Crash in js::GCMarker::traverseEdge

NEW
Unassigned

Status

()

Core
JavaScript: GC
--
critical
3 years ago
8 months ago

People

(Reporter: Grant, Unassigned)

Tracking

({crash, topcrash-win})

Trunk
All
Windows
crash, topcrash-win
Points:
---

Firefox Tracking Flags

(e10s-, firefox47 affected, firefox48 affected, firefox49 affected, firefox-esr45 affected, firefox50 affected, firefox51 affected, firefox52 wontfix, firefox53 affected, firefox54 affected)

Details

(crash signature)

(Reporter)

Description

3 years ago
Hey,

1. Be browsing around like normal with e10s enabled on nightly
2. Bam! All tabs crash
3. Get this crash report:

Doesn't happen if I revert to a build earlier than 25th May

https://crash-stats.mozilla.com/report/index/06aac959-c6ad-413c-9eca-3eaae2150528

It seems to be happening a lot - according to "more reports" its spiked over last couple of days.

Thanks
Blocks: 899758
Severity: normal → critical
Status: UNCONFIRMED → NEW
Crash Signature: [@ js::GCMarker::traverseEdge<JSObject*, js::ObjectGroup*>(JSObject*, js::ObjectGroup*) ]
tracking-e10s: --- → ?
Ever confirmed: true
Keywords: crash, crashreportid, regression, regressionwindow-wanted
#12 in top crash list and climbing

this has been around since 2015051509. but began increasing in volume since 2015051903
Keywords: regression, regressionwindow-wanted → topcrash-win
OS: Windows 7 → Windows
Hardware: x86_64 → All
NI to jimm to see if this is corelated with e10s
Flags: needinfo?(jmathies)

Comment 3

3 years ago
(In reply to Brad Lassey [:blassey] (use needinfo?) from comment #2)
> NI to jimm to see if this is corelated with e10s


browser process:
https://crash-stats.mozilla.com/search/?product=Firefox&signature=%3Djs%3A%3AGCMarker%3A%3AtraverseEdge%3CJSObject*%2C+js%3A%3AObjectGroup*%3E%28JSObject*%2C+js%3A%3AObjectGroup*%29&process_type=browser&_facets=signature&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#facet-signature

content process:
https://crash-stats.mozilla.com/search/?product=Firefox&signature=%3Djs%3A%3AGCMarker%3A%3AtraverseEdge%3CJSObject*%2C+js%3A%3AObjectGroup*%3E%28JSObject*%2C+js%3A%3AObjectGroup*%29&process_type=content&_facets=signature&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#facet-signature

non-e10s:
https://crash-stats.mozilla.com/search/?product=Firefox&signature=%3Djs%3A%3AGCMarker%3A%3AtraverseEdge%3CJSObject*%2C+js%3A%3AObjectGroup*%3E%28JSObject*%2C+js%3A%3AObjectGroup*%29&dom_ipc_enabled=__null__&_facets=signature&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#facet-signature

e10s:
https://crash-stats.mozilla.com/search/?product=Firefox&signature=%3Djs%3A%3AGCMarker%3A%3AtraverseEdge%3CJSObject*%2C+js%3A%3AObjectGroup*%3E%28JSObject*%2C+js%3A%3AObjectGroup*%29&dom_ipc_enabled=!__null__&_facets=signature&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#facet-signature

Since nightly e10s coverage is around 80%, this crash looks worse for non-e10s. Definitely not e10s specific.
Flags: needinfo?(jmathies)
tracking-e10s: ? → -

Updated

2 years ago
Crash Signature: [@ js::GCMarker::traverseEdge<JSObject*, js::ObjectGroup*>(JSObject*, js::ObjectGroup*) ] → [@ js::GCMarker::traverseEdge<JSObject*, js::ObjectGroup*>(JSObject*, js::ObjectGroup*) ] [@ js::GCMarker::traverseEdge<T> ]

Updated

2 years ago
Component: Untriaged → JavaScript: GC

Comment 4

2 years ago
Grant, does this still reproduce for you?


(In reply to Grant from comment #0)
> Hey,
> 
> 1. Be browsing around like normal with e10s enabled on nightly
> 2. Bam! All tabs crash
> 3. Get this crash report:
> 
> Doesn't happen if I revert to a build earlier than 25th May

http://hg.mozilla.org/mozilla-central/pushloghtml?startdate=2015-05-23+03%3A05%3A00&enddate=2015-05-25+03%3A05%3A00


> https://crash-stats.mozilla.com/report/index/06aac959-c6ad-413c-9eca-3eaae2150528

 0 	xul.dll	js::GCMarker::traverseEdge<JSObject*, js::ObjectGroup*>(JSObject*, js::ObjectGroup*)	js/src/gc/Marking.cpp
1 	xul.dll	js::GCMarker::processMarkStackTop(js::SliceBudget&)	js/src/gc/Marking.cpp
2 	xul.dll	js::GCMarker::drainMarkStack(js::SliceBudget&)	js/src/gc/Marking.cpp
3 	xul.dll	js::gc::GCRuntime::drainMarkStack(js::SliceBudget&, js::gcstats::Phase)	js/src/jsgc.cpp
4 	xul.dll	js::gc::GCRuntime::incrementalCollectSlice(js::SliceBudget&, JS::gcreason::Reason)	js/src/jsgc.cpp
5 	xul.dll	js::gc::GCRuntime::gcCycle(bool, js::SliceBudget&, JS::gcreason::Reason)	js/src/jsgc.cpp
6 	xul.dll	js::gc::GCRuntime::collect(bool, js::SliceBudget, JS::gcreason::Reason)	js/src/jsgc.cpp
7 	xul.dll	js::gc::GCRuntime::gcSlice(JS::gcreason::Reason, __int64)	js/src/jsgc.cpp
8 	xul.dll	nsXPConnect::NotifyDidPaint()	js/xpconnect/src/nsXPConnect.cpp
9 	xul.dll	nsRefreshDriver::Tick(__int64, mozilla::TimeStamp)	layout/base/nsRefreshDriver.cpp
10 	xul.dll	mozilla::RefreshDriverTimer::TickDriver(nsRefreshDriver*, __int64, mozilla::TimeStamp)	layout/base/nsRefreshDriver.cpp
Flags: needinfo?(tenisthenewnine)
Keywords: crashreportid

Comment 5

2 years ago
(In reply to Tracy Walker [:tracy] from comment #1)
> #12 in top crash list and climbing
> 
> this has been around since 2015051509. but began increasing in volume since
> 2015051903

So a checkin on the 18th made it worse?
http://hg.mozilla.org/mozilla-central/pushloghtml?startdate=2015-05-18+03%3A05%3A00&enddate=2015-05-19+03%3A05%3A00
(Reporter)

Comment 6

2 years ago
Wayne, I don't think this is still happening to me. I rarely get crashes on nightlies anymore.
Flags: needinfo?(tenisthenewnine)
Still defective.  Crash still occurring in v48.0a1, e.g - 

https://crash-stats.mozilla.com/report/index/954a14db-e062-4bd4-9b95-9146f2160310
https://crash-stats.mozilla.com/report/index/a81d0fd1-27ba-4e6c-950f-8a2ca2160309

This 'feature' appears to have been introduced in v40.0 and has 3,068 reported instances, to date.  Given it is still occurring in v48.0a1, it is safe to presume that this defect remains unresolved.

Updated

2 years ago
Summary: Content process intermittently crashes since ~25th May build → Crash in js::GCMarker::traverseEdge

Updated

2 years ago
Blocks: 1249209
No longer blocks: 899758

Comment 8

2 years ago
This is another gc crash with high e10s correlation. Terrance, can you offer any insight here? Wondering if this is OOM related.
Flags: needinfo?(terrence)
This is the central function that walks through every single pointer in the system every 30 seconds when we GC. Any sort of memory corruption at all is going to crash here if it doesn't crash somewhere else first. This can be caused by bugs in firefox, in which case we probably see some sort of crash spike here and elsewhere at the same time. It can also be caused by a flaky stick of RAM. Of which there are many[1]. Looking at the reports table, I see that this is hovering at 20-50 crashes per build, which is fairly in line with what this crash (in its various names over the years) has always been hovering at.

1- http://www.zdnet.com/article/dram-error-rates-nightmare-on-dimm-street/
Flags: needinfo?(terrence)
I also suffer from a similar issue in Debian Linux.

See my previous post: https://bugzilla.mozilla.org/show_bug.cgi?id=1267655#c2
Crash volume for signature 'js::GCMarker::traverseEdge<T>':
 - nightly (version 50): 50 crashes from 2016-06-06.
 - aurora  (version 49): 77 crashes from 2016-06-07.
 - beta    (version 48): 4286 crashes from 2016-06-06.
 - release (version 47): 11732 crashes from 2016-05-31.
 - esr     (version 45): 1030 crashes from 2016-04-07.

Crash volume on the last weeks:
             Week N-1   Week N-2   Week N-3   Week N-4   Week N-5   Week N-6   Week N-7
 - nightly          2         18         10          3          7          6          4
 - aurora          12          8         16         23          8          8          0
 - beta           923        747        632        311        643        603        173
 - release       1769       1864       1711       1787       1766       1699        599
 - esr            159        147        113        106        115        112         61

Affected platform: Windows
status-firefox47: --- → affected
status-firefox48: --- → affected
status-firefox49: --- → affected
status-firefox50: --- → affected
status-firefox-esr45: --- → affected
Crash volume for signature 'js::GCMarker::traverseEdge<T>':
 - nightly (version 51): 15 crashes from 2016-08-01.
 - aurora  (version 50): 21 crashes from 2016-08-01.
 - beta    (version 49): 535 crashes from 2016-08-02.
 - release (version 48): 2557 crashes from 2016-07-25.
 - esr     (version 45): 1658 crashes from 2016-05-02.

Crash volume on the last weeks (Week N is from 08-22 to 08-28):
            W. N-1  W. N-2  W. N-3
 - nightly       4       7       3
 - aurora       10       9       0
 - beta        294     192      29
 - release     818     744     408
 - esr         156     164     158

Affected platform: Windows

Crash rank on the last 7 days:
           Browser   Content     Plugin
 - nightly           #194
 - aurora  #404      #733
 - beta    #247      #191
 - release #20       #12
 - esr     #53
status-firefox51: --- → affected
Crash volume for signature 'js::GCMarker::traverseEdge<T>':
 - nightly (version 52): 32 crashes from 2016-09-19.
 - aurora  (version 51): 32 crashes from 2016-09-19.
 - beta    (version 50): 345 crashes from 2016-09-20.
 - release (version 49): 2157 crashes from 2016-09-05.
 - esr     (version 45): 2492 crashes from 2016-06-01.

Crash volume on the last weeks (Week N is from 10-03 to 10-09):
            W. N-1  W. N-2
 - nightly      16      16
 - aurora       28       4
 - beta        339       6
 - release    1720     436
 - esr         217     192

Affected platform: Windows

Crash rank on the last 7 days:
           Browser   Content     Plugin
 - nightly #104      #98
 - aurora  #59       #105
 - beta    #46       #54
 - release #29       #19
 - esr     #50
status-firefox52: --- → affected
Crash volume for signature 'js::GCMarker::traverseEdge<T>':
 - nightly (version 53): 127 crashes from 2016-11-14.
 - aurora  (version 52): 155 crashes from 2016-11-14.
 - beta    (version 51): 2003 crashes from 2016-11-14.
 - release (version 50): 7030 crashes from 2016-11-01.
 - esr     (version 45): 5322 crashes from 2016-07-06.

Crash volume on the last weeks (Week N is from 01-02 to 01-08):
            W. N-1  W. N-2  W. N-3  W. N-4  W. N-5  W. N-6  W. N-7
 - nightly      21      12      14      26      17      18      14
 - aurora       25      27      24      25      26      21       0
 - beta         23      23     309     672     622     340      10
 - release    2644    2269    1026      85      69      77      23
 - esr         125     170     265     285     288     278     286

Affected platform: Windows

Crash rank on the last 7 days:
           Browser   Content   Plugin
 - nightly #88       #62
 - aurora  #95       #71
 - beta    #51       #35
 - release #73       #51
 - esr     #59
status-firefox53: --- → affected
Crash volume for signature 'js::GCMarker::traverseEdge<T>':
 - nightly (version 54): 24 crashes from 2017-01-23.
 - aurora  (version 53): 10 crashes from 2017-01-23.
 - beta    (version 52): 474 crashes from 2017-01-23.
 - release (version 51): 0 crashes from 2017-01-16.
 - esr     (version 45): 5340 crashes from 2016-08-03.

Crash volume on the last weeks (Week N is from 01-30 to 02-05):
            W. N-1  W. N-2  W. N-3  W. N-4  W. N-5  W. N-6  W. N-7
 - nightly      17
 - aurora        4
 - beta        238
 - release       0       0
 - esr         235     213     200     176     125     170     265

Affected platform: Windows

Crash rank on the last 7 days:
           Browser   Content   Plugin
 - nightly #83       #36
 - aurora  #81       #42
 - beta    #24       #22
 - release
 - esr     #62
status-firefox54: --- → affected
Too late for firefox 52, mass-wontfix.
status-firefox52: affected → wontfix
This happened to me when my Windows 10 laptop went to standby for a moment.

Sebastian
Sorry, forgot the crash report:
https://crash-stats.mozilla.com/report/index/8faae8b6-f8b3-4fb6-b5f8-c76fd0170425

Sebastian
You need to log in before you can comment on or make changes to this bug.