Closed Bug 1237795 Opened 9 years ago Closed 8 years ago

Intermittent browser_wa_properties-view-params.js,browser_wa_reset-02.js | Found a tab after previous test timed out: doc_simple-context.html | application crashed [@ js::gc::ZoneCellIterUnderGC::ZoneCellIterUnderGC(JS::Zone*, js::gc::AllocKind)]

Categories

(Core :: JavaScript: GC, defect, P5)

Product:
Core
Component:
JavaScript: GC
Type:
defect

Tracking

()

Status:
RESOLVED WORKSFORME
Tracking Flags:
Tracking Status
e10s + ---
firefox46 --- wontfix
firefox47 --- wontfix
firefox48 --- affected
firefox49 --- affected
firefox50 --- affected

People

(Reporter: KWierso, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, crash, intermittent-failure) 

This is a low-frequency intermittent, but what concerns me is the GC assertion/crash that appears to accompany it:
Assertion failure: rt->gc.nursery.isEmpty(), at c:\builds\moz2_slave\try-w32-d-00000000000000000000\build\src\js\src\jsgcinlines.h:201
[@ js::gc::ZoneCellIterUnderGC::ZoneCellIterUnderGC(JS::Zone *,js::gc::AllocKind)]
Blocks: e10s-tests
status-firefox46: --- → unaffected
status-firefox47: --- → affected
status-firefox48: --- → affected
tracking-e10s: --- → ?
Component: Developer Tools: Web Audio Editor → JavaScript: GC
Flags: needinfo?(jcoppeard)
Keywords: assertion, crash
Product: Firefox → Core
I can't immediately see how this can happen.  I'll take a look when I get back from PTO.
Intermittent e10s test failure
Priority: -- → P5
I'm working on tracking down a regression range for this on the hopes that it'll shed some light on bug 1262015.
status-firefox47: affected → wontfix
status-firefox49: --- → affected
status-firefox50: --- → affected
Summary: Intermittent browser_wa_reset-02.js | Found a tab after previous test timed out: doc_simple-context.html - → Intermittent browser_wa_properties-view-params.js,browser_wa_reset-02.js | Found a tab after previous test timed out: doc_simple-context.html | application crashed [@ js::gc::ZoneCellIterUnderGC::ZoneCellIterUnderGC(JS::Zone*, js::gc::AllocKind)]
Regression range: https://hg.mozilla.org/integration/fx-team/pushloghtml?fromchange=89c1cc2faea8&tochange=256e3e81fed7

Try bisection is strongly pointing at bug 1132501 as when this started (150 green runs on the push prior, crashing within 20 runs on rev 256e3e81fed7). So a devtools change is causing GC asserts/crashes?
Blocks: 1132501
status-firefox46: unaffected → wontfix
I wouldn't be surprised if connecting a debugger to the page exposed bugs like this. It "instruments" the code in a lot of ways. The only thing that would be weird is if the test doesn't open the devtools.
All of the associations in comment 11 are really bug 1285232.

Given that we made several fixes to ZoneCellIterUnderGC earlier in the year and there have been no genuine reports since March, I'm going to close this.
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.