Closed Bug 1008357 Opened 7 years ago Closed 7 years ago

Intermittent b2ginstance.py | application crashed [@ js::ShapeTable::search(jsid, bool)]

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
ARM
Gonk (Firefox OS)
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla32
Tracking Flags:
Tracking Status
firefox30 --- unaffected
firefox31 --- unaffected
firefox32 --- fixed
firefox-esr24 --- unaffected
b2g-v1.4 --- unaffected
b2g-v2.0 --- fixed

People

(Reporter: RyanVM, Unassigned)

References

Details

(Keywords: crash, intermittent-failure) 

This first started happening around 7-May, but was getting starred under bug 1000883. Seems to happen on startup in mozJSComponentLoader code. It's happening with pretty high frequency, so attentions from the JS team would be much appreciated :)

https://tbpl.mozilla.org/php/getParsedLog.php?id=39377639&tree=B2g-Inbound

b2g_emulator_vm b2g-inbound opt test mochitest-2 on 2014-05-09 11:52:26 PDT for push 3422ae7c9be6
slave: tst-linux64-spot-732

11:58:02     INFO -  runtests.py | Server pid: 2901
11:58:02     INFO -  runtests.py | Websocket server pid: 2903
11:58:02     INFO -  INFO | runtests.py | SSL tunnel pid: 2905
11:58:03     INFO -  Mochitest INFO | runtestsb2g.py | Running tests: start.
11:58:15     INFO -  1399661895792	Marionette	INFO	marionette enabled via build flag and pref
11:58:17     INFO -  1399661898132	Marionette	INFO	marionette-server.js loaded
11:58:18     INFO -  1399661899368	Marionette	INFO	B2G emulator: yes
11:58:18     INFO -  1399661899381	Marionette	INFO	Device detected is generic
11:58:18     INFO -  1399661899390	Marionette	INFO	Bypassing offline status.
11:58:19     INFO -  1399661899413	Marionette	INFO	Listening on port 2828
11:58:19     INFO -  1399661899423	Marionette	INFO	Marionette server ready
11:58:19     INFO -  System JS : WARNING resource://gre/modules/Preferences.jsm:378 - mutating the [[Prototype]] of an object will cause your code to run very slowly; instead create the object with the correct initial [[Prototype]] value using Object.create
11:58:21     INFO -  1399661901940	Marionette	DEBUG	accepted connection on 127.0.0.1:50004
11:58:31     INFO -  1399661911822	Marionette	DEBUG	accepted connection on 127.0.0.1:50005
11:59:08     INFO -  1399661948754	Marionette	INFO	loaded marionette-listener.js
11:59:08     INFO -  1399661948781	Marionette	INFO	sendToClient: {"from":"0","value":{"browserName":"B2G","browserVersion":"32.0a1","platformName":"ANDROID","platformVersion":"32.0a1","cssSelectorsEnabled":true,"handlesAlerts":false,"javascriptEnabled":true,"nativeEvents":false,"rotatable":true,"secureSsl":false,"takesElementScreenshot":true,"takesScreenshot":true,"platform":"ANDROID","XULappId":"{3c2e2abc-06d4-11e1-ac3b-374f68613e61}","appBuildId":"20140509095333","device":"qemu","version":"32.0a1","b2g":true}}, {f2dfce17-bb08-46d5-94cd-fc6d6057737a}, {f2dfce17-bb08-46d5-94cd-fc6d6057737a}
11:59:08     INFO -  ###################################### forms.js loaded
11:59:08     INFO -  ############################### browserElementPanning.js loaded
11:59:08     INFO -  ######################## BrowserElementChildPreload.js loaded
11:59:08     INFO -  *** UTM:SVC TimerManager:registerTimer - id: user-agent-updates-timer
11:59:11     INFO -  1399661951489	Marionette	DEBUG	Got request: setContext, data: {"to":"0","sessionId":{"rotatable":true,"browserVersion":"32.0a1","takesScreenshot":true,"appBuildId":"20140509095333","cssSelectorsEnabled":true,"javascriptEnabled":true,"XULappId":"{3c2e2abc-06d4-11e1-ac3b-374f68613e61}","secureSsl":false,"platform":"ANDROID","browserName":"B2G","version":"32.0a1","device":"qemu","b2g":true,"nativeEvents":false,"platformVersion":"32.0a1","takesElementScreenshot":true,"platformName":"ANDROID","handlesAlerts":false},"name":"setContext","parameters":{"value":"chrome"}}, id: {4b3adac6-2c17-41cf-9d01-f0abda522373}
11:59:11     INFO -  1399661951499	Marionette	INFO	sendToClient: {"from":"0","ok":true}, {4b3adac6-2c17-41cf-9d01-f0abda522373}, {4b3adac6-2c17-41cf-9d01-f0abda522373}
11:59:12     INFO -  1399661953010	Marionette	DEBUG	Got request: execute, data: {"to":"0","sessionId":{"rotatable":true,"browserVersion":"32.0a1","takesScreenshot":true,"appBuildId":"20140509095333","cssSelectorsEnabled":true,"javascriptEnabled":true,"XULappId":"{3c2e2abc-06d4-11e1-ac3b-374f68613e61}","secureSsl":false,"platform":"ANDROID","browserName":"B2G","version":"32.0a1","device":"qemu","b2g":true,"nativeEvents":false,"platformVersion":"32.0a1","takesElementScreenshot":true,"platformName":"ANDROID","handlesAlerts":false},"name":"executeScript","parameters":{"scriptTimeout":null,"specialPowers":false,"script":"\n                Components.utils.import(\"resource://gre/modules/Services.jsm\");\n                Services.io.manageOfflineStatus = false;\n                Services.io.offline = false;\n                ","newSandbox":true,"args":[],"filename":"remote.py","line":214}}, id: {64ee8f1b-6702-4104-84e4-13000b91907c}
11:59:19     INFO -  mozcrash INFO | Downloading symbols from: http://pvtbuilds.pvt.build.mozilla.org/pub/mozilla.org/b2g/tinderbox-builds/b2g-inbound-emulator/20140509095333/b2g-32.0a1.en-US.android-arm.crashreporter-symbols.zip
11:59:38  WARNING -  PROCESS-CRASH | b2ginstance.py | application crashed [@ js::ShapeTable::search(jsid, bool)]
11:59:38     INFO -  Crash dump filename: /tmp/tmpDNWWSh/2f035f84-0493-4090-54f0b6f4-72939b66.dmp
11:59:38     INFO -  Operating system: Android
11:59:38     INFO -                    0.0.0 Linux 2.6.29-00302-g586075d #31 Mon Feb 24 10:28:23 PST 2014 armv7l Android/full/generic:4.0.4.0.4.0.4/OPENMASTER/eng.cltbld.20140509.133455:eng/test-keys
11:59:38     INFO -  CPU: arm
11:59:38     INFO -       0 CPUs
11:59:38     INFO -  Crash reason:  SIGSEGV
11:59:38     INFO -  Crash address: 0x0
11:59:38     INFO -  Thread 0 (crashed)
11:59:38     INFO -   0  libxul.so!js::ShapeTable::search(jsid, bool) [Shape.cpp:3422ae7c9be6 : 189 + 0x0]
11:59:38     INFO -       r4 = 0x40210fc0    r5 = 0x43ce8058    r6 = 0xfffff5c4    r7 = 0xbee5c5b4
11:59:38     INFO -       r8 = 0x40210fc0    r9 = 0xbee5c5b0   r10 = 0x40210fc0    fp = 0x00000000
11:59:38     INFO -       sp = 0xbee5c488    lr = 0x41cb5cbd    pc = 0x41ccd986
11:59:38     INFO -      Found by: given as instruction pointer in context
11:59:38     INFO -   1  libxul.so!js::ObjectImpl::nativeLookup(js::ExclusiveContext*, jsid) [Shape-inl.h:3422ae7c9be6 : 133 + 0x3]
11:59:38     INFO -       r4 = 0x40210fc0    r5 = 0x43ce8058    r6 = 0xfffff5c4    r7 = 0xbee5c5b4
11:59:38     INFO -       r8 = 0x40210fc0    r9 = 0xbee5c5b0   r10 = 0x40210fc0    fp = 0x00000000
11:59:38     INFO -       sp = 0xbee5c4a0    pc = 0x41cb5cbd
11:59:38     INFO -      Found by: call frame info
11:59:38     INFO -   2  libxul.so!js::LookupNativeProperty(js::ExclusiveContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::MutableHandle<JSObject*>, JS::MutableHandle<js::Shape*>) [jsobj.cpp:3422ae7c9be6 : 3969 + 0x7]
11:59:38     INFO -       r4 = 0xbee5c758    r5 = 0x42579fa0    r6 = 0xfffff5c4    r7 = 0xbee5c5b4
11:59:38     INFO -       r8 = 0x40210fc0    r9 = 0xbee5c5b0   r10 = 0x40210fc0    fp = 0x00000000
11:59:38     INFO -       sp = 0xbee5c4b8    pc = 0x41c3d87d
11:59:38     INFO -      Found by: call frame info
11:59:38     INFO -   3  libxul.so!bool js::baseops::SetPropertyHelper<(js::ExecutionMode)0>(js::ExecutionModeTraits<(js::ExecutionMode)0>::ContextType, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<jsid>, js::baseops::QualifiedBool, JS::MutableHandle<JS::Value>, bool) [jsobj.cpp:3422ae7c9be6 : 4848 + 0x7]
11:59:38     INFO -       r4 = 0x42579fa0    r5 = 0x40210fc0    r6 = 0xbee5c7fc    r7 = 0x00000000
11:59:38     INFO -       r8 = 0xbee5c758    r9 = 0xbee5c5b4   r10 = 0xbee5c5b0    fp = 0x00000000
11:59:38     INFO -       sp = 0xbee5c530    pc = 0x41c46115
11:59:38     INFO -      Found by: call frame info
11:59:38     INFO -   4  libxul.so!JS_SetPropertyById [jsobj.h:3422ae7c9be6 : 1024 + 0x11]
11:59:38     INFO -       r4 = 0xbee5c758    r5 = 0x449eef30    r6 = 0x43c28c40    r7 = 0xffffff87
11:59:38     INFO -       r8 = 0x00000000    r9 = 0xbee5c758   r10 = 0xbee5c708    fp = 0xbee5c7fc
11:59:38     INFO -       sp = 0xbee5c5e0    pc = 0x41bf73eb
11:59:38     INFO -      Found by: call frame info
11:59:38     INFO -   5  libxul.so!mozJSComponentLoader::ImportInto(nsACString_internal const&, JS::Handle<JSObject*>, JSContext*, JS::MutableHandle<JSObject*>) [mozJSComponentLoader.cpp:3422ae7c9be6 : 1314 + 0xb]
11:59:38     INFO -       r4 = 0x402d9d70    r5 = 0x449eef30    r6 = 0x43ae1a60    r7 = 0xbee5c710
11:59:38     INFO -       r8 = 0x00000000    r9 = 0xbee5c758   r10 = 0xbee5c708    fp = 0xbee5c7fc
11:59:38     INFO -       sp = 0xbee5c608    pc = 0x412a7997
11:59:38     INFO -      Found by: call frame info
11:59:38     INFO -   6  libxul.so!mozJSComponentLoader::Import(nsACString_internal const&, JS::Handle<JS::Value>, JSContext*, unsigned char, JS::MutableHandle<JS::Value>) [mozJSComponentLoader.cpp:3422ae7c9be6 : 1127 + 0xd]
11:59:38     INFO -       r4 = 0x43ef8c00    r5 = 0x402d9d70    r6 = 0x449eef30    r7 = 0xbee5c7f8
11:59:38     INFO -       r8 = 0xbee5c948    r9 = 0x0000001a   r10 = 0x4200e56a    fp = 0x449eef20
11:59:38     INFO -       sp = 0xbee5c7c0    pc = 0x412a7bb7
11:59:38     INFO -      Found by: call frame info
11:59:38     INFO -   7  libxul.so!nsXPCComponents_Utils::Import(nsACString_internal const&, JS::Handle<JS::Value>, JSContext*, unsigned char, JS::MutableHandle<JS::Value>) [XPCComponents.cpp:3422ae7c9be6 : 2724 + 0x11]
11:59:38     INFO -       r4 = 0x412a7b01    r5 = 0xbee5c918    r6 = 0x449eef30    r7 = 0x43ef8c00
11:59:38     INFO -       r8 = 0x00000005    r9 = 0x0000001a   r10 = 0x4200e56a    fp = 0x449eef20
11:59:38     INFO -       sp = 0xbee5c818    pc = 0x412785a9
11:59:38     INFO -      Found by: call frame info
11:59:38     INFO -   8  libxul.so!NS_InvokeByIndex [xptcinvoke_arm.cpp:3422ae7c9be6 : 164 + 0x23]
11:59:38     INFO -       r4 = 0x4127856d    r5 = 0x449eef30    r6 = 0xbee5c948    r7 = 0xbee5c870
11:59:38     INFO -       r8 = 0x00000005    r9 = 0x0000001a   r10 = 0x4200e56a    fp = 0x449eef20
11:59:38     INFO -       sp = 0xbee5c840    pc = 0x40c77f95
11:59:38     INFO -      Found by: call frame info
11:59:38     INFO -   9  libxul.so!XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) [XPCWrappedNative.cpp:3422ae7c9be6 : 2397 + 0xd]
11:59:38     INFO -       r4 = 0x42579fa0    r5 = 0xbee5c948    r6 = 0xbee5c8d8    r7 = 0x00000010
11:59:38     INFO -       r8 = 0x00000003    r9 = 0x0000001a   r10 = 0x4200e56a    fp = 0x421ad62c
11:59:38     INFO -       sp = 0xbee5c8a0    pc = 0x41299835
11:59:38     INFO -      Found by: call frame info
11:59:38     INFO -  10  libxul.so!XPC_WN_CallMethod(JSContext*, unsigned int, JS::Value*) [XPCWrappedNativeJSOps.cpp:3422ae7c9be6 : 1273 + 0x7]
11:59:38     INFO -       r4 = 0x43ef8c00    r5 = 0xbee5ca9c    r6 = 0x00000001    r7 = 0x00000001
11:59:38     INFO -       r8 = 0x4023b284    r9 = 0x43ce2da0   r10 = 0x43ce2da0    fp = 0xffffff87
11:59:38     INFO -       sp = 0xbee5ca78    pc = 0x4129d5cf
11:59:38     INFO -      Found by: call frame info
Summary: Intermittent b2ginstance.py | application crashed [@ js::ShapeTable::search(jsid, bool)] → Intermittent B2G automation | b2ginstance.py | application crashed [@ js::ShapeTable::search(jsid, bool)]
I don't have the bandwidth for this at the moment. Sorry. :-(
Naveed, this is going to be climbing the OrangeFactor rankings in a hurry. Can you please help us find an owner?
Flags: needinfo?(nihsanullah)
Nicolas please take a look at this
Flags: needinfo?(nihsanullah) → needinfo?(nicolas.b.pierron)
(In reply to Ryan VanderMeulen [:RyanVM UTC-4] from comment #0)
> This first started happening around 7-May, but was getting starred under bug
> 1000883. Seems to happen on startup in mozJSComponentLoader code. It's
> happening with pretty high frequency, so attentions from the JS team would
> be much appreciated :)

I look inside the following range

(~May 7th) http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=d0523fcc5af9fbfd6e30e096c18e13c928048a26&tochange=615cffdf77cd7f5f61c0259c0999d7b45637c252

I do not yet see any JS changes which might cause such issue, also if it is as frequent as you mention, I would expect fuzzers to hit this case soonish.

Also, based on the stack, I guess this might be in the glue code.

Also, AWFY does not seems to fails more often compare to the repeated tests of B2g-(aurora/beta) branch.  AWFY FFOS tests are using Marionette, so I guess we might be able to isolate these failures to some Marionette test cases which doing one Cu.import.
I looked precisely at when it got reported on Bug 1000883, and at the frequency of it.
The first occurrence is (Bug 1000883 comment 75):

https://tbpl.mozilla.org/php/getParsedLog.php?id=39242997&tree=B2g-Inbound
b2g_emulator_vm b2g-inbound opt test mochitest-3 on 2014-05-07 17:31:31
revision: 79cef4dc41f9
slave: tst-linux64-spot-785

So I guess, that in the following range:
http://hg.mozilla.org/integration/b2g-inbound/pushloghtml?fromchange=d0523fcc5af9fbfd6e30e096c18e13c928048a26&tochange=79cef4dc41f9

This is potentially related to changes made as part of Bug 993282.
Also note the Bug 993282 comment 12, and that the patch got back out, and this match the absence of reports, which are raising again after the re-landing.

(failure after the backout, Bug 1000883 comment 91)
http://hg.mozilla.org/integration/b2g-inbound/pushloghtml?fromchange=7616388e078a&tochange=28462d6b3973

I suggest, triggering again the "b2g_emulator_vm opt mochitest[1-9]" on the try pushes (Bug 993282 comment 14).
Flags: needinfo?(fabrice)
Flags: needinfo?(nicolas.b.pierron)
They don't look to fail much on try...
Flags: needinfo?(fabrice)
(In reply to Fabrice Desré [:fabrice] from comment #21)
> They don't look to fail much on try...

There was at least one occurrence - see the red M7:
https://tbpl.mozilla.org/?tree=Try&rev=c716badf1e49

I think we should back out bug 993282 until this is tracked down.
Flags: needinfo?(fabrice)
(In reply to Ed Morley [:edmorley UTC+0] from comment #29)
> I think we should back out bug 993282 until this is tracked down.

I put the call out for help on this bug in today's Platform meeting, but barring any soonish changes, I'm inclined to agree.
Fabrice: the consensus seems to be that this crash is a regression from bug 993282. If you need any help debugging, just ping :nbp.
Bug 993282 backed out since there doesn't seem to be any progress here.
Blocks: 993282
Flags: needinfo?(fabrice)
(In reply to Ed Morley [:edmorley UTC+0] from comment #176)
> Bug 993282 backed out since there doesn't seem to be any progress here.

This has gone away now the backout has been merged around; bug 993282 was the cause.
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
status-b2g-v1.4: --- → unaffected
status-b2g-v2.0: --- → fixed
status-firefox30: --- → unaffected
status-firefox31: --- → unaffected
status-firefox32: --- → fixed
status-firefox-esr24: --- → unaffected
Target Milestone: --- → mozilla32
(In reply to Ed Morley [:edmorley UTC+0] from comment #182)
> (In reply to Ed Morley [:edmorley UTC+0] from comment #176)
> > Bug 993282 backed out since there doesn't seem to be any progress here.
> 
> This has gone away now the backout has been merged around; bug 993282 was
> the cause.

Well, that doesn't fix the underlying cause, which is in the js engine and not bug 993282 in itself.
Nicolas, since you started looking at the crash, do you prefer using a new bug?
Flags: needinfo?(nicolas.b.pierron)
(In reply to < away until June 17 > from comment #183)
> (In reply to Ed Morley [:edmorley UTC+0] from comment #182)
> > (In reply to Ed Morley [:edmorley UTC+0] from comment #176)
> > > Bug 993282 backed out since there doesn't seem to be any progress here.
> > 
> > This has gone away now the backout has been merged around; bug 993282 was
> > the cause.
> 
> Well, that doesn't fix the underlying cause, which is in the js engine and
> not bug 993282 in itself.
> Nicolas, since you started looking at the crash, do you prefer using a new
> bug?

Even if a landing is not the root cause, but merely tickles an existing issue, that landing should be backed out until the root cause is resolved. This is normal practice.
Summary: Intermittent B2G automation | b2ginstance.py | application crashed [@ js::ShapeTable::search(jsid, bool)] → Intermittent b2ginstance.py | application crashed [@ js::ShapeTable::search(jsid, bool)]
Blocks: 1024157
Flags: needinfo?(nicolas.b.pierron)
You need to log in before you can comment on or make changes to this bug.