Closed Bug 1033459 Opened 10 years ago Closed 10 years ago

Intermittent Android 2.3 test_webgl_conformance_test_suite.html | application crashed [@ jemalloc_crash] (with js::jit::Assembler::~Assembler() on the stack)

Categories

(Core :: JavaScript Engine: JIT, defect)

Product:
Core
Component:
JavaScript Engine: JIT
Platform:
ARM
Android
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: emorley, Unassigned)

References

Details

(Keywords: crash, intermittent-failure)

Crash Data

Android 2.3 Emulator mozilla-inbound opt test mochitest-gl on 2014-07-02 08:07:56 PDT for push df2d52a1ac29

slave: tst-linux64-spot-883

https://tbpl.mozilla.org/php/getParsedLog.php?id=42946663&tree=Mozilla-Inbound

{
08:36:46     INFO -  3994 INFO TEST-INFO | /tests/content/canvas/test/webgl-conformance/test_webgl_conformance_test_suite.html | [conformance/misc/uninitialized-test.html] (WebGL mochitest) Starting test page
08:36:46     INFO -  3995 INFO TEST-PASS | /tests/content/canvas/test/webgl-conformance/test_webgl_conformance_test_suite.html | [conformance/misc/uninitialized-test.html] Test passed - Context created.
08:36:46     INFO -  3996 INFO TEST-PASS | /tests/content/canvas/test/webgl-conformance/test_webgl_conformance_test_suite.html | [conformance/misc/uninitialized-test.html] Test passed - gl.checkFramebufferStatus(gl.FRAMEBUFFER) is gl.FRAMEBUFFER_COMPLETE
08:36:46     INFO -  INFO | automation.py | Application ran for: 0:19:48.081353
08:36:46     INFO -  INFO | zombiecheck | Reading PID log: /tmp/tmpJ116e5pidlog
08:36:46     INFO -  /data/anr/traces.txt not found
08:36:46     INFO -  mozcrash INFO | Downloading symbols from: https://ftp-ssl.mozilla.org/pub/mozilla.org/mobile/tinderbox-builds/mozilla-inbound-android/1404311422/fennec-33.0a1.en-US.android-arm.crashreporter-symbols.zip
08:36:46  WARNING -  PROCESS-CRASH | /tests/content/canvas/test/webgl-conformance/test_webgl_conformance_test_suite.html | application crashed [@ jemalloc_crash]
08:36:46     INFO -  Crash dump filename: /tmp/tmpHUWOUI/33c69af2-2669-ecae-34c5f3ba-0f805fb4.dmp
08:36:46     INFO -  Operating system: Android
08:36:46     INFO -                    0.0.0 Linux 2.6.29-ge3d684d #1 Mon Dec 16 22:26:51 UTC 2013 armv7l generic/sdk/generic:2.3.7/GINGERBREAD/eng.ubuntu.20140123.014351:eng/test-keys
08:36:46     INFO -  CPU: arm
08:36:46     INFO -       0 CPUs
08:36:46     INFO -  
08:36:46     INFO -  Crash reason:  SIGSEGV
08:36:46     INFO -  Crash address: 0x0
08:36:46     INFO -  
08:36:46     INFO -  Thread 11 (crashed)
08:36:46     INFO -   0  libmozglue.so!jemalloc_crash [jemalloc.c:df2d52a1ac29 : 1574 + 0x4]
08:36:46     INFO -       r4 = 0x46d2d000    r5 = 0x58803000    r6 = 0x5713b888    r7 = 0x58801000
08:36:46     INFO -       r8 = 0x5713e190    r9 = 0x00000001   r10 = 0x58800000    fp = 0x562e6840
08:36:46     INFO -       sp = 0x47c2f9e8    lr = 0x8032783f    pc = 0x803264be
08:36:46     INFO -      Found by: given as instruction pointer in context
08:36:46     INFO -   1  libmozglue.so!arena_dalloc [jemalloc.c:df2d52a1ac29 : 4584 + 0x3]
08:36:46     INFO -       r4 = 0x46d2d000    r5 = 0x58803000    r6 = 0x5713b888    r7 = 0x58801000
08:36:46     INFO -       r8 = 0x5713e190    r9 = 0x00000001   r10 = 0x58800000    fp = 0x562e6840
08:36:46     INFO -       sp = 0x47c2f9f0    pc = 0x8032783f
08:36:46     INFO -      Found by: call frame info
08:36:46     INFO -   2  libxul.so!js::LifoAlloc::freeAll() [Utility.h:df2d52a1ac29 : 122 + 0x3]
08:36:46     INFO -       r4 = 0x5713a248    r5 = 0x58803000    r6 = 0x5713b888    r7 = 0x5642229a
08:36:46     INFO -       r8 = 0x5713e190    r9 = 0x00000001   r10 = 0x55ea2a40    fp = 0x562e6840
08:36:46     INFO -       sp = 0x47c2fa10    pc = 0x4e68b54d
08:36:46     INFO -      Found by: call frame info
08:36:46     INFO -   3  libxul.so!js::jit::Assembler::~Assembler() [LifoAlloc.h:df2d52a1ac29 : 245 + 0x3]
08:36:46     INFO -       r4 = 0x5713a030    r5 = 0x5713b740    r6 = 0x5713b888    r7 = 0x5642229a
08:36:46     INFO -       r8 = 0x5713e190    r9 = 0x00000001   r10 = 0x55ea2a40    fp = 0x562e6840
08:36:46     INFO -       sp = 0x47c2fa20    pc = 0x4e6c641b
08:36:46     INFO -      Found by: call frame info
08:36:46     INFO -   4  libxul.so!js::jit::MacroAssembler::~MacroAssembler() [MacroAssembler-arm.h:df2d52a1ac29 : 29 + 0x5]
08:36:46     INFO -       r4 = 0x5713a030    r5 = 0x5713b740    r6 = 0x5713b888    r7 = 0x5642229a
08:36:46     INFO -       r8 = 0x5713e190    r9 = 0x00000001   r10 = 0x55ea2a40    fp = 0x562e6840
08:36:46     INFO -       sp = 0x47c2fa28    pc = 0x4e71668d
08:36:46     INFO -      Found by: call frame info
08:36:46     INFO -   5  libxul.so!js::jit::CodeGeneratorShared::~CodeGeneratorShared() [Maybe.h:df2d52a1ac29 : 41 + 0xb]
08:36:46     INFO -       r4 = 0x5713a000    r5 = 0x5713b740    r6 = 0x5713b888    r7 = 0x5642229a
08:36:46     INFO -       r8 = 0x5713e190    r9 = 0x00000001   r10 = 0x55ea2a40    fp = 0x562e6840
08:36:46     INFO -       sp = 0x47c2fa30    pc = 0x4e71b953
08:36:46     INFO -      Found by: call frame info
08:36:46     INFO -   6  libxul.so!js::jit::CodeGenerator::~CodeGenerator() [CodeGenerator-arm.h:df2d52a1ac29 : 19 + 0xd]
08:36:46     INFO -       r4 = 0x5713a000    r5 = 0x00000000    r6 = 0x57f65fc0    r7 = 0x5642229a
08:36:46     INFO -       r8 = 0x5713e190    r9 = 0x00000001   r10 = 0x55ea2a40    fp = 0x562e6840
08:36:46     INFO -       sp = 0x47c2fa40    pc = 0x4e71b9c7
08:36:46     INFO -      Found by: call frame info
08:36:46     INFO -   7  libxul.so!js::ScopedJSDeletePtr<js::jit::CodeGenerator>::~ScopedJSDeletePtr() [Utility.h:df2d52a1ac29 : 334 + 0x5]
08:36:46     INFO -       r4 = 0x5713a000    r5 = 0x47c2fab4    r6 = 0x57f65fc0    r7 = 0x5642229a
08:36:46     INFO -       r8 = 0x5713e190    r9 = 0x00000001   r10 = 0x55ea2a40    fp = 0x562e6840
08:36:46     INFO -       sp = 0x47c2fa50    pc = 0x4e721d57
08:36:46     INFO -      Found by: call frame info
08:36:46     INFO -   8  libxul.so!js::jit::Compile [Ion.cpp:df2d52a1ac29 : 1951 + 0xd]
08:36:46     INFO -       r4 = 0x00000004    r5 = 0x47c2fb24    r6 = 0x57f65fc0    r7 = 0x5642229a
08:36:46     INFO -       r8 = 0x5713e190    r9 = 0x00000001   r10 = 0x55ea2a40    fp = 0x562e6840
08:36:46     INFO -       sp = 0x47c2fa60    pc = 0x4e756c41
08:36:46     INFO -      Found by: call frame info
08:36:46     INFO -   9  libxul.so!js::jit::CanEnterAtBranch(JSContext*, JSScript*, js::jit::BaselineFrame*, unsigned char*, bool) [Ion.cpp:df2d52a1ac29 : 2170 + 0x5]
08:36:46     INFO -       r4 = 0x0000000b    r5 = 0x51b68180    r6 = 0x57f65fc0    r7 = 0x00000000
08:36:46     INFO -       r8 = 0x5642229a    r9 = 0x00000001   r10 = 0x0000000b    fp = 0x47c2fbd0
08:36:46     INFO -       sp = 0x47c2fb18    pc = 0x4e756fd9
08:36:46     INFO -      Found by: call frame info
08:36:46     INFO -  10  libxul.so!js::jit::DoUseCountFallback [BaselineIC.cpp:df2d52a1ac29 : 810 + 0xd]
08:36:46     INFO -       r4 = 0x00000291    r5 = 0x57f65fc0    r6 = 0x47c2fbcc    r7 = 0x47c2fc18
08:36:46     INFO -       r8 = 0x5642229a    r9 = 0x00000001   r10 = 0x0000000b    fp = 0x47c2fbd0
08:36:46     INFO -       sp = 0x47c2fb40    pc = 0x4e75716d
08:36:46     INFO -      Found by: call frame info
}
Is this actually only showing up once every four days or so? If it is, I don't like my chances for reproducing this under a debugger.  That being said, since there is an explicit call to jemalloc_crash, I'll try running a linux browser under valgrind, and see if anything comes up.
(In reply to Marty Rosenberg [:mjrosenb] from comment #3)
> Is this actually only showing up once every four days or so? If it is, I
> don't like my chances for reproducing this under a debugger.  That being
> said, since there is an explicit call to jemalloc_crash, I'll try running a
> linux browser under valgrind, and see if anything comes up.

I'm hitting this pretty regularly on an Aurora-as-Beta Try push as well.
https://tbpl.mozilla.org/?tree=Try&rev=cd72cc28d32c&jobname=Android%202.3%20Emulator%20try%20opt%20test%20mochitest-gl
(In reply to Ryan VanderMeulen [:RyanVM UTC-4] from comment #8)
> I'm hitting this pretty regularly on an Aurora-as-Beta Try push as well.
> https://tbpl.mozilla.org/?tree=Try&rev=cd72cc28d32c&jobname=Android%202.
> 3%20Emulator%20try%20opt%20test%20mochitest-gl

FWIW, this means that we *might* see a spike in this after next Tuesday's merge from Aurora to Beta.
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.