Maybe related to bug 583554, but I'm filing separately since it's a different assertion. http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1280667156.1280668037.6482.gz WINNT 5.2 mozilla-central debug test mochitests-2/5 Conservative GC scanner has missed the root 077AE120 with tag 4294967285 on the stack. Aborting. Assertion failure: false, at e:/builds/moz2_slave/mozilla-central-win32-debug/build/js/src/jsgc.cpp:2538 TEST-UNEXPECTED-FAIL | /tests/dom/src/threads/test/test_closeOnGC.html | Exited with code -1073741819 during test run

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1280667535.1280668429.8280.gz WINNT 5.2 mozilla-central debug test mochitests-2/5 Conservative GC scanner has missed the root 0DE9C090 with tag 4294967285 on the stack. Aborting. Assertion failure: false, at e:/builds/moz2_slave/mozilla-central-win32-debug/build/js/src/jsgc.cpp:2538

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1280688584.1280689352.13395.gz Conservative GC scanner has missed the root 076C0900 with tag 4294967285 on the stack. Aborting. Assertion failure: false, at e:/builds/moz2_slave/mozilla-central-win32-debug/build/js/src/jsgc.cpp:2538

I do not see from the stack traces what causes this test failures on Windows. My plan is to add more debug printouts so it would be easy to judge from the stack traces what is going on.

It seems that we don't mark the roots. 0 means that we have a valid word. Maybe we are in JSRTS_LANDING mode? Conservative GC scanner has missed the root 09B2E090 with tag -11 on the stack due to 0. Aborting. Assertion failure: false, at e:/builds/moz2_slave/tracemonkey-win32-debug/build/js/src/jsgc.cpp:2501 nsStringStats => mAllocCount: 391340 => mReallocCount: 26817 => mFreeCount: 355359 -- LEAKED 35981 !!! => mShareCount: 667973 => mAdoptCount: 43127 => mAdoptFreeCount: 43125 -- LEAKED 2 !!! NEXT ERROR TEST-UNEXPECTED-FAIL | /tests/dom/src/threads/test/test_closeOnGC.html | Exited with code -1073741819 during test run

(In reply to comment #16) > It seems that we don't mark the roots. 0 means that we have a valid word. Maybe > we are in JSRTS_LANDING mode? Landing would imply js_DestroyContext on the stack. But those are absent. Another puzzle is that the bug shows up only on Windows with platform-neutral stack traces. I am going to add even more to the abort output to help to locate the source of the bug.

This seems to be some nasty threading bug. I don't see any assertions any more with this patch.

And with the right version...

Comment on attachment 463844 [details] [diff] [review] patch >diff -r bdd944b09a53 js/src/jsapi.cpp >--- a/js/src/jsapi.cpp Fri Aug 06 21:45:25 2010 +0200 >+++ b/js/src/jsapi.cpp Sat Aug 07 14:52:49 2010 -0700 >@@ -891,43 +891,41 @@ JS_YieldRequest(JSContext *cx) > JS_PUBLIC_API(jsrefcount) > JS_SuspendRequest(JSContext *cx) > { > #ifdef JS_THREADSAFE > jsrefcount saveDepth = cx->requestDepth; > if (saveDepth == 0) > return 0; > >+ JS_THREAD_DATA(cx)->conservativeGC.enable(); > do { > cx->outstandingRequests++; /* compensate for StopRequest */ > StopRequest(cx); > } while (cx->requestDepth); > >- JS_THREAD_DATA(cx)->conservativeGC.enable(); >- > return saveDepth; > #else > return 0; > #endif > } > > JS_PUBLIC_API(void) > JS_ResumeRequest(JSContext *cx, jsrefcount saveDepth) > { > #ifdef JS_THREADSAFE > if (saveDepth == 0) > return; > >- JS_THREAD_DATA(cx)->conservativeGC.disable(); >- > JS_ASSERT(cx->outstandingRequests != 0); > do { > JS_BeginRequest(cx); > cx->outstandingRequests--; /* compensate for JS_BeginRequest */ > } while (--saveDepth != 0); >+ JS_THREAD_DATA(cx)->conservativeGC.disable(); > #endif > } > > JS_PUBLIC_API(void) > JS_Lock(JSRuntime *rt) > { > JS_LOCK_RUNTIME(rt); > }

(In reply to comment #26) > Created attachment 463844 [details] [diff] [review] > patch > > And with the right version... This is a nice catch!

Nice work Gregor.

So a conservative GC was racing with a JS_SuspendRequest? /be

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1281255272.1281256106.5995.gz#err0 s: win32-slave54 TEST-UNEXPECTED-FAIL | /tests/dom/src/threads/test/test_closeOnGC.html | Exited with code -1073741819 during test run PROCESS-CRASH | /tests/dom/src/threads/test/test_closeOnGC.html | application crashed (minidump found) Thread 0 (crashed) TEST-UNEXPECTED-FAIL | automationutils.processLeakLog() | missing output line for total leaks!

(In reply to comment #32) > So a conservative GC was racing with a JS_SuspendRequest? > Yes.

FTR we've been seeing this on Thunderbird bloat builders as well.