Closed Bug 1277833 Opened 8 years ago Closed 8 years ago

[e10s] Assertion failure: typeDescrObjects.empty(), at js/src/gc/Zone.cpp:61 | runner.py | application crashed [@ JS::Zone::~Zone()]

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED
mozilla51
Tracking Status
e10s + ---
firefox49 --- wontfix
firefox50 --- fixed
firefox51 --- fixed

People

(Reporter: cbook, Assigned: mconley)

References

(Blocks 1 open bug, )

Details

(Keywords: assertion, crash, intermittent-failure)

Crash Data

https://treeherder.mozilla.org/logviewer.html#?job_id=29408604&repo=mozilla-inbound#L1385

ERROR -  PROCESS-CRASH | runner.py | application crashed [@ XUL + 0x4be504d]
 03:32:33     INFO -  Crash dump filename: /var/folders/q3/qr1dz7h156sc9qr571g_8l4r00000w/T/tmpBwg_wH.mozrunner/minidumps/75820195-FC74-4EB2-A6FF-099A3847A3A6.dmp
 03:32:33     INFO -  Operating system: Mac OS X
 03:32:33     INFO -                    10.10.5 14F27
 03:32:33     INFO -  CPU: amd64
 03:32:33     INFO -       family 6 model 69 stepping 1
 03:32:33     INFO -       4 CPUs
 03:32:33     INFO -  Crash reason:  EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
 03:32:33     INFO -  Crash address: 0x0
 03:32:33     INFO -  Process uptime: 85 seconds
 03:32:33     INFO -  Thread 0 (crashed)
 03:32:33     INFO -   0  XUL + 0x4be504d
 03:32:33     INFO -      rax = 0x0000000000000000   rdx = 0x00007fff7b35a1f8
 03:32:33     INFO -      rcx = 0x0000000000000000   rbx = 0x00007fff7b35ac50
 03:32:33     INFO -      rsi = 0x00524e0000524e00   rdi = 0x00524d0000524e03
 03:32:33     INFO -      rbp = 0x00007fff54dbdf20   rsp = 0x00007fff54dbdf00
 03:32:33     INFO -       r8 = 0x00007fff54dbdeb0    r9 = 0x00007fff7af80300
 03:32:33     INFO -      r10 = 0x0000000000000000   r11 = 0x0000000000000246
 03:32:33     INFO -      r12 = 0x000000011ee580f0   r13 = 0x000000010be32390
 03:32:33     INFO -      r14 = 0x00000000000000d4   r15 = 0x000000010be32390
 03:32:33     INFO -      rip = 0x000000010fef204d
 03:32:33     INFO -      Found by: given as instruction pointer in context
 03:32:33     INFO -   1  XUL + 0x4773ab7
 03:32:33     INFO -      rbp = 0x00007fff54dbdf90   rsp = 0x00007fff54dbdf30
 03:32:33     INFO -      rip = 0x000000010fa80ab7
 03:32:33     INFO -      Found by: previous frame's frame pointer
 03:32:33     INFO -   2  XUL + 0x47848ed
 03:32:33     INFO -      rbp = 0x00007fff54dbe070   rsp = 0x00007fff54dbdfa0
 03:32:33     INFO -      rip = 0x000000010fa918ed
 03:32:33     INFO -      Found by: previous frame's frame pointer
 03:32:33     INFO -   3  XUL + 0x47855a3
 03:32:33     INFO -      rbp = 0x00007fff54dbe0e0   rsp = 0x00007fff54dbe080
 03:32:33     INFO -      rip = 0x000000010fa925a3
 03:32:33     INFO -      Found by: previous frame's frame pointer
 03:32:33     INFO -   4  XUL + 0x4785f0b
 03:32:33     INFO -      rbp = 0x00007fff54dbe1f0   rsp = 0x00007fff54dbe0f0
 03:32:33     INFO -      rip = 0x000000010fa92f0b
 03:32:33     INFO -      Found by: previous frame's frame pointer
 03:32:33     INFO -   5  XUL + 0x4770bc6
 03:32:33     INFO -      rbp = 0x00007fff54dbe240   rsp = 0x00007fff54dbe200
 03:32:33     INFO -      rip = 0x000000010fa7dbc6
 03:32:33     INFO -      Found by: previous frame's frame pointer
 03:32:33     INFO -   6  XUL + 0x499072a
 03:32:33     INFO -      rbp = 0x00007fff54dbe2d0   rsp = 0x00007fff54dbe250
 03:32:33     INFO -      rip = 0x000000010fc9d72a
 03:32:33     INFO -      Found by: previous frame's frame pointer
 03:32:33     INFO -   7  XUL + 0x46f0066
 03:32:33     INFO -      rbp = 0x00007fff54dbe2f0   rsp = 0x00007fff54dbe2e0
 03:32:33     INFO -      rip = 0x000000010f9fd066
 03:32:33     INFO -      Found by: previous frame's frame pointer
03:32:33 INFO -
Looks like this crash happens mostly with e10s enabled only.
tracking-e10s: --- → ?
Maybe the assertion we get is related here:

https://treeherder.mozilla.org/logviewer.html#?job_id=30650102&repo=mozilla-inbound#L22287

 [..]
 23:44:17     INFO -  ERROR: GC found live Cell 0x7fb05632f418 of kind STRING at shutdown
 23:44:17     INFO -  ERROR: GC found live Cell 0x7fb05632f4f0 of kind STRING at shutdown
 23:44:17     INFO -  ERROR: GC found live Cell 0x7fb05632f610 of kind STRING at shutdown
 23:44:17 INFO - ERROR: GC found live Cell 0x7fb05632f658 of kind STRING at shutdown 
Assertion failure: typeDescrObjects.empty(), at /home/worker/workspace/build/src/js/src/gc/Zone.cpp:61

Maybe this makes it a JS engine related crash.
Component: General → JavaScript Engine
Keywords: assertion
Summary: Intermittent runner.py | application crashed [@ XUL + 0x4be504d] → [e10s] Assertion failure: typeDescrObjects.empty(), at /home/worker/workspace/build/src/js/src/gc/Zone.cpp:61 | runner.py | application crashed [@ XUL + 0x4be504d]
Probably a dupe of bug 1285075 with broken symbolification (recently fixed).
Summary: [e10s] Assertion failure: typeDescrObjects.empty(), at /home/worker/workspace/build/src/js/src/gc/Zone.cpp:61 | runner.py | application crashed [@ XUL + 0x4be504d] → [e10s] Assertion failure: typeDescrObjects.empty(), at js/src/gc/Zone.cpp:61 | runner.py | application crashed [@ XUL + 0x4be504d]
Yes it is but I would dupe the other way around given that this bug has way more information.
Crash Signature: [@ JS::Zone::~Zone()]
Summary: [e10s] Assertion failure: typeDescrObjects.empty(), at js/src/gc/Zone.cpp:61 | runner.py | application crashed [@ XUL + 0x4be504d] → [e10s] Assertion failure: typeDescrObjects.empty(), at js/src/gc/Zone.cpp:61 | runner.py | application crashed [@ JS::Zone::~Zone()]
Depends on: 1290567
This went away after bug 1290567 landed.
Assignee: nobody → mconley
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla51
You need to log in before you can comment on or make changes to this bug.