethodHelper::Call() [XPCWrappedNative.cpp:31113754db3b : 1744 + 0x6] 10:37:24 INFO - eip = 0x72878169 esp = 0x004fc3c0 ebp = 0x004fc3d0 10:37:24 INFO - Found by: call frame info ...
Ok, I guess what I told Terrence was wrong.
Assignee: nobody → continuation
https://tbpl.mozilla.org/php/getParsedLog.php?id=35145099&tree=B2g-Inbound
Alias: needcollect
Summary: Intermittent test_423060.xul | application crashed [@ mozilla::CycleCollectedJSRuntime::TraverseRoots(nsCycleCollectionNoteRootCallback &)] after Assertion failure: !NeedCollect() (Cannot cycle collect if GC has not run first!) → Intermittent test_423060.xul,test_event_local_key.html | application crashed [@ mozilla::CycleCollectedJSRuntime::TraverseRoots(nsCycleCollectionNoteRootCallback &)] after Assertion failure: !NeedCollect() (Cannot cycle collect if GC has not run first!)
Blocks: 956081
The problem here is that the old check was just "have we never run the GC yet?", whereas the new check is more like, "have we never run the GC yet, or overflowed the stack while running UnmarkGray?". We run FreeSnowWhite() after we run FixGrayBits(), which can call arbitrary dtors, so I could imagine that one of them triggers an UnmarkGrayCall that can sometimes overflow the stack. In theory, triggering FixGrayBits() can require a new FreeSnowWhite() call, so in order to really get this "right", we would want to run them together in a loop until it stabilizes, but that could be bad in the worst case. I think for now the right thing to do is to just remove this assert, which will restore the current behavior, as FixGrayBits() will ensure that we have run at least one full GC before triggering the CC.
Comment on attachment 8381917 [details] [diff] [review] Remove overly strict assertion from CycleCollectedJSRuntime::TraverseRoots to restore previous behavior. Oops, I forgot to set the review flag.
Attachment #8381917 - Flags: review?(bugs)
Comment on attachment 8381917 [details] [diff] [review] Remove overly strict assertion from CycleCollectedJSRuntime::TraverseRoots to restore previous behavior. I guess. Do we want to add back some "has gc run" check. I guess that needs something new in JS engine. Some flag somewhere.
Attachment #8381917 - Flags: review?(bugs) → review+
That's what we were doing before, but for some reason it won't work with generational GC.
I guess this should get left open until it propagates to all branches, though I just removed the assertion, so my patch should def. fix it.
Keywords: leave-open
Nah, not only do we not much care whether we're starring in a closed or an open bug, but also, merging back around to all three integration branches is part of the same job as merging to m-c, so you're only talking about the runs that are already in progress at the time this would be closed, anyway.
Keywords: leave-open
https://hg.mozilla.org/mozilla-central/rev/eebc9dfce3f4
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla30
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: