1330193 - Crash in js::jit::JitProfilingFrameIterator::moveToNextFrame

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine: JIT, defect, P1)

Description

[:Harald Kirschner :digitarald]

This bug was filed from the Socorro interface and is 
report bp-48a66f40-f9d0-4464-b64e-9d4d82170111.
Also 48a66f40-f9d0-4464-b64e-9d4d82170111
=============================================================

Happened several times on LinkedIn with Profiler enabled. Naveed could reproduce on his Mac Book as well.

Comment 1

[Markus Stange [:mstange]]

Kannan, any ideas?

Comment 2

[Sean Stangl [:sstangl]]

Attachment: Diagnostic patch

JitProfilingFrameIterator::moveToNextFrame() is missing cases for JitFrame_IonStub, JitFrame_Exit, and JitFrame_Bailout.

It is surprising that we've gone this whole time without this breaking, if the missing cases are actually required...

Harald (or Naveed), could you try compiling with this patch and see which case it crashes on?

Comment 3

[:Harald Kirschner :digitarald]

I just tried reproducing it in Nightly without the patch and it doesn't happen anymore. Naveed, does it still reproduce for you?

Comment 4

[Randell Jesup [:jesup] (needinfo me)]

It happened to me on Nightly/win10/profiler:

https://crash-stats.mozilla.com/report/index/7a9e6c8f-e095-4f03-ae94-4d0d22170203

Comment 5

[Randell Jesup [:jesup] (needinfo me)]

And again reloading the crashed tab: https://crash-stats.mozilla.com/report/index/63fe0a34-ff86-47c8-a10b-202da2170203

Comment 6

[:Harald Kirschner :digitarald]

Maybe related (signature is not), but I was profiling using devtools profiler in LinkedIn and got https://crash-stats.mozilla.com/report/index/f45f0458-80f4-4d95-acbb-2b0a72170203

Comment 7

[Bryce Seager van Dyk [:bryce] (he/him) - Not reading bugmail]

I'm seeing this on Windows 10 when watching videos on twitch.tv. I've just had it while trying to reparent a window containing a video (https://crash-stats.mozilla.com/report/index/83313024-b4d1-40a6-b092-027d12170216). I've also seen it with a static window with a video playing that simply crashed.

I've had periods of high crashability (every few minutes, renders streams unwatchable), but typically this happens every few days.

Comment 8

[Gervase Markham [:gerv]]

I currently can't use LinkedIn on Aurora because it crashes every few seconds due to this bug.

Gerv

Comment 9

[Hannes Verschore [:h4writer]]

(In reply to Sean Stangl [:sstangl] from comment #2)
> Created attachment 8825649 [details] [diff] [review]
> Diagnostic patch
> 
> JitProfilingFrameIterator::moveToNextFrame() is missing cases for
> JitFrame_IonStub, JitFrame_Exit, and JitFrame_Bailout.
> 
> It is surprising that we've gone this whole time without this breaking, if
> the missing cases are actually required...
> 
> Harald (or Naveed), could you try compiling with this patch and see which
> case it crashes on?

Can you create a try build with this patch. To make it easier to let others try if they hit it with this patch? We could potentially also land this?

(In reply to Gervase Markham [:gerv] from comment #8)
> I currently can't use LinkedIn on Aurora because it crashes every few
> seconds due to this bug.
> 
> Gerv

This is without the profiler enabled? If this is without the profiler this might be another bug. Can you post a crash report?

Comment 10

[Jan de Mooij [:jandem]]

(In reply to Sean Stangl [:sstangl] from comment #2)
> JitProfilingFrameIterator::moveToNextFrame() is missing cases for
> JitFrame_IonStub, JitFrame_Exit, and JitFrame_Bailout.

I removed JitFrame_IonStub a few days ago but I think it has been dead since bug 1323099. It looks like we still have Nightly crashes after that.

Can you try to reproduce this?

Comment 11

[Bryce Seager van Dyk [:bryce] (he/him) - Not reading bugmail]

I think I may be the current top crasher on this. Still seeing it in release, however I can't repro in beta. Looking at the other crash reports, I don't see anyone crashing with a  build ID later than 53. I can't reliably repro this, so it's hard to be sure.

Comment 12

[Jan de Mooij [:jandem]]

Yes no crashes in 53+ with this signature, let's close this.

Comment 13

[:Harald Kirschner :digitarald]

(pardon me, edited wrong bug)