Closed Bug 981821 Opened 10 years ago Closed 10 years ago

Crash in mochitest-other during WeakMap markIteratively

Categories

(Core :: JavaScript: GC, defect)

x86_64
Linux
defect
Not set
normal

Tracking

()

RESOLVED INVALID

People

(Reporter: sfink, Unassigned)

Details

On the Maple branch, we have a reliable crash at some point during M-oth. See eg https://tbpl.mozilla.org/?tree=Maple&rev=b129030101a5

It happens on all platforms. It happens for all debug builds, but some of the opt builds escape it.

The test it happens in varies, but the top of the stack always looks like:

libxul.so!js::WeakMap<js::EncapsulatedPtr<JSObject, unsigned int>, js::EncapsulatedPtr<JSObject, unsigned int>, js::DefaultHasher<js::EncapsulatedPtr<JSObject, unsigned int> > >::markIteratively(JSTracer*) [jsweakmap.h:b129030101a5 : 165 + 0x2]
libxul.so!js::WeakMapBase::markCompartmentIteratively(JSCompartment*, JSTracer*) [jsweakmap.cpp:b129030101a5 : 42 + 0xb]
libxul.so!MarkWeakReferences<js::CompartmentsIterT<js::gc::GCZoneGroupIter> > [jsgc.cpp:b129030101a5 : 3164 + 0x7]
libxul.so!MarkGrayReferences<js::gc::GCZoneGroupIter, js::CompartmentsIterT<js::gc::GCZoneGroupIter> > [jsgc.cpp:b129030101a5 : 3205 + 0xc]
libxul.so!BeginSweepPhase [jsgc.cpp:b129030101a5 : 3215 + 0x6]
libxul.so!IncrementalCollectSlice [jsgc.cpp:b129030101a5 : 4652 + 0x4]
libxul.so!GCCycle [jsgc.cpp:b129030101a5 : 4791 + 0x21]
libxul.so!Collect [jsgc.cpp:b129030101a5 : 4929 + 0x1e]
libxul.so!js::GC(JSRuntime*, js::JSGCInvocationKind, JS::gcreason::Reason) [jsgc.cpp:b129030101a5 : 4961 + 0x2f]
libxul.so!JS::GCForReason(JSRuntime*, JS::gcreason::Reason) [jsfriendapi.cpp:b129030101a5 : 200 + 0x17]
libxul.so!nsJSContext::GarbageCollectNow(JS::gcreason::Reason, nsJSContext::IsIncremental, nsJSContext::IsCompartment, nsJSContext::IsShrinking, long long) [nsJSEnvironment.cpp:b129030101a5 : 1866 + 0xf]
libxul.so!nsDOMWindowUtils::GarbageCollect(nsICycleCollectorListener*, int) [nsDOMWindowUtils.cpp:b129030101a5 : 1402 + 0x12]
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → INVALID
You need to log in before you can comment on or make changes to this bug.