All users were logged out of Bugzilla on October 13th, 2018

Intermittent v8_7 | application crashed [@ js::CancelOffThreadIonCompile(JSCompartment *,JSScript *)]

RESOLVED WORKSFORME

Status

()

P3
normal
RESOLVED WORKSFORME
3 years ago
2 years ago

People

(Reporter: RyanVM, Unassigned)

Tracking

({crash, intermittent-failure})

Trunk
x86
Windows 7
crash, intermittent-failure
Points:
---

Firefox Tracking Flags

(firefox43 affected)

Details

Comment hidden (empty)
Comment hidden (Treeherder Robot)
Looks like it's crashing while traversing the pending ion builder list in CancelOffThreadIonCompile() at the start of a compacting GC.

11:21:26 INFO - Crash reason: EXCEPTION_ACCESS_VIOLATION_READ
11:21:26 INFO - Crash address: 0x5a5a5a62
11:21:26 INFO - Thread 49 (crashed)
11:21:26 INFO - 0 xul.dll!js::CancelOffThreadIonCompile(JSCompartment *,JSScript *) [HelperThreads.cpp:a6eeb28458fd : 182 + 0x3]
11:21:26 INFO - eip = 0x62a14a94 esp = 0x170df790 ebp = 0x170df7b8 ebx = 0x195d23a0
11:21:26 INFO - esi = 0x5a5a5a5a edi = 0x18701130 eax = 0x00000000 ecx = 0x195d23a0
11:21:26 INFO - edx = 0x00000000 efl = 0x00010206
11:21:26 INFO - Found by: given as instruction pointer in context
11:21:26 INFO - 1 xul.dll!js::jit::StopAllOffThreadCompilations(JS::Zone *) [Ion.cpp:a6eeb28458fd : 2761 + 0x13]
11:21:26 INFO - eip = 0x62a148b7 esp = 0x170df7c0 ebp = 0x170df7d8
11:21:26 INFO - Found by: call frame info
11:21:26 INFO - 2 xul.dll!js::gc::GCRuntime::relocateArenas(JS::Zone *,JS::gcreason::Reason,js::gc::ArenaHeader * &,js::SliceBudget &) [jsgc.cpp:a6eeb28458fd : 2230 + 0x9]
11:21:26 INFO - eip = 0x628b742c esp = 0x170df7e0 ebp = 0x170df7f8
11:21:26 INFO - Found by: call frame info
11:21:26 INFO - 3 xul.dll!js::gc::GCRuntime::compactPhase(JS::gcreason::Reason,js::SliceBudget &) [jsgc.cpp:a6eeb28458fd : 5506 + 0x13]
11:21:26 INFO - eip = 0x628b4c83 esp = 0x170df800 ebp = 0x170df830
11:21:26 INFO - Found by: call frame info
11:21:26 INFO - 4 xul.dll!js::gc::GCRuntime::incrementalCollectSlice(js::SliceBudget &,JS::gcreason::Reason) [jsgc.cpp:a6eeb28458fd : 5944 + 0x8]
11:21:26 INFO - eip = 0x628b56e1 esp = 0x170df838 ebp = 0x170df858
11:21:26 INFO - Found by: call frame info
11:21:26 INFO - 5 xul.dll!js::gc::GCRuntime::gcCycle(bool,js::SliceBudget &,JS::gcreason::Reason) [jsgc.cpp:a6eeb28458fd : 6110 + 0xa]
11:21:26 INFO - eip = 0x628b52c4 esp = 0x170df860 ebp = 0x170df8ac
11:21:26 INFO - Found by: call frame info
11:21:26 INFO - 6 xul.dll!js::gc::GCRuntime::collect(bool,js::SliceBudget,JS::gcreason::Reason) [jsgc.cpp:a6eeb28458fd : 6239 + 0x15]
11:21:26 INFO - eip = 0x628b3df9 esp = 0x170df8b4 ebp = 0x170df930
11:21:26 INFO - Found by: call frame info
11:21:26 INFO - 7 xul.dll!js::gc::GCRuntime::gc(JSGCInvocationKind,JS::gcreason::Reason) [jsgc.cpp:a6eeb28458fd : 6300 + 0x21]
11:21:26 INFO - eip = 0x628b3c13 esp = 0x170df938 ebp = 0x170df990
11:21:26 INFO - Found by: call frame info
11:21:26 INFO - 8 xul.dll!mozilla::dom::workers::WorkerPrivate::GarbageCollectInternal(JSContext *,bool,bool) [WorkerPrivate.cpp:a6eeb28458fd : 6832 + 0x4]
11:21:26 INFO - eip = 0x629abbfa esp = 0x170df998 ebp = 0x170df9b4
11:21:26 INFO - Found by: call frame info
11:21:26 INFO - 9 xul.dll!`anonymous namespace'::GarbageCollectRunnable::WorkerRun(JSContext *,mozilla::dom::workers::WorkerPrivate *) [WorkerPrivate.cpp:a6eeb28458fd : 1905 + 0x14]
11:21:26 INFO - eip = 0x62da55ba esp = 0x170df9bc ebp = 0x170df9c8
11:21:26 INFO - Found by: call frame info
11:21:26 INFO - 10 xul.dll!mozilla::dom::workers::WorkerRunnable::Run() [WorkerRunnable.cpp:a6eeb28458fd : 359 + 0xd]
11:21:26 INFO - eip = 0x628bb828 esp = 0x170df9d0 ebp = 0x170dfad4
11:21:26 INFO - Found by: call frame info
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Subsequent crashes did not occur during compacting GC.  Usually seems to happen on workers.

We're crashing while cancelling lazy linking for pending builders.

Hannes, could this be related to the lazy linking changes in bug 1178834?
Flags: needinfo?(hv1989)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
(Reporter)

Updated

3 years ago
Duplicate of this bug: 1196977
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Depends on: 1178834
Flags: needinfo?(hv1989)
Blocks: 1178834
No longer depends on: 1178834
(Reporter)

Updated

3 years ago
Duplicate of this bug: 1198108
(Reporter)

Updated

3 years ago
Duplicate of this bug: 1198117
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Potentially fixed by bug 1198245. No reports since that landed, but keeping open, since there was a weekend in between, which means low volume...

Comment 28

2 years ago
Bulk assigning P3 to all open intermittent bugs without a priority set in Firefox components per bug 1298978.
Priority: -- → P3
(Reporter)

Comment 29

2 years ago
(In reply to Hannes Verschore [:h4writer] from comment #27)
> Potentially fixed by bug 1198245. No reports since that landed, but keeping
> open, since there was a weekend in between, which means low volume...

Let's go with that.
Status: NEW → RESOLVED
Last Resolved: 2 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.