Closed Bug 975849 (needcollect) Opened 10 years ago Closed 10 years ago

Intermittent test_423060.xul,test_event_local_key.html | application crashed [@ mozilla::CycleCollectedJSRuntime::TraverseRoots(nsCycleCollectionNoteRootCallback &)] after Assertion failure: !NeedCollect() (Cannot cycle collect if GC has not run first!)

Categories

(Core :: XPCOM, defect)

Product:
Core
Component:
XPCOM
Platform:
x86
Windows 8
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla30
Tracking Flags:
Tracking Status
firefox28 --- unaffected
firefox29 --- unaffected
firefox30 --- fixed
firefox-esr24 --- unaffected

People

(Reporter: philor, Assigned: mccr8)

References

Details

(Keywords: assertion, intermittent-failure)

Attachments

(1 file)

Remove overly strict assertion from CycleCollectedJSRuntime::TraverseRoots to restore previous behavior.
875 bytes, patch
smaug
: review+
Details | Diff | Splinter Review 
https://tbpl.mozilla.org/php/getParsedLog.php?id=35119710&tree=Mozilla-Central
WINNT 6.2 mozilla-central debug test mochitest-other on 2014-02-23 10:33:18 PST for push 31113754db3b
slave: t-w864-ix-112

10:37:16     INFO -  7 INFO TEST-START | chrome://mochitests/content/chrome/browser/components/feeds/test/chrome/test_423060.xul
10:37:16     INFO -  --DOMWINDOW == 31 (0FF22BC0) [pid = 2256] [serial = 9] [outer = 0FF20740] [url = about:blank]
10:37:16     INFO -  --DOMWINDOW == 30 (12579DE0) [pid = 2256] [serial = 21] [outer = 12578DE8] [url = about:blank]
10:37:16     INFO -  --DOMWINDOW == 29 (12579B98) [pid = 2256] [serial = 22] [outer = 125794C0] [url = about:blank]
10:37:16     INFO -  --DOMWINDOW == 28 (12149038) [pid = 2256] [serial = 31] [outer = 10780D90] [url = about:blank]
10:37:16     INFO -  Assertion failure: !NeedCollect() (Cannot cycle collect if GC has not run first!), at c:\builds\moz2_slave\m-cen-w32-d-000000000000000000\build\xpcom\base\CycleCollectedJSRuntime.cpp:880
10:37:17  WARNING -  TEST-UNEXPECTED-FAIL | chrome://mochitests/content/chrome/browser/components/feeds/test/chrome/test_423060.xul | application terminated with exit code 2147483651
10:37:17     INFO -  INFO | runtests.py | Application ran for: 0:00:15.701000
10:37:17     INFO -  INFO | zombiecheck | Reading PID log: c:\users\cltbld~1.t-w\appdata\local\temp\tmpt7044vpidlog
10:37:24  WARNING -  PROCESS-CRASH | chrome://mochitests/content/chrome/browser/components/feeds/test/chrome/test_423060.xul | application crashed [@ mozilla::CycleCollectedJSRuntime::TraverseRoots(nsCycleCollectionNoteRootCallback &)]
10:37:24     INFO -  Crash dump filename: c:\users\cltbld~1.t-w\appdata\local\temp\tmpwnxtcr\minidumps\6d2e9cdb-53a9-4191-8bd6-2bf1eb892a7b.dmp
10:37:24     INFO -  Operating system: Windows NT
10:37:24     INFO -                    6.2.9200
10:37:24     INFO -  CPU: x86
10:37:24     INFO -       GenuineIntel family 6 model 30 stepping 5
10:37:24     INFO -       8 CPUs
10:37:24     INFO -  Crash reason:  EXCEPTION_BREAKPOINT
10:37:24     INFO -  Crash address: 0x71cd6b62
10:37:24     INFO -  Thread 0 (crashed)
10:37:24     INFO -   0  xul.dll!mozilla::CycleCollectedJSRuntime::TraverseRoots(nsCycleCollectionNoteRootCallback &) [CycleCollectedJSRuntime.cpp:31113754db3b : 880 + 0x20]
10:37:24     INFO -      eip = 0x71cd6b62   esp = 0x004fc260   ebp = 0x004fc2a0   ebx = 0x0074a780
10:37:24     INFO -      esi = 0x0650b180   edi = 0x00000000   eax = 0x00000000   ecx = 0x160d34d3
10:37:24     INFO -      edx = 0x71c6e4d8   efl = 0x00000216
10:37:24     INFO -      Found by: given as instruction pointer in context
10:37:24     INFO -   1  xul.dll!nsCycleCollector::BeginCollection(ccType,nsICycleCollectorListener *) [nsCycleCollector.cpp:31113754db3b : 3361 + 0x1e]
10:37:24     INFO -      eip = 0x71cdfc79   esp = 0x004fc2a8   ebp = 0x004fc2e0
10:37:24     INFO -      Found by: call frame info
10:37:24     INFO -   2  xul.dll!nsCycleCollector::Collect(ccType,js::SliceBudget &,nsICycleCollectorListener *) [nsCycleCollector.cpp:31113754db3b : 3211 + 0xc]
10:37:24     INFO -      eip = 0x71ce0383   esp = 0x004fc2e8   ebp = 0x004fc30c
10:37:24     INFO -      Found by: call frame info
10:37:24     INFO -   3  xul.dll!nsCycleCollector_collect(nsICycleCollectorListener *) [nsCycleCollector.cpp:31113754db3b : 3760 + 0x16]
10:37:24     INFO -      eip = 0x71ce04af   esp = 0x004fc314   ebp = 0x004fc338
10:37:24     INFO -      Found by: call frame info
10:37:24     INFO -   4  xul.dll!nsJSContext::CycleCollectNow(nsICycleCollectorListener *,int) [nsJSEnvironment.cpp:31113754db3b : 2109 + 0x7]
10:37:24     INFO -      eip = 0x7290e882   esp = 0x004fc340   ebp = 0x004fc34c
10:37:24     INFO -      Found by: call frame info
10:37:24     INFO -   5  xul.dll!nsDOMWindowUtils::GarbageCollect(nsICycleCollectorListener *,int) [nsDOMWindowUtils.cpp:31113754db3b : 1402 + 0xa]
10:37:24     INFO -      eip = 0x728d97a0   esp = 0x004fc354   ebp = 0x004fc388
10:37:24     INFO -      Found by: call frame info
10:37:24     INFO -   6  xul.dll!NS_InvokeByIndex [xptcinvoke.cpp:31113754db3b : 70 + 0x2]
10:37:24     INFO -      eip = 0x71d29859   esp = 0x004fc390   ebp = 0x004fc3a4
10:37:24     INFO -      Found by: call frame info
10:37:24     INFO -   7  xul.dll!CallMethodHelper::Invoke() [XPCWrappedNative.cpp:31113754db3b : 2403 + 0xe]
10:37:24     INFO -      eip = 0x7286c5cf   esp = 0x004fc3ac   ebp = 0x004fc3d0
10:37:24     INFO -      Found by: call frame info
10:37:24     INFO -   8  xul.dll!CallMethodHelper::Call() [XPCWrappedNative.cpp:31113754db3b : 1744 + 0x6]
10:37:24     INFO -      eip = 0x72878169   esp = 0x004fc3c0   ebp = 0x004fc3d0
10:37:24     INFO -      Found by: call frame info
...
Ok, I guess what I told Terrence was wrong.
Assignee: nobody → continuation
https://tbpl.mozilla.org/php/getParsedLog.php?id=35145099&tree=B2g-Inbound
Alias: needcollect
Summary: Intermittent test_423060.xul | application crashed [@ mozilla::CycleCollectedJSRuntime::TraverseRoots(nsCycleCollectionNoteRootCallback &)] after Assertion failure: !NeedCollect() (Cannot cycle collect if GC has not run first!) → Intermittent test_423060.xul,test_event_local_key.html | application crashed [@ mozilla::CycleCollectedJSRuntime::TraverseRoots(nsCycleCollectionNoteRootCallback &)] after Assertion failure: !NeedCollect() (Cannot cycle collect if GC has not run first!)
Blocks: 956081
The problem here is that the old check was just "have we never run the GC yet?", whereas the new check is more like, "have we never run the GC yet, or overflowed the stack while running UnmarkGray?".  We run FreeSnowWhite() after we run FixGrayBits(), which can call arbitrary dtors, so I could imagine that one of them triggers an UnmarkGrayCall that can sometimes overflow the stack.

In theory, triggering FixGrayBits() can require a new FreeSnowWhite() call, so in order to really get this "right", we would want to run them together in a loop until it stabilizes, but that could be bad in the worst case.  I think for now the right thing to do is to just remove this assert, which will restore the current behavior, as FixGrayBits() will ensure that we have run at least one full GC before triggering the CC.
Comment on attachment 8381917 [details] [diff] [review]
Remove overly strict assertion from CycleCollectedJSRuntime::TraverseRoots to restore previous behavior.

Oops, I forgot to set the review flag.
Attachment #8381917 - Flags: review?(bugs)
Comment on attachment 8381917 [details] [diff] [review]
Remove overly strict assertion from CycleCollectedJSRuntime::TraverseRoots to restore previous behavior.

I guess.

Do we want to add back some "has gc run" check. I guess that needs something
new in JS engine. Some flag somewhere.
Attachment #8381917 - Flags: review?(bugs) → review+
That's what we were doing before, but for some reason it won't work with generational GC.
I guess this should get left open until it propagates to all branches, though I just removed the assertion, so my patch should def. fix it.
Keywords: leave-open
Nah, not only do we not much care whether we're starring in a closed or an open bug, but also, merging back around to all three integration branches is part of the same job as merging to m-c, so you're only talking about the runs that are already in progress at the time this would be closed, anyway.
Keywords: leave-open
https://hg.mozilla.org/mozilla-central/rev/eebc9dfce3f4
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla30
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: