Closed Bug 1182207 Opened 6 years ago Closed 3 years ago

GC OOM of unknown size in js::gc::StoreBuffer::MonoTypeBuffer<T>::trace


(Core :: JavaScript: GC, defect)

Windows NT
Not set



Tracking Status
firefox39 --- unaffected
firefox40 + wontfix
firefox41 + wontfix
firefox42 - affected


(Reporter: kairo, Unassigned)


(Keywords: crash)

Crash Data

This bug was filed from the Socorro interface and is 
report bp-0e92ef9a-da25-443c-ad17-16d3d2150709.

Top Frames:
0 	xul.dll 	js::CrashAtUnhandlableOOM(char const*) 	js/src/jscntxt.cpp
1 	xul.dll 	js::gc::StoreBuffer::MonoTypeBuffer<js::gc::StoreBuffer::ValueEdge>::trace(js::gc::StoreBuffer*, js::TenuringTracer&) 	js/src/gc/Marking.cpp
2 	xul.dll 	js::Nursery::collect(JSRuntime*, JS::gcreason::Reason, js::Vector<js::ObjectGroup*, 0, js::SystemAllocPolicy>*) 	js/src/gc/Nursery.cpp
3 	xul.dll 	js::gc::GCRuntime::minorGCImpl(JS::gcreason::Reason, js::Vector<js::ObjectGroup*, 0, js::SystemAllocPolicy>*) 	js/src/jsgc.cpp
4 	xul.dll 	js::gc::GCRuntime::evictNursery(JS::gcreason::Reason) 	js/src/gc/GCRuntime.h
5 	xul.dll 	js::gc::GCRuntime::gcCycle(bool, js::SliceBudget&, JS::gcreason::Reason) 	js/src/jsgc.cpp
6 	xul.dll 	js::gc::GCRuntime::collect(bool, js::SliceBudget, JS::gcreason::Reason) 	js/src/jsgc.cpp
7 	xul.dll 	js::gc::GCRuntime::gc(JSGCInvocationKind, JS::gcreason::Reason) 	js/src/jsgc.cpp
8 	xul.dll 	js::gc::GCRuntime::refillFreeListFromMainThread<1>(JSContext*, js::gc::AllocKind, unsigned int) 	js/src/gc/Allocator.cpp
9 	xul.dll 	js::Allocate<JSObject, 1>(js::ExclusiveContext*, js::gc::AllocKind, unsigned int, js::gc::InitialHeap, js::Class const*) 	js/src/gc/Allocator.cpp

This OOM signature in GC is new with 40 and affects all newer trains. It's 0.7% of all crashes in 40.0b2.
Crash Signature: [@ OOM | unknown | js::CrashAtUnhandlableOOM(char const*) | js::gc::StoreBuffer::MonoTypeBuffer<T>::trace(js::gc::StoreBuffer*, js::TenuringTracer&)] → [@ OOM | unknown | js::CrashAtUnhandlableOOM(char const*) | js::gc::StoreBuffer::MonoTypeBuffer<T>::trace(js::gc::StoreBuffer*, js::TenuringTracer&)] [@ OOM | unknown | js::CrashAtUnhandlableOOM | js::gc::StoreBuffer::MonoTypeBuffer<T>::trace]
Adding a tracking flag for FF40 as this was mentioned notable in the Beta stability during channel meeting. I also see some instances on FF41 though nearly not as many as on FF40.
Naveed - Can you please have someone take a look at this bug, which is currently one of the top crashes in Beta 40?
Flags: needinfo?(nihsanullah)
Assignee: nobody → terrence
Flags: needinfo?(nihsanullah)
We haven't changed anything in this area in close to a year. Perhaps this is just a moved signature?
Possibly a variant of this signature on 1100652?

OOM | unknown | js::CrashAtUnhandlableOOM(char const*) | js::gc::StoreBuffer::MonoTypeBuffer<js::gc::StoreBuffer::ValueEdge>::put(js::gc::StoreBuffer*, js::gc::StoreBuffer::ValueEdge const&) 

It's odd that that bug is marked fixed. From the last few comments I guess I added the crash signature after the patch landed, in the hopes that the patch would resolve those OOMs. But it looks like we never confirmed that.
Given that the crash rate is in an acceptable range for 40, I'm marking this as wontfix for this release.
This is an OOM|small: there's nothing we can do here.
Assignee: terrence → nobody
The current snapshot of 41.0b crash-stats has this issue ranked at 33. Given that it is not in the top 10 and comment 6, I will resolve this as wontfix for FF41. Added tracking for FF42.
Not actionable, we published two releases with this bug, stop tracking.
Closing because no crash reported since 12 weeks.
Closed: 3 years ago
Resolution: --- → WONTFIX
Closing because no crash reported since 12 weeks.
You need to log in before you can comment on or make changes to this bug.