1195485 - Intermittent v8_7 | application crashed [@ js::CancelOffThreadIonCompile(JSCompartment *,JSScript *)]

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect, P3)

Comment 1

[Legacy TBPL/Treeherder Robot]

log: https://treeherder.mozilla.org/logviewer.html#?repo=mozilla-central&job_id=2031112
repository: mozilla-central
start_time: 2015-08-17T10:56:04
who: rvandermeulen[at]mozilla[dot]com
machine: t-w732-ix-087
buildname: Windows 7 32-bit mozilla-central pgo talos dromaeojs
revision: a6eeb28458fd

PROCESS-CRASH | v8_7 | application crashed [@ js::CancelOffThreadIonCompile(JSCompartment *,JSScript *)]
Traceback (most recent call last):
Return code: 2
No talos data in output!
# TBPL FAILURE #

Comment 2

[Jon Coppeard (:jonco)]

Looks like it's crashing while traversing the pending ion builder list in CancelOffThreadIonCompile() at the start of a compacting GC.

11:21:26 INFO - Crash reason: EXCEPTION_ACCESS_VIOLATION_READ
11:21:26 INFO - Crash address: 0x5a5a5a62
11:21:26 INFO - Thread 49 (crashed)
11:21:26 INFO - 0 xul.dll!js::CancelOffThreadIonCompile(JSCompartment *,JSScript *) [HelperThreads.cpp:a6eeb28458fd : 182 + 0x3]
11:21:26 INFO - eip = 0x62a14a94 esp = 0x170df790 ebp = 0x170df7b8 ebx = 0x195d23a0
11:21:26 INFO - esi = 0x5a5a5a5a edi = 0x18701130 eax = 0x00000000 ecx = 0x195d23a0
11:21:26 INFO - edx = 0x00000000 efl = 0x00010206
11:21:26 INFO - Found by: given as instruction pointer in context
11:21:26 INFO - 1 xul.dll!js::jit::StopAllOffThreadCompilations(JS::Zone *) [Ion.cpp:a6eeb28458fd : 2761 + 0x13]
11:21:26 INFO - eip = 0x62a148b7 esp = 0x170df7c0 ebp = 0x170df7d8
11:21:26 INFO - Found by: call frame info
11:21:26 INFO - 2 xul.dll!js::gc::GCRuntime::relocateArenas(JS::Zone *,JS::gcreason::Reason,js::gc::ArenaHeader * &,js::SliceBudget &) [jsgc.cpp:a6eeb28458fd : 2230 + 0x9]
11:21:26 INFO - eip = 0x628b742c esp = 0x170df7e0 ebp = 0x170df7f8
11:21:26 INFO - Found by: call frame info
11:21:26 INFO - 3 xul.dll!js::gc::GCRuntime::compactPhase(JS::gcreason::Reason,js::SliceBudget &) [jsgc.cpp:a6eeb28458fd : 5506 + 0x13]
11:21:26 INFO - eip = 0x628b4c83 esp = 0x170df800 ebp = 0x170df830
11:21:26 INFO - Found by: call frame info
11:21:26 INFO - 4 xul.dll!js::gc::GCRuntime::incrementalCollectSlice(js::SliceBudget &,JS::gcreason::Reason) [jsgc.cpp:a6eeb28458fd : 5944 + 0x8]
11:21:26 INFO - eip = 0x628b56e1 esp = 0x170df838 ebp = 0x170df858
11:21:26 INFO - Found by: call frame info
11:21:26 INFO - 5 xul.dll!js::gc::GCRuntime::gcCycle(bool,js::SliceBudget &,JS::gcreason::Reason) [jsgc.cpp:a6eeb28458fd : 6110 + 0xa]
11:21:26 INFO - eip = 0x628b52c4 esp = 0x170df860 ebp = 0x170df8ac
11:21:26 INFO - Found by: call frame info
11:21:26 INFO - 6 xul.dll!js::gc::GCRuntime::collect(bool,js::SliceBudget,JS::gcreason::Reason) [jsgc.cpp:a6eeb28458fd : 6239 + 0x15]
11:21:26 INFO - eip = 0x628b3df9 esp = 0x170df8b4 ebp = 0x170df930
11:21:26 INFO - Found by: call frame info
11:21:26 INFO - 7 xul.dll!js::gc::GCRuntime::gc(JSGCInvocationKind,JS::gcreason::Reason) [jsgc.cpp:a6eeb28458fd : 6300 + 0x21]
11:21:26 INFO - eip = 0x628b3c13 esp = 0x170df938 ebp = 0x170df990
11:21:26 INFO - Found by: call frame info
11:21:26 INFO - 8 xul.dll!mozilla::dom::workers::WorkerPrivate::GarbageCollectInternal(JSContext *,bool,bool) [WorkerPrivate.cpp:a6eeb28458fd : 6832 + 0x4]
11:21:26 INFO - eip = 0x629abbfa esp = 0x170df998 ebp = 0x170df9b4
11:21:26 INFO - Found by: call frame info
11:21:26 INFO - 9 xul.dll!`anonymous namespace'::GarbageCollectRunnable::WorkerRun(JSContext *,mozilla::dom::workers::WorkerPrivate *) [WorkerPrivate.cpp:a6eeb28458fd : 1905 + 0x14]
11:21:26 INFO - eip = 0x62da55ba esp = 0x170df9bc ebp = 0x170df9c8
11:21:26 INFO - Found by: call frame info
11:21:26 INFO - 10 xul.dll!mozilla::dom::workers::WorkerRunnable::Run() [WorkerRunnable.cpp:a6eeb28458fd : 359 + 0xd]
11:21:26 INFO - eip = 0x628bb828 esp = 0x170df9d0 ebp = 0x170dfad4
11:21:26 INFO - Found by: call frame info

Comment 3

[Legacy TBPL/Treeherder Robot]

log: https://treeherder.mozilla.org/logviewer.html#?repo=mozilla-central&job_id=2036305
repository: mozilla-central
start_time: 2015-08-18T08:14:09
who: rvandermeulen[at]mozilla[dot]com
machine: t-w864-ix-042
buildname: Windows 8 64-bit mozilla-central pgo test mochitest-devtools-chrome-1
revision: 90d9b7c391d3

TEST-UNEXPECTED-FAIL | automation.py | application terminated with exit code 1
PROCESS-CRASH | automation.py | application crashed [@ js::CancelOffThreadIonCompile(JSCompartment *,JSScript *)]
Return code: 1

Comment 4

[Legacy TBPL/Treeherder Robot]

log: https://treeherder.mozilla.org/logviewer.html#?repo=mozilla-central&job_id=2039024
repository: mozilla-central
start_time: 2015-08-18T11:37:07
who: wkocher[at]mozilla[dot]com
machine: t-w732-ix-079
buildname: Windows 7 32-bit mozilla-central opt test mochitest-2
revision: 2c272af993c2

TEST-UNEXPECTED-FAIL | automation.py | application terminated with exit code 1
PROCESS-CRASH | automation.py | application crashed [@ js::CancelOffThreadIonCompile(JSCompartment *,JSScript *)]
Return code: 1

Comment 5

[Legacy TBPL/Treeherder Robot]

log: https://treeherder.mozilla.org/logviewer.html#?repo=fx-team&job_id=4287272
repository: fx-team
start_time: 2015-08-18T10:17:55
who: rvandermeulen[at]mozilla[dot]com
machine: t-w864-ix-079
buildname: Windows 8 64-bit fx-team pgo test mochitest-5
revision: ff71dfc40c70

TEST-UNEXPECTED-FAIL | toolkit/components/microformats/tests/test_Microformats_hCard.html | application terminated with exit code 1
PROCESS-CRASH | toolkit/components/microformats/tests/test_Microformats_hCard.html | application crashed [@ js::CancelOffThreadIonCompile(JSCompartment *,JSScript *)]
Return code: 1

Comment 6

[Legacy TBPL/Treeherder Robot]

log: https://treeherder.mozilla.org/logviewer.html#?repo=mozilla-inbound&job_id=13028160
repository: mozilla-inbound
start_time: 2015-08-18T21:45:42
who: archaeopteryx[at]coole-files[dot]de
machine: t-w864-ix-001
buildname: Windows 8 64-bit mozilla-inbound opt test reftest
revision: be65c38abed9

REFTEST TEST-UNEXPECTED-FAIL | file:///C:/slave/test/build/tests/reftest/tests/layout/reftests/w3c-css/submitted/variables/variable-supports-45.html | This test left crash dumps behind, but we weren't expecting it to!
TEST-UNEXPECTED-FAIL | file:///C:/slave/test/build/tests/reftest/tests/layout/reftests/w3c-css/submitted/variables/variable-supports-46.html | application terminated with exit code 1
PROCESS-CRASH | file:///C:/slave/test/build/tests/reftest/tests/layout/reftests/w3c-css/submitted/variables/variable-supports-46.html | application crashed [@ js::CancelOffThreadIonCompile(JSCompartment *,JSScript *)]
Return code: 1
No tests run or test summary not found

Comment 7

[Legacy TBPL/Treeherder Robot]

log: https://treeherder.mozilla.org/logviewer.html#?repo=mozilla-inbound&job_id=13030208
repository: mozilla-inbound
start_time: 2015-08-19T00:11:18
who: archaeopteryx[at]coole-files[dot]de
machine: t-w864-ix-061
buildname: Windows 8 64-bit mozilla-inbound opt test mochitest-devtools-chrome-1
revision: 7dd543ff5fe1

TEST-UNEXPECTED-FAIL | browser/devtools/debugger/test/browser_dbg_variables-view-reexpand-02.js | application terminated with exit code 1
PROCESS-CRASH | browser/devtools/debugger/test/browser_dbg_variables-view-reexpand-02.js | application crashed [@ js::CancelOffThreadIonCompile(JSCompartment *,JSScript *)]
Return code: 1

Comment 8

[Jon Coppeard (:jonco)]

Subsequent crashes did not occur during compacting GC.  Usually seems to happen on workers.

We're crashing while cancelling lazy linking for pending builders.

Hannes, could this be related to the lazy linking changes in bug 1178834?

Comment 9

[Legacy TBPL/Treeherder Robot]

log: https://treeherder.mozilla.org/logviewer.html#?repo=mozilla-inbound&job_id=13049386
repository: mozilla-inbound
start_time: 2015-08-19T10:19:15
who: wkocher[at]mozilla[dot]com
machine: t-w732-ix-003
buildname: Windows 7 32-bit mozilla-inbound talos g2
revision: abdb239a6d4d

Traceback (most recent call last):
TalosError: Could not find report in browser output: [('tsformat', ('__start_report', '__end_report')), ('tpformat', ('__start_tp_report', '__end_tp_report'))]
PROCESS-CRASH | damp | application crashed [@ js::CancelOffThreadIonCompile(JSCompartment *,JSScript *)]
Traceback (most recent call last):
Return code: 2
No talos data in output!
# TBPL FAILURE #

Comment 10

[Legacy TBPL/Treeherder Robot]

log: https://treeherder.mozilla.org/logviewer.html#?repo=fx-team&job_id=4301147
repository: fx-team
start_time: 2015-08-19T09:55:17
who: wkocher[at]mozilla[dot]com
machine: t-w864-ix-004
buildname: Windows 8 64-bit fx-team pgo test mochitest-2
revision: bf9bf669af6a

TEST-UNEXPECTED-FAIL | dom/imptests/webapps/XMLHttpRequest/tests/submissions/Ms2ger/test_FormData-append.html | application terminated with exit code 1
PROCESS-CRASH | dom/imptests/webapps/XMLHttpRequest/tests/submissions/Ms2ger/test_FormData-append.html | application crashed [@ js::CancelOffThreadIonCompile(JSCompartment *,JSScript *)]
Return code: 1

Comment 11

[Legacy TBPL/Treeherder Robot]

log: https://treeherder.mozilla.org/logviewer.html#?repo=mozilla-inbound&job_id=13048148
repository: mozilla-inbound
start_time: 2015-08-19T09:57:10
who: rvandermeulen[at]mozilla[dot]com
machine: t-snow-r4-0065
buildname: Rev4 MacOSX Snow Leopard 10.6 mozilla-inbound opt test mochitest-3
revision: 944ff50489f0

TEST-UNEXPECTED-FAIL | automation.py | application terminated with exit code 1
PROCESS-CRASH | automation.py | application crashed [@ js::CancelOffThreadIonCompile(JSCompartment*, JSScript*)]

Comment 12

[Legacy TBPL/Treeherder Robot]

log: https://treeherder.mozilla.org/logviewer.html#?repo=b2g-inbound&job_id=2585432
repository: b2g-inbound
start_time: 2015-08-21T09:20:11
who: rvandermeulen[at]mozilla[dot]com
machine: t-snow-r4-0006
buildname: Rev4 MacOSX Snow Leopard 10.6 b2g-inbound opt test mochitest-browser-chrome-1
revision: c33f4cdaae8c

TEST-UNEXPECTED-FAIL | browser/base/content/test/general/browser_zbug569342.js | application terminated with exit code 1
PROCESS-CRASH | browser/base/content/test/general/browser_zbug569342.js | application crashed [@ js::CancelOffThreadIonCompile(JSCompartment*, JSScript*)]

Comment 13

[Legacy TBPL/Treeherder Robot]

log: https://treeherder.mozilla.org/logviewer.html#?repo=fx-team&job_id=4339294
repository: fx-team
start_time: 2015-08-21T20:21:11
who: rvandermeulen[at]mozilla[dot]com
machine: t-yosemite-r5-0105
buildname: Rev5 MacOSX Yosemite 10.10 fx-team opt test mochitest-browser-chrome-2
revision: e0f2fd166388

TEST-UNEXPECTED-TIMEOUT | browser/extensions/pdfjs/test/browser_pdfjs_navigation.js | application timed out after 330 seconds with no output
TEST-UNEXPECTED-FAIL | browser/extensions/pdfjs/test/browser_pdfjs_navigation.js | application terminated with exit code 5
PROCESS-CRASH | browser/extensions/pdfjs/test/browser_pdfjs_navigation.js | application crashed [@ js::CancelOffThreadIonCompile(JSCompartment*, JSScript*)]

Comment 14

[Legacy TBPL/Treeherder Robot]

log: https://treeherder.mozilla.org/logviewer.html#?repo=mozilla-central&job_id=2056735
repository: mozilla-central
start_time: 2015-08-22T05:22:10
who: rvandermeulen[at]mozilla[dot]com
machine: t-yosemite-r5-0008
buildname: Rev5 MacOSX Yosemite 10.10 mozilla-central talos g1
revision: 22c34579ae07

Traceback (most recent call last):
TalosError: Could not find report in browser output: [('tsformat', ('__start_report', '__end_report')), ('tpformat', ('__start_tp_report', '__end_tp_report'))]
PROCESS-CRASH | glterrain | application crashed [@ js::CancelOffThreadIonCompile(JSCompartment*, JSScript*)]
Traceback (most recent call last):
Return code: 2
No talos data in output!
# TBPL FAILURE #

Comment 15

[Legacy TBPL/Treeherder Robot]

log: https://treeherder.mozilla.org/logviewer.html#?repo=mozilla-central&job_id=2057607
repository: mozilla-central
start_time: 2015-08-23T07:36:35
who: rvandermeulen[at]mozilla[dot]com
machine: t-w732-ix-157
buildname: Windows 7 32-bit mozilla-central pgo test mochitest-1
revision: 22c34579ae07

TEST-UNEXPECTED-FAIL | automation.py | application terminated with exit code 1
PROCESS-CRASH | automation.py | application crashed [@ js::CancelOffThreadIonCompile(JSCompartment *,JSScript *)]
Return code: 1

Comment 17

[Legacy TBPL/Treeherder Robot]

log: https://treeherder.mozilla.org/logviewer.html#?repo=mozilla-inbound&job_id=13129097
repository: mozilla-inbound
start_time: 2015-08-21T00:07:22
who: rvandermeulen[at]mozilla[dot]com
machine: t-w864-ix-139
buildname: Windows 8 64-bit mozilla-inbound pgo test mochitest-2
revision: 4fd3f9fdf6c2

TEST-UNEXPECTED-FAIL | dom/imptests/editing/conformancetest/test_event.html | application terminated with exit code 1
PROCESS-CRASH | dom/imptests/editing/conformancetest/test_event.html | application crashed [@ js::CancelOffThreadIonCompile(JSCompartment *,JSScript *)]
Return code: 1

Comment 18

[Legacy TBPL/Treeherder Robot]

log: https://treeherder.mozilla.org/logviewer.html#?repo=mozilla-inbound&job_id=13138880
repository: mozilla-inbound
start_time: 2015-08-21T05:57:27
who: rvandermeulen[at]mozilla[dot]com
machine: t-yosemite-r5-0029
buildname: Rev5 MacOSX Yosemite 10.10 mozilla-inbound debug test mochitest-devtools-chrome-1
revision: c5f6317224a6

TEST-UNEXPECTED-FAIL | ShutdownLeaks | process() called before end of test suite
TEST-UNEXPECTED-FAIL | browser/devtools/webconsole/test/browser_webconsole_bug_622303_persistent_filters.js | application terminated with exit code 1
PROCESS-CRASH | browser/devtools/webconsole/test/browser_webconsole_bug_622303_persistent_filters.js | application crashed [@ js::CancelOffThreadIonCompile(JSCompartment*, JSScript*)]
TEST-UNEXPECTED-FAIL | leakcheck | default process: missing output line for total leaks!

Comment 19

[Legacy TBPL/Treeherder Robot]

log: https://treeherder.mozilla.org/logviewer.html#?repo=b2g-inbound&job_id=2579872
repository: b2g-inbound
start_time: 2015-08-20T22:17:25
who: rvandermeulen[at]mozilla[dot]com
machine: t-w732-ix-144
buildname: Windows 7 32-bit b2g-inbound pgo test mochitest-5
revision: c5f6995a464d

TEST-UNEXPECTED-FAIL | toolkit/xre/test/test_fpuhandler.html | application terminated with exit code 1
PROCESS-CRASH | toolkit/xre/test/test_fpuhandler.html | application crashed [@ js::CancelOffThreadIonCompile(JSCompartment *,JSScript *)]
Return code: 1

Comment 20

[Legacy TBPL/Treeherder Robot]

log: https://treeherder.mozilla.org/logviewer.html#?repo=mozilla-inbound&job_id=13214824
repository: mozilla-inbound
start_time: 2015-08-24T07:47:46
who: rvandermeulen[at]mozilla[dot]com
machine: t-yosemite-r5-0086
buildname: Rev5 MacOSX Yosemite 10.10 mozilla-inbound talos g2
revision: a7fb70a151a1

Traceback (most recent call last):
TalosError: Could not find report in browser output: [('tsformat', ('__start_report', '__end_report')), ('tpformat', ('__start_tp_report', '__end_tp_report'))]
PROCESS-CRASH | damp | application crashed [@ js::CancelOffThreadIonCompile(JSCompartment*, JSScript*)]
Traceback (most recent call last):
Return code: 2
No talos data in output!
# TBPL FAILURE #

Comment 21

[Legacy TBPL/Treeherder Robot]

log: https://treeherder.mozilla.org/logviewer.html#?repo=fx-team&job_id=4349635
repository: fx-team
start_time: 2015-08-24T11:13:24
who: rvandermeulen[at]mozilla[dot]com
machine: t-yosemite-r5-0020
buildname: Rev5 MacOSX Yosemite 10.10 fx-team debug test mochitest-other
revision: babc0182fe4b

TEST-UNEXPECTED-FAIL | toolkit/devtools/server/tests/mochitest/test_memory_allocations_02.html | application terminated with exit code 1
PROCESS-CRASH | toolkit/devtools/server/tests/mochitest/test_memory_allocations_02.html | application crashed [@ js::CancelOffThreadIonCompile(JSCompartment*, JSScript*)]
TEST-UNEXPECTED-FAIL | leakcheck | default process: missing output line for total leaks!
Return code: 1
No tests run or test summary not found

Comment 24

[Legacy TBPL/Treeherder Robot]

log: https://treeherder.mozilla.org/logviewer.html#?repo=fx-team&job_id=4396642
repository: fx-team
start_time: 2015-08-26T13:04:24
who: rvandermeulen[at]mozilla[dot]com
machine: t-yosemite-r5-0104
buildname: Rev5 MacOSX Yosemite 10.10 fx-team opt test mochitest-devtools-chrome-1
revision: ce62942bcbc2

TEST-UNEXPECTED-FAIL | browser/devtools/framework/test/browser_toolbox_highlight.js | application terminated with exit code 1
PROCESS-CRASH | browser/devtools/framework/test/browser_toolbox_highlight.js | application crashed [@ js::CancelOffThreadIonCompile(JSCompartment*, JSScript*)]

Comment 25

[Legacy TBPL/Treeherder Robot]

log: https://treeherder.mozilla.org/logviewer.html#?repo=mozilla-inbound&job_id=13353828
repository: mozilla-inbound
start_time: 2015-08-26T21:11:11
who: philringnalda[at]gmail[dot]com
machine: t-xp32-ix-156
buildname: Windows XP 32-bit mozilla-inbound debug test web-platform-tests-8
revision: a819698325b2

PROCESS-CRASH | /workers/interfaces/WorkerGlobalScope/location/setting-members.html | application crashed [@ js::CancelOffThreadIonCompile(JSCompartment *,JSScript *)]
TEST-UNEXPECTED-CRASH | /workers/interfaces/WorkerGlobalScope/location/setting-members.html | expected OK
PROCESS | 1284 | Assertion failure: IsFrozen(), at c:/builds/moz2_slave/m-in-w32-d-0000000000000000000/build/src/dom/workers/SharedWorker.cpp:101
PROCESS-CRASH | /_mozilla/service-workers/service-worker/sync-xhr-doesnt-deadlock.https.html | application crashed [@ mozilla::dom::workers::SharedWorker::Thaw()]
Return code: 1

Comment 26

[Legacy TBPL/Treeherder Robot]

log: https://treeherder.mozilla.org/logviewer.html#?repo=fx-team&job_id=4404087
repository: fx-team
start_time: 2015-08-27T03:17:30
who: archaeopteryx[at]coole-files[dot]de
machine: t-w864-ix-063
buildname: Windows 8 64-bit fx-team opt test mochitest-3
revision: 286c0d72ae55

TEST-UNEXPECTED-FAIL | dom/tests/mochitest/dom-level2-html/test_HTMLTableElement40.html | application terminated with exit code 1
PROCESS-CRASH | dom/tests/mochitest/dom-level2-html/test_HTMLTableElement40.html | application crashed [@ js::CancelOffThreadIonCompile(JSCompartment *,JSScript *)]
Return code: 1

Comment 27

[Hannes Verschore [:h4writer]]

Potentially fixed by bug 1198245. No reports since that landed, but keeping open, since there was a weekend in between, which means low volume...

Comment 28

[BMO Automation]

Bulk assigning P3 to all open intermittent bugs without a priority set in Firefox components per bug 1298978.

Comment 29

[Ryan VanderMeulen [:RyanVM]]

(In reply to Hannes Verschore [:h4writer] from comment #27)
> Potentially fixed by bug 1198245. No reports since that landed, but keeping
> open, since there was a weekend in between, which means low volume...

Let's go with that.