Closed Bug 1288952 Opened 9 years ago Closed 7 months ago

Crash in UnmarkGrayTracer::onChild

Categories

(Core :: JavaScript Engine, defect, P5)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
Windows 7
Type:
defect

Tracking

()

Status:
RESOLVED WORKSFORME
Tracking Flags:
Tracking Status
firefox48 --- affected
firefox49 --- affected
firefox-esr45 --- affected
firefox50 --- affected
firefox51 --- affected
firefox52 --- wontfix
firefox57 --- affected

People

(Reporter: baffclan, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: crash, Whiteboard: [tbird crash])

Crash Data

When I was scrolling on twitter, crashed. This bug was filed from the Socorro interface and is report bp-e4ae2b1f-6f18-440a-aa38-d8f5c2160724. ============================================================= Crashing Thread (0) Frame Module Signature Source 0 xul.dll UnmarkGrayTracer::onChild(JS::GCCellPtr const&) js/src/gc/Marking.cpp:2745 1 xul.dll JS::CallbackTracer::onShapeEdge(js::Shape**) obj-firefox/dist/include/js/TracingAPI.h:146 2 xul.dll DispatchToTracer<js::Shape*>(JSTracer*, js::Shape**, char const*) js/src/gc/Marking.cpp:655 3 xul.dll JS::DispatchTraceKindTyped<TraceChildrenFunctor, JSTracer*&, void*&>(TraceChildrenFunctor, JS::TraceKind, JSTracer*&, void*&) obj-firefox/dist/include/js/TraceKind.h:182 4 xul.dll js::DispatchTyped<DoCallbackFunctor<JS::Value>, JS::CallbackTracer*&, char const*&>(DoCallbackFunctor<JS::Value>, JS::Value const&, JS::CallbackTracer*&, char const*&) obj-firefox/dist/include/js/Value.h:1914 5 xul.dll DispatchToTracer<JS::Value>(JSTracer*, JS::Value*, char const*) js/src/gc/Marking.cpp:655 6 xul.dll JS::DispatchTraceKindTyped<TraceChildrenFunctor, JSTracer*&, void*&>(TraceChildrenFunctor, JS::TraceKind, JSTracer*&, void*&) obj-firefox/dist/include/js/TraceKind.h:182 7 xul.dll js::DispatchTyped<DoCallbackFunctor<JS::Value>, JS::CallbackTracer*&, char const*&>(DoCallbackFunctor<JS::Value>, JS::Value const&, JS::CallbackTracer*&, char const*&) obj-firefox/dist/include/js/Value.h:1914 8 xul.dll DispatchToTracer<JS::Value>(JSTracer*, JS::Value*, char const*) js/src/gc/Marking.cpp:655 9 xul.dll JS::DispatchTraceKindTyped<TraceChildrenFunctor, JSTracer*&, void*&>(TraceChildrenFunctor, JS::TraceKind, JSTracer*&, void*&) obj-firefox/dist/include/js/TraceKind.h:182 10 xul.dll js::DispatchTyped<DoCallbackFunctor<JS::Value>, JS::CallbackTracer*&, char const*&>(DoCallbackFunctor<JS::Value>, JS::Value const&, JS::CallbackTracer*&, char const*&) obj-firefox/dist/include/js/Value.h:1914 11 xul.dll DispatchToTracer<JS::Value>(JSTracer*, JS::Value*, char const*) js/src/gc/Marking.cpp:655 12 xul.dll JS::DispatchTraceKindTyped<TraceChildrenFunctor, JSTracer*&, void*&>(TraceChildrenFunctor, JS::TraceKind, JSTracer*&, void*&) obj-firefox/dist/include/js/TraceKind.h:182 13 xul.dll UnmarkGrayTracer::onChild(JS::GCCellPtr const&) js/src/gc/Marking.cpp:2748 14 xul.dll JS::CallbackTracer::onObjectEdge(JSObject**) obj-firefox/dist/include/js/TracingAPI.h:141 15 xul.dll DoCallback<JSObject*>(JS::CallbackTracer*, JSObject**, char const*) js/src/gc/Tracer.cpp:51 16 xul.dll JSFunction::trace(JSTracer*) js/src/jsfun.cpp:779 17 xul.dll JSObject::traceChildren(JSTracer*) js/src/jsobj.cpp:3883 18 xul.dll TypedUnmarkGrayCellRecursively<JSObject> js/src/gc/Marking.cpp:2792 19 xul.dll JS::UnmarkGrayGCThingRecursively(JS::GCCellPtr) js/src/gc/Marking.cpp:2816 20 xul.dll mozilla::dom::CallbackObject::MarkForCC() obj-firefox/dist/include/mozilla/dom/CallbackObject.h:100 21 xul.dll mozilla::EventListenerManager::MarkForCC() dom/events/EventListenerManager.cpp:1629 22 xul.dll nsContentUtils::UnmarkGrayJSListenersInCCGenerationDocuments() dom/base/nsContentUtils.cpp:4234 23 xul.dll nsCCUncollectableMarker::Observe(nsISupports*, char const*, char16_t const*) dom/base/nsCCUncollectableMarker.cpp:444 24 xul.dll nsObserverList::NotifyObservers(nsISupports*, char const*, char16_t const*) xpcom/ds/nsObserverList.cpp:112 25 xul.dll nsObserverService::NotifyObservers(nsISupports*, char const*, char16_t const*) xpcom/ds/nsObserverService.cpp:305 26 xul.dll XPCJSRuntime::PrepareForForgetSkippable() js/xpconnect/src/XPCJSRuntime.cpp:665 27 xul.dll nsCycleCollector::ForgetSkippable(bool, bool) xpcom/base/nsCycleCollector.cpp:2879 28 xul.dll FireForgetSkippable dom/base/nsJSEnvironment.cpp:1245 29 xul.dll CCTimerFired dom/base/nsJSEnvironment.cpp:1793 30 xul.dll nsTimerImpl::Fire() xpcom/threads/nsTimerImpl.cpp:524 31 xul.dll nsTimerEvent::Run() xpcom/threads/TimerThread.cpp:286 32 xul.dll nsThread::ProcessNextEvent(bool, bool*) xpcom/threads/nsThread.cpp:1068 33 xul.dll NS_ProcessNextEvent(nsIThread*, bool) xpcom/glue/nsThreadUtils.cpp:290 34 xul.dll mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) ipc/glue/MessagePump.cpp:132 35 xul.dll MessageLoop::RunHandler() ipc/chromium/src/base/message_loop.cc:225 36 xul.dll MessageLoop::Run() ipc/chromium/src/base/message_loop.cc:205 37 xul.dll nsBaseAppShell::Run() widget/nsBaseAppShell.cpp:156 38 xul.dll nsAppShell::Run() widget/windows/nsAppShell.cpp:262 39 xul.dll nsAppStartup::Run() toolkit/components/startup/nsAppStartup.cpp:284 40 xul.dll XREMain::XRE_mainRun() toolkit/xre/nsAppRunner.cpp:4214 41 xul.dll XREMain::XRE_main(int, char** const, nsXREAppData const*) toolkit/xre/nsAppRunner.cpp:4341 42 xul.dll XRE_main toolkit/xre/nsAppRunner.cpp:4432 43 firefox.exe do_main browser/app/nsBrowserApp.cpp:247 44 firefox.exe wmain toolkit/xre/nsWindowsWMain.cpp:115 45 firefox.exe __scrt_common_main_seh f:/dd/vctools/crt/vcstartup/src/startup/exe_common.inl:255 46 kernel32.dll BaseThreadInitThunk 47 ntdll.dll RtlUserThreadStart Application Basics Name: Firefox Version: 50.0a1 Build ID: 20160723030206 User Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:50.0) Gecko/20100101 Firefox/50.0 OS: Windows_NT 6.1
Crash volume for signature 'UnmarkGrayTracer::onChild': - nightly (version 50): 6 crashes from 2016-06-06. - aurora (version 49): 19 crashes from 2016-06-07. - beta (version 48): 533 crashes from 2016-06-06. - release (version 47): 981 crashes from 2016-05-31. - esr (version 45): 32 crashes from 2016-04-07. Crash volume on the last weeks: W. N-1 W. N-2 W. N-3 W. N-4 W. N-5 W. N-6 W. N-7 - nightly 1 1 1 2 0 0 0 - aurora 5 1 2 1 4 5 1 - beta 64 80 88 68 69 60 71 - release 121 131 140 132 129 119 123 - esr 0 2 3 6 3 4 2 Affected platforms: Windows, Mac OS X, Linux
status-firefox48: --- → affected
status-firefox49: --- → affected
status-firefox-esr45: --- → affected
Crash volume for signature 'UnmarkGrayTracer::onChild': - nightly (version 51): 7 crashes from 2016-08-01. - aurora (version 50): 6 crashes from 2016-08-01. - beta (version 49): 165 crashes from 2016-08-02. - release (version 48): 197 crashes from 2016-07-25. - esr (version 45): 34 crashes from 2016-05-02. Crash volume on the last weeks (Week N is from 08-22 to 08-28): W. N-1 W. N-2 W. N-3 - nightly 1 2 3 - aurora 1 2 1 - beta 55 50 22 - release 65 58 34 - esr 0 1 6 Affected platforms: Windows, Mac OS X, Linux Crash rank on the last 7 days: Browser Content Plugin - nightly #582 - aurora #281 - beta #300 #246 - release #392 #582 - esr #1657
status-firefox51: --- → affected
Crash volume for signature 'UnmarkGrayTracer::onChild': - nightly (version 52): 4 crashes from 2016-09-19. - aurora (version 51): 3 crashes from 2016-09-19. - beta (version 50): 51 crashes from 2016-09-20. - release (version 49): 149 crashes from 2016-09-05. - esr (version 45): 41 crashes from 2016-06-01. Crash volume on the last weeks (Week N is from 10-03 to 10-09): W. N-1 W. N-2 - nightly 3 1 - aurora 3 0 - beta 41 10 - release 115 33 - esr 2 1 Affected platforms: Windows, Mac OS X, Linux Crash rank on the last 7 days: Browser Content Plugin - nightly #751 #305 - aurora #1180 #376 - beta #466 #258 - release #535 #352 - esr #1915
status-firefox52: --- → affected
Too late for firefox 52, mass-wontfix.
status-firefox52: affected → wontfix
Thunderbird user bp-93cc6bdb-67f7-4348-988c-194530170608 ... also crashes with js::GCMarker::markAndPush<T> (bug 1374742) bp-39664a43-9e90-428e-b29d-584f70170610 The overall crash rate quadrupled early March, then dropped considerably mid-April https://crash-stats.mozilla.com/signature/?signature=UnmarkGrayTracer%3A%3AonChild&date=%3E%3D2017-01-07T16%3A05%3A47.000Z&date=%3C2017-07-07T16%3A05%3A47.000Z#graphs
See Also: → 1374742
Whiteboard: [tbird crash]
Jon please take a look
status-firefox57: --- → affected
Flags: needinfo?(jcoppeard)
Priority: -- → P2
This isn't actionable as it is, but I'm going to investigate how we can track down crashes like this in bug 1399944.
Flags: needinfo?(jcoppeard)
Blocks: GCCrashes
See Also: → 815141

Jon, do you think you could help answer Wayne's question in comment 8?

Flags: needinfo?(sdetar) → needinfo?(jcoppeard)

This is most likely memory corruption.

Flags: needinfo?(jcoppeard)
Keywords: stalled
Priority: P2 → P5

Hey Jon,
Could this crash still be worth keeping or should we close it?

Flags: needinfo?(jcoppeard)

Generally we keep these bugs open and mark them as stalled.

Flags: needinfo?(jcoppeard)
QA Whiteboard: qa-not-actionable

Closing because no crashes reported for 12 weeks.

Status: NEW → RESOLVED
Closed: 7 months ago
Resolution: --- → WORKSFORME

Since the bug is closed, the stalled keyword is now meaningless.
For more information, please visit BugBot documentation.

Keywords: stalled
You need to log in before you can comment on or make changes to this bug.