1182207 - GC OOM of unknown size in js::gc::StoreBuffer::MonoTypeBuffer<T>::trace

Status: RESOLVED WONTFIX

(Core :: JavaScript: GC, defect)

Description

[Robert Kaiser]

This bug was filed from the Socorro interface and is 
report bp-0e92ef9a-da25-443c-ad17-16d3d2150709.
=============================================================

Top Frames:
0 	xul.dll 	js::CrashAtUnhandlableOOM(char const*) 	js/src/jscntxt.cpp
1 	xul.dll 	js::gc::StoreBuffer::MonoTypeBuffer<js::gc::StoreBuffer::ValueEdge>::trace(js::gc::StoreBuffer*, js::TenuringTracer&) 	js/src/gc/Marking.cpp
2 	xul.dll 	js::Nursery::collect(JSRuntime*, JS::gcreason::Reason, js::Vector<js::ObjectGroup*, 0, js::SystemAllocPolicy>*) 	js/src/gc/Nursery.cpp
3 	xul.dll 	js::gc::GCRuntime::minorGCImpl(JS::gcreason::Reason, js::Vector<js::ObjectGroup*, 0, js::SystemAllocPolicy>*) 	js/src/jsgc.cpp
4 	xul.dll 	js::gc::GCRuntime::evictNursery(JS::gcreason::Reason) 	js/src/gc/GCRuntime.h
5 	xul.dll 	js::gc::GCRuntime::gcCycle(bool, js::SliceBudget&, JS::gcreason::Reason) 	js/src/jsgc.cpp
6 	xul.dll 	js::gc::GCRuntime::collect(bool, js::SliceBudget, JS::gcreason::Reason) 	js/src/jsgc.cpp
7 	xul.dll 	js::gc::GCRuntime::gc(JSGCInvocationKind, JS::gcreason::Reason) 	js/src/jsgc.cpp
8 	xul.dll 	js::gc::GCRuntime::refillFreeListFromMainThread<1>(JSContext*, js::gc::AllocKind, unsigned int) 	js/src/gc/Allocator.cpp
9 	xul.dll 	js::Allocate<JSObject, 1>(js::ExclusiveContext*, js::gc::AllocKind, unsigned int, js::gc::InitialHeap, js::Class const*) 	js/src/gc/Allocator.cpp
[...]

This OOM signature in GC is new with 40 and affects all newer trains. It's 0.7% of all crashes in 40.0b2.

Comment 1

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Adding a tracking flag for FF40 as this was mentioned notable in the Beta stability during channel meeting. I also see some instances on FF41 though nearly not as many as on FF40.

Comment 2

[Lawrence Mandel [:lmandel] (use needinfo)]

Naveed - Can you please have someone take a look at this bug, which is currently one of the top crashes in Beta 40?

Comment 3

[Terrence Cole [:terrence]]

We haven't changed anything in this area in close to a year. Perhaps this is just a moved signature?

Comment 4

[(Away)]

Possibly a variant of this signature on 1100652?

OOM | unknown | js::CrashAtUnhandlableOOM(char const*) | js::gc::StoreBuffer::MonoTypeBuffer<js::gc::StoreBuffer::ValueEdge>::put(js::gc::StoreBuffer*, js::gc::StoreBuffer::ValueEdge const&) 

It's odd that that bug is marked fixed. From the last few comments I guess I added the crash signature after the patch landed, in the hopes that the patch would resolve those OOMs. But it looks like we never confirmed that.

Comment 5

[Lawrence Mandel [:lmandel] (use needinfo)]

Given that the crash rate is in an acceptable range for 40, I'm marking this as wontfix for this release.

Comment 6

[Terrence Cole [:terrence]]

This is an OOM|small: there's nothing we can do here.

Comment 7

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

The current snapshot of 41.0b crash-stats has this issue ranked at 33. Given that it is not in the top 10 and comment 6, I will resolve this as wontfix for FF41. Added tracking for FF42.

Comment 8

[Sylvestre Ledru [:Sylvestre]]

Not actionable, we published two releases with this bug, stop tracking.

Comment 9

[Sylvestre Ledru [:Sylvestre]]

Closing because no crash reported since 12 weeks.

Comment 10

[Sylvestre Ledru [:Sylvestre]]

Closing because no crash reported since 12 weeks.