Closed Bug 1008357 Opened 11 years ago Closed 11 years ago

Intermittent b2ginstance.py | application crashed [@ js::ShapeTable::search(jsid, bool)]

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
ARM
Gonk (Firefox OS)
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla32
Tracking Flags:
Tracking Status
firefox30 --- unaffected
firefox31 --- unaffected
firefox32 --- fixed
firefox-esr24 --- unaffected
b2g-v1.4 --- unaffected
b2g-v2.0 --- fixed

People

(Reporter: RyanVM, Unassigned)

References

Details

(Keywords: crash, intermittent-failure)

This first started happening around 7-May, but was getting starred under bug 1000883. Seems to happen on startup in mozJSComponentLoader code. It's happening with pretty high frequency, so attentions from the JS team would be much appreciated :) https://tbpl.mozilla.org/php/getParsedLog.php?id=39377639&tree=B2g-Inbound b2g_emulator_vm b2g-inbound opt test mochitest-2 on 2014-05-09 11:52:26 PDT for push 3422ae7c9be6 slave: tst-linux64-spot-732 11:58:02 INFO - runtests.py | Server pid: 2901 11:58:02 INFO - runtests.py | Websocket server pid: 2903 11:58:02 INFO - INFO | runtests.py | SSL tunnel pid: 2905 11:58:03 INFO - Mochitest INFO | runtestsb2g.py | Running tests: start. 11:58:15 INFO - 1399661895792 Marionette INFO marionette enabled via build flag and pref 11:58:17 INFO - 1399661898132 Marionette INFO marionette-server.js loaded 11:58:18 INFO - 1399661899368 Marionette INFO B2G emulator: yes 11:58:18 INFO - 1399661899381 Marionette INFO Device detected is generic 11:58:18 INFO - 1399661899390 Marionette INFO Bypassing offline status. 11:58:19 INFO - 1399661899413 Marionette INFO Listening on port 2828 11:58:19 INFO - 1399661899423 Marionette INFO Marionette server ready 11:58:19 INFO - System JS : WARNING resource://gre/modules/Preferences.jsm:378 - mutating the [[Prototype]] of an object will cause your code to run very slowly; instead create the object with the correct initial [[Prototype]] value using Object.create 11:58:21 INFO - 1399661901940 Marionette DEBUG accepted connection on 127.0.0.1:50004 11:58:31 INFO - 1399661911822 Marionette DEBUG accepted connection on 127.0.0.1:50005 11:59:08 INFO - 1399661948754 Marionette INFO loaded marionette-listener.js 11:59:08 INFO - 1399661948781 Marionette INFO sendToClient: {"from":"0","value":{"browserName":"B2G","browserVersion":"32.0a1","platformName":"ANDROID","platformVersion":"32.0a1","cssSelectorsEnabled":true,"handlesAlerts":false,"javascriptEnabled":true,"nativeEvents":false,"rotatable":true,"secureSsl":false,"takesElementScreenshot":true,"takesScreenshot":true,"platform":"ANDROID","XULappId":"{3c2e2abc-06d4-11e1-ac3b-374f68613e61}","appBuildId":"20140509095333","device":"qemu","version":"32.0a1","b2g":true}}, {f2dfce17-bb08-46d5-94cd-fc6d6057737a}, {f2dfce17-bb08-46d5-94cd-fc6d6057737a} 11:59:08 INFO - ###################################### forms.js loaded 11:59:08 INFO - ############################### browserElementPanning.js loaded 11:59:08 INFO - ######################## BrowserElementChildPreload.js loaded 11:59:08 INFO - *** UTM:SVC TimerManager:registerTimer - id: user-agent-updates-timer 11:59:11 INFO - 1399661951489 Marionette DEBUG Got request: setContext, data: {"to":"0","sessionId":{"rotatable":true,"browserVersion":"32.0a1","takesScreenshot":true,"appBuildId":"20140509095333","cssSelectorsEnabled":true,"javascriptEnabled":true,"XULappId":"{3c2e2abc-06d4-11e1-ac3b-374f68613e61}","secureSsl":false,"platform":"ANDROID","browserName":"B2G","version":"32.0a1","device":"qemu","b2g":true,"nativeEvents":false,"platformVersion":"32.0a1","takesElementScreenshot":true,"platformName":"ANDROID","handlesAlerts":false},"name":"setContext","parameters":{"value":"chrome"}}, id: {4b3adac6-2c17-41cf-9d01-f0abda522373} 11:59:11 INFO - 1399661951499 Marionette INFO sendToClient: {"from":"0","ok":true}, {4b3adac6-2c17-41cf-9d01-f0abda522373}, {4b3adac6-2c17-41cf-9d01-f0abda522373} 11:59:12 INFO - 1399661953010 Marionette DEBUG Got request: execute, data: {"to":"0","sessionId":{"rotatable":true,"browserVersion":"32.0a1","takesScreenshot":true,"appBuildId":"20140509095333","cssSelectorsEnabled":true,"javascriptEnabled":true,"XULappId":"{3c2e2abc-06d4-11e1-ac3b-374f68613e61}","secureSsl":false,"platform":"ANDROID","browserName":"B2G","version":"32.0a1","device":"qemu","b2g":true,"nativeEvents":false,"platformVersion":"32.0a1","takesElementScreenshot":true,"platformName":"ANDROID","handlesAlerts":false},"name":"executeScript","parameters":{"scriptTimeout":null,"specialPowers":false,"script":"\n Components.utils.import(\"resource://gre/modules/Services.jsm\");\n Services.io.manageOfflineStatus = false;\n Services.io.offline = false;\n ","newSandbox":true,"args":[],"filename":"remote.py","line":214}}, id: {64ee8f1b-6702-4104-84e4-13000b91907c} 11:59:19 INFO - mozcrash INFO | Downloading symbols from: http://pvtbuilds.pvt.build.mozilla.org/pub/mozilla.org/b2g/tinderbox-builds/b2g-inbound-emulator/20140509095333/b2g-32.0a1.en-US.android-arm.crashreporter-symbols.zip 11:59:38 WARNING - PROCESS-CRASH | b2ginstance.py | application crashed [@ js::ShapeTable::search(jsid, bool)] 11:59:38 INFO - Crash dump filename: /tmp/tmpDNWWSh/2f035f84-0493-4090-54f0b6f4-72939b66.dmp 11:59:38 INFO - Operating system: Android 11:59:38 INFO - 0.0.0 Linux 2.6.29-00302-g586075d #31 Mon Feb 24 10:28:23 PST 2014 armv7l Android/full/generic:4.0.4.0.4.0.4/OPENMASTER/eng.cltbld.20140509.133455:eng/test-keys 11:59:38 INFO - CPU: arm 11:59:38 INFO - 0 CPUs 11:59:38 INFO - Crash reason: SIGSEGV 11:59:38 INFO - Crash address: 0x0 11:59:38 INFO - Thread 0 (crashed) 11:59:38 INFO - 0 libxul.so!js::ShapeTable::search(jsid, bool) [Shape.cpp:3422ae7c9be6 : 189 + 0x0] 11:59:38 INFO - r4 = 0x40210fc0 r5 = 0x43ce8058 r6 = 0xfffff5c4 r7 = 0xbee5c5b4 11:59:38 INFO - r8 = 0x40210fc0 r9 = 0xbee5c5b0 r10 = 0x40210fc0 fp = 0x00000000 11:59:38 INFO - sp = 0xbee5c488 lr = 0x41cb5cbd pc = 0x41ccd986 11:59:38 INFO - Found by: given as instruction pointer in context 11:59:38 INFO - 1 libxul.so!js::ObjectImpl::nativeLookup(js::ExclusiveContext*, jsid) [Shape-inl.h:3422ae7c9be6 : 133 + 0x3] 11:59:38 INFO - r4 = 0x40210fc0 r5 = 0x43ce8058 r6 = 0xfffff5c4 r7 = 0xbee5c5b4 11:59:38 INFO - r8 = 0x40210fc0 r9 = 0xbee5c5b0 r10 = 0x40210fc0 fp = 0x00000000 11:59:38 INFO - sp = 0xbee5c4a0 pc = 0x41cb5cbd 11:59:38 INFO - Found by: call frame info 11:59:38 INFO - 2 libxul.so!js::LookupNativeProperty(js::ExclusiveContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::MutableHandle<JSObject*>, JS::MutableHandle<js::Shape*>) [jsobj.cpp:3422ae7c9be6 : 3969 + 0x7] 11:59:38 INFO - r4 = 0xbee5c758 r5 = 0x42579fa0 r6 = 0xfffff5c4 r7 = 0xbee5c5b4 11:59:38 INFO - r8 = 0x40210fc0 r9 = 0xbee5c5b0 r10 = 0x40210fc0 fp = 0x00000000 11:59:38 INFO - sp = 0xbee5c4b8 pc = 0x41c3d87d 11:59:38 INFO - Found by: call frame info 11:59:38 INFO - 3 libxul.so!bool js::baseops::SetPropertyHelper<(js::ExecutionMode)0>(js::ExecutionModeTraits<(js::ExecutionMode)0>::ContextType, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<jsid>, js::baseops::QualifiedBool, JS::MutableHandle<JS::Value>, bool) [jsobj.cpp:3422ae7c9be6 : 4848 + 0x7] 11:59:38 INFO - r4 = 0x42579fa0 r5 = 0x40210fc0 r6 = 0xbee5c7fc r7 = 0x00000000 11:59:38 INFO - r8 = 0xbee5c758 r9 = 0xbee5c5b4 r10 = 0xbee5c5b0 fp = 0x00000000 11:59:38 INFO - sp = 0xbee5c530 pc = 0x41c46115 11:59:38 INFO - Found by: call frame info 11:59:38 INFO - 4 libxul.so!JS_SetPropertyById [jsobj.h:3422ae7c9be6 : 1024 + 0x11] 11:59:38 INFO - r4 = 0xbee5c758 r5 = 0x449eef30 r6 = 0x43c28c40 r7 = 0xffffff87 11:59:38 INFO - r8 = 0x00000000 r9 = 0xbee5c758 r10 = 0xbee5c708 fp = 0xbee5c7fc 11:59:38 INFO - sp = 0xbee5c5e0 pc = 0x41bf73eb 11:59:38 INFO - Found by: call frame info 11:59:38 INFO - 5 libxul.so!mozJSComponentLoader::ImportInto(nsACString_internal const&, JS::Handle<JSObject*>, JSContext*, JS::MutableHandle<JSObject*>) [mozJSComponentLoader.cpp:3422ae7c9be6 : 1314 + 0xb] 11:59:38 INFO - r4 = 0x402d9d70 r5 = 0x449eef30 r6 = 0x43ae1a60 r7 = 0xbee5c710 11:59:38 INFO - r8 = 0x00000000 r9 = 0xbee5c758 r10 = 0xbee5c708 fp = 0xbee5c7fc 11:59:38 INFO - sp = 0xbee5c608 pc = 0x412a7997 11:59:38 INFO - Found by: call frame info 11:59:38 INFO - 6 libxul.so!mozJSComponentLoader::Import(nsACString_internal const&, JS::Handle<JS::Value>, JSContext*, unsigned char, JS::MutableHandle<JS::Value>) [mozJSComponentLoader.cpp:3422ae7c9be6 : 1127 + 0xd] 11:59:38 INFO - r4 = 0x43ef8c00 r5 = 0x402d9d70 r6 = 0x449eef30 r7 = 0xbee5c7f8 11:59:38 INFO - r8 = 0xbee5c948 r9 = 0x0000001a r10 = 0x4200e56a fp = 0x449eef20 11:59:38 INFO - sp = 0xbee5c7c0 pc = 0x412a7bb7 11:59:38 INFO - Found by: call frame info 11:59:38 INFO - 7 libxul.so!nsXPCComponents_Utils::Import(nsACString_internal const&, JS::Handle<JS::Value>, JSContext*, unsigned char, JS::MutableHandle<JS::Value>) [XPCComponents.cpp:3422ae7c9be6 : 2724 + 0x11] 11:59:38 INFO - r4 = 0x412a7b01 r5 = 0xbee5c918 r6 = 0x449eef30 r7 = 0x43ef8c00 11:59:38 INFO - r8 = 0x00000005 r9 = 0x0000001a r10 = 0x4200e56a fp = 0x449eef20 11:59:38 INFO - sp = 0xbee5c818 pc = 0x412785a9 11:59:38 INFO - Found by: call frame info 11:59:38 INFO - 8 libxul.so!NS_InvokeByIndex [xptcinvoke_arm.cpp:3422ae7c9be6 : 164 + 0x23] 11:59:38 INFO - r4 = 0x4127856d r5 = 0x449eef30 r6 = 0xbee5c948 r7 = 0xbee5c870 11:59:38 INFO - r8 = 0x00000005 r9 = 0x0000001a r10 = 0x4200e56a fp = 0x449eef20 11:59:38 INFO - sp = 0xbee5c840 pc = 0x40c77f95 11:59:38 INFO - Found by: call frame info 11:59:38 INFO - 9 libxul.so!XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) [XPCWrappedNative.cpp:3422ae7c9be6 : 2397 + 0xd] 11:59:38 INFO - r4 = 0x42579fa0 r5 = 0xbee5c948 r6 = 0xbee5c8d8 r7 = 0x00000010 11:59:38 INFO - r8 = 0x00000003 r9 = 0x0000001a r10 = 0x4200e56a fp = 0x421ad62c 11:59:38 INFO - sp = 0xbee5c8a0 pc = 0x41299835 11:59:38 INFO - Found by: call frame info 11:59:38 INFO - 10 libxul.so!XPC_WN_CallMethod(JSContext*, unsigned int, JS::Value*) [XPCWrappedNativeJSOps.cpp:3422ae7c9be6 : 1273 + 0x7] 11:59:38 INFO - r4 = 0x43ef8c00 r5 = 0xbee5ca9c r6 = 0x00000001 r7 = 0x00000001 11:59:38 INFO - r8 = 0x4023b284 r9 = 0x43ce2da0 r10 = 0x43ce2da0 fp = 0xffffff87 11:59:38 INFO - sp = 0xbee5ca78 pc = 0x4129d5cf 11:59:38 INFO - Found by: call frame info
Summary: Intermittent b2ginstance.py | application crashed [@ js::ShapeTable::search(jsid, bool)] → Intermittent B2G automation | b2ginstance.py | application crashed [@ js::ShapeTable::search(jsid, bool)]
I don't have the bandwidth for this at the moment. Sorry. :-(
Naveed, this is going to be climbing the OrangeFactor rankings in a hurry. Can you please help us find an owner?
Flags: needinfo?(nihsanullah)
Nicolas please take a look at this
Flags: needinfo?(nihsanullah) → needinfo?(nicolas.b.pierron)
(In reply to Ryan VanderMeulen [:RyanVM UTC-4] from comment #0) > This first started happening around 7-May, but was getting starred under bug > 1000883. Seems to happen on startup in mozJSComponentLoader code. It's > happening with pretty high frequency, so attentions from the JS team would > be much appreciated :) I look inside the following range (~May 7th) http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=d0523fcc5af9fbfd6e30e096c18e13c928048a26&tochange=615cffdf77cd7f5f61c0259c0999d7b45637c252 I do not yet see any JS changes which might cause such issue, also if it is as frequent as you mention, I would expect fuzzers to hit this case soonish. Also, based on the stack, I guess this might be in the glue code. Also, AWFY does not seems to fails more often compare to the repeated tests of B2g-(aurora/beta) branch. AWFY FFOS tests are using Marionette, so I guess we might be able to isolate these failures to some Marionette test cases which doing one Cu.import.
I looked precisely at when it got reported on Bug 1000883, and at the frequency of it. The first occurrence is (Bug 1000883 comment 75): https://tbpl.mozilla.org/php/getParsedLog.php?id=39242997&tree=B2g-Inbound b2g_emulator_vm b2g-inbound opt test mochitest-3 on 2014-05-07 17:31:31 revision: 79cef4dc41f9 slave: tst-linux64-spot-785 So I guess, that in the following range: http://hg.mozilla.org/integration/b2g-inbound/pushloghtml?fromchange=d0523fcc5af9fbfd6e30e096c18e13c928048a26&tochange=79cef4dc41f9 This is potentially related to changes made as part of Bug 993282. Also note the Bug 993282 comment 12, and that the patch got back out, and this match the absence of reports, which are raising again after the re-landing. (failure after the backout, Bug 1000883 comment 91) http://hg.mozilla.org/integration/b2g-inbound/pushloghtml?fromchange=7616388e078a&tochange=28462d6b3973 I suggest, triggering again the "b2g_emulator_vm opt mochitest[1-9]" on the try pushes (Bug 993282 comment 14).
Flags: needinfo?(fabrice)
Flags: needinfo?(nicolas.b.pierron)
They don't look to fail much on try...
Flags: needinfo?(fabrice)
(In reply to Fabrice Desré [:fabrice] from comment #21) > They don't look to fail much on try... There was at least one occurrence - see the red M7: https://tbpl.mozilla.org/?tree=Try&rev=c716badf1e49 I think we should back out bug 993282 until this is tracked down.
Flags: needinfo?(fabrice)
(In reply to Ed Morley [:edmorley UTC+0] from comment #29) > I think we should back out bug 993282 until this is tracked down. I put the call out for help on this bug in today's Platform meeting, but barring any soonish changes, I'm inclined to agree.
Fabrice: the consensus seems to be that this crash is a regression from bug 993282. If you need any help debugging, just ping :nbp.
Bug 993282 backed out since there doesn't seem to be any progress here.
Blocks: 993282
Flags: needinfo?(fabrice)
(In reply to Ed Morley [:edmorley UTC+0] from comment #176) > Bug 993282 backed out since there doesn't seem to be any progress here. This has gone away now the backout has been merged around; bug 993282 was the cause.
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
status-b2g-v1.4: --- → unaffected
status-b2g-v2.0: --- → fixed
status-firefox30: --- → unaffected
status-firefox31: --- → unaffected
status-firefox32: --- → fixed
status-firefox-esr24: --- → unaffected
Target Milestone: --- → mozilla32
(In reply to Ed Morley [:edmorley UTC+0] from comment #182) > (In reply to Ed Morley [:edmorley UTC+0] from comment #176) > > Bug 993282 backed out since there doesn't seem to be any progress here. > > This has gone away now the backout has been merged around; bug 993282 was > the cause. Well, that doesn't fix the underlying cause, which is in the js engine and not bug 993282 in itself. Nicolas, since you started looking at the crash, do you prefer using a new bug?
Flags: needinfo?(nicolas.b.pierron)
(In reply to < away until June 17 > from comment #183) > (In reply to Ed Morley [:edmorley UTC+0] from comment #182) > > (In reply to Ed Morley [:edmorley UTC+0] from comment #176) > > > Bug 993282 backed out since there doesn't seem to be any progress here. > > > > This has gone away now the backout has been merged around; bug 993282 was > > the cause. > > Well, that doesn't fix the underlying cause, which is in the js engine and > not bug 993282 in itself. > Nicolas, since you started looking at the crash, do you prefer using a new > bug? Even if a landing is not the root cause, but merely tickles an existing issue, that landing should be backed out until the root cause is resolved. This is normal practice.
Summary: Intermittent B2G automation | b2ginstance.py | application crashed [@ js::ShapeTable::search(jsid, bool)] → Intermittent b2ginstance.py | application crashed [@ js::ShapeTable::search(jsid, bool)]
Blocks: 1024157
Flags: needinfo?(nicolas.b.pierron)
You need to log in before you can comment on or make changes to this bug.