1220385 - crash in js::ConstraintTypeSet::sweep

Status: RESOLVED DUPLICATE of bug 1112741

(Core :: JavaScript: GC, defect)

Description

[Ioana Chiorean]

This bug was filed from the Socorro interface and is 
report bp-b8b9082b-7497-45c6-93b5-d78b42151031.
=============================================================
0 		@0x17db6ce40 	
1 	XUL 	js::ConstraintTypeSet::sweep(JS::Zone*, js::AutoClearTypeInferenceStateOnOOM&) 	js/src/vm/TypeInference.cpp
2 	XUL 	JSScript::maybeSweepTypes(js::AutoClearTypeInferenceStateOnOOM*) 	js/src/vm/TypeInference.cpp
3 	XUL 	js::gc::GCRuntime::sweepPhase(js::SliceBudget&) 	js/src/jsgc.cpp
4 	XUL 	js::gc::GCRuntime::incrementalCollectSlice(js::SliceBudget&, JS::gcreason::Reason) 	js/src/jsgc.cpp
5 	XUL 	js::gc::GCRuntime::gcCycle(bool, js::SliceBudget&, JS::gcreason::Reason) 	js/src/jsgc.cpp
6 	XUL 	js::gc::GCRuntime::collect(bool, js::SliceBudget, JS::gcreason::Reason) 	js/src/jsgc.cpp
7 	XUL 	js::gc::GCRuntime::notifyDidPaint() 	js/src/jsgc.cpp
8 	XUL 	nsXPConnect::NotifyDidPaint() 	js/xpconnect/src/nsXPConnect.cpp
9 	XUL 	nsRefreshDriver::Tick(long long, mozilla::TimeStamp) 	layout/base/nsRefreshDriver.cpp
10 	XUL 	mozilla::RefreshDriverTimer::Tick(long long, mozilla::TimeStamp) 	layout/base/nsRefreshDriver.cpp
11 	XUL 	nsRunnableMethodImpl<void (mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::*)(mozilla::TimeStamp), true, mozilla::TimeStamp>::Run 	xpcom/glue/nsThreadUtils.h
12 	XUL 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp
13 	XUL 	NS_ProcessPendingEvents(nsIThread*, unsigned int) 	xpcom/glue/nsThreadUtils.cpp
14 	XUL 	nsBaseAppShell::NativeEventCallback() 	widget/nsBaseAppShell.cpp
15 	XUL 	nsAppShell::ProcessGeckoEvents(void*) 	widget/cocoa/nsAppShell.mm
16 	CoreFoundation 	__CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ 	
17 	CoreFoundation 	__CFRunLoopDoSources0 	
18 	CoreFoundation 	__CFRunLoopRun 	
19 	CoreFoundation 	CFRunLoopRunSpecific 	
20 	HIToolbox 	RunCurrentEventLoopInMode 	
21 	HIToolbox 	ReceiveNextEventCommon 	
22 	HIToolbox 	_BlockUntilNextEventMatchingListInModeWithFilter 	
23 	AppKit 	_DPSNextEvent 	
24 	AppKit 	-[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] 	
25 	XUL 	-[GeckoNSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] 	widget/cocoa/nsAppShell.mm
26 	AppKit 	-[NSApplication run] 	
27 	XUL 	nsAppShell::Run() 	widget/cocoa/nsAppShell.mm
28 	XUL 	nsAppStartup::Run() 	toolkit/components/startup/nsAppStartup.cpp
29 	XUL 	XREMain::XRE_mainRun() 	toolkit/xre/nsAppRunner.cpp
30 	XUL 	XREMain::XRE_main(int, char**, nsXREAppData const*) 	toolkit/xre/nsAppRunner.cpp
31 	XUL 	XRE_main 	toolkit/xre/nsAppRunner.cpp
32 	firefox 	main 	browser/app/nsBrowserApp.cpp
33 	firefox 	start

Comment 1

[Wayne Mery (:wsmwk)]

Ioana, is this something you can reproduce?

Comment 2

[John Hesling [:John99] (NeedInfo me)]

Also seen on Linux. Filing from Sumo: https://support.mozilla.org/en-US/questions/1115516
bp-bab24358-80d4-4b70-a7aa-bbec02160323

Sorry no STR. Noted as a random crash. Other signatures also seen.

Comment 3

[Calixte Denizet (:calixte)]

This crash affects mainly beta and spiked the 2016-04-22:
https://crash-stats.mozilla.com/signature/?date=%3E%3D2016-04-19T13%3A24%3A21.115917&date=%3C2016-04-26T13%3A24%3A21.115917&product=Firefox&release_channel=beta&signature=js%3A%3AConstraintTypeSet%3A%3Asweep#graphs

Comment 4

[Ioana Chiorean]

Unfortunately - I am getting so so many crashes lately that if I did not add the steps then, I can't tell now. So sorry :(

Comment 5

[Wayne Mery (:wsmwk)]

(In reply to Ioana Chiorean from comment #4)
> Unfortunately - I am getting so so many crashes lately 

You do ineed
ad1acd36-1006-4c20-b012-399912160426	2016-04-26 18:47:36
303e5cb1-ab0d-4c03-abe2-4998a2160425	2016-04-25 19:56:16
f4b891a9-18ff-49e5-b9c0-8b3972160425	2016-04-25 19:52:57
c2de7658-4740-4c6d-8e91-519ee2160425	2016-04-25 19:50:55
23bd2b62-061d-49db-995f-2a4d12160424	2016-04-24 20:37:04
d04de37e-ff34-4047-8bbd-cef092160424	2016-04-24 20:32:29
910fe4a0-70d3-4d83-8088-5e8592160423	2016-04-23 07:37:41 

Have you considered the possibility that you have a hardware issue?

Comment 6

[Ioana Chiorean]

Well not really as I am getting them both on my Mac machine but also on my linux one.
Can you be more specific?

Comment 7

[Wayne Mery (:wsmwk)]

(In reply to Ioana Chiorean from comment #6)
> Well not really as I am getting them both on my Mac machine but also on my
> linux one.
I'm seeing only Mac crash reports. Are you able to create mozilla crash reports or backgraces for the linux crashes?

>> Have you considered the possibility that you have a hardware issue?
> Can you be more specific?

since you are also crashing linux, let's consider first potentially more likely causes. 
Do you have the same mail accounts defined to both Mac and linux?
Can you try an experiment of disabling half your addons on Mac, and the *other* half onlinux?

Comment 8

[Marco Castelluccio [:marco]]

This is now #15 top crasher on Firefox 46.

Comment 9

[Ioana Chiorean]

Sorry - I missed to reply here. 
I am not encountering the crashes anymore. I am always using nightly so probably one of the updates fixed it.

Comment 10

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'js::ConstraintTypeSet::sweep':
 - nightly (version 51): 41 crashes from 2016-08-01.
 - aurora  (version 50): 138 crashes from 2016-08-01.
 - beta    (version 49): 1292 crashes from 2016-08-02.
 - release (version 48): 215 crashes from 2016-07-25.
 - esr     (version 45): 132 crashes from 2016-05-02.

Crash volume on the last weeks (Week N is from 08-22 to 08-28):
            W. N-1  W. N-2  W. N-3
 - nightly      11      13       8
 - aurora       40      55      23
 - beta        410     435     177
 - release      76      49      26
 - esr          10      22      15

Affected platforms: Windows, Mac OS X, Linux

Crash rank on the last 7 days:
           Browser   Content     Plugin
 - nightly #147      #56
 - aurora  #51       #33
 - beta    #36       #18
 - release #240
 - esr     #688

Comment 11

[[:philipp]]

[Tracking Requested - why for this release]:
this signature starts noticeably increasing since 49.0b builds: 
https://crash-stats.mozilla.com/signature/?release_channel=beta&product=Firefox&date=%3E2016-04-01&signature=js%3A%3AConstraintTypeSet%3A%3Asweep#graphs

Comment 12

[Gerry Chang [:gchang]]

Track for 49+ as the volume of crashes is increasing.

Comment 13

[Liz Henry (:lizzard Please n-i to RyanVM, jcristau, or pascal)]

This spiked in beta 8 but looks much better for beta 10. We can keep an eye on it but a fix for 49 is unlikely at this point as we are hoping to build RC2 today and release next week.

Comment 14

[Liz Henry (:lizzard Please n-i to RyanVM, jcristau, or pascal)]

Naveed, this bug may need a new owner... Can you help find someone to work on it at least for the 50 timeframe? Thanks!

Comment 15

[Naveed Ihsanullah [:naveed]]

Jon please take a look. Thanks.

Comment 16

[Jon Coppeard (:jonco)]

The crashes seem to be at a variety of addresses, including addresses containing the free poison pattern.

I'm going to work on bug 1294767 which will add assertions that may shed light on this.

Comment 17

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'js::ConstraintTypeSet::sweep':
 - nightly (version 52): 55 crashes from 2016-09-19.
 - aurora  (version 51): 19 crashes from 2016-09-19.
 - beta    (version 50): 663 crashes from 2016-09-20.
 - release (version 49): 5029 crashes from 2016-09-05.
 - esr     (version 45): 171 crashes from 2016-06-01.

Crash volume on the last weeks (Week N is from 10-03 to 10-09):
            W. N-1  W. N-2
 - nightly      21      34
 - aurora       16       3
 - beta        572      91
 - release    4002    1026
 - esr          10      14

Affected platforms: Windows, Mac OS X, Linux

Crash rank on the last 7 days:
           Browser   Content     Plugin
 - nightly #216      #68
 - aurora  #147      #111
 - beta    #23       #16
 - release #10       #5
 - esr     #788

Comment 18

[Calixte Denizet (:calixte)]

The volume of crashes for 49.0.1 is 10291 (it was 636 in 49.0).

Comment 19

[Jon Coppeard (:jonco)]

Unassigning myself because I'm not actively working on this.

I added some assertions in bug 1314299 but they haven't shown up anything.

Jan, off the top of your head do you have any idea how we could track this down?

Comment 20

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'js::ConstraintTypeSet::sweep':
 - nightly (version 53): 177 crashes from 2016-11-14.
 - aurora  (version 52): 113 crashes from 2016-11-14.
 - beta    (version 51): 6775 crashes from 2016-11-14.
 - release (version 50): 14894 crashes from 2016-11-01.
 - esr     (version 45): 587 crashes from 2016-07-06.

Crash volume on the last weeks (Week N is from 01-02 to 01-08):
            W. N-1  W. N-2  W. N-3  W. N-4  W. N-5  W. N-6  W. N-7
 - nightly      19      13      38      40      27      17      13
 - aurora       17      20      12      26      22      11       0
 - beta       1295    1415     998     452     675     851     681
 - release    1257    1329    1378    1420    3142    4295    1715
 - esr          11      19      15      34     101     111      72

Affected platforms: Windows, Mac OS X, Linux

Crash rank on the last 7 days:
           Browser   Content   Plugin
 - nightly #137      #42
 - aurora  #288      #75
 - beta    #14       #8
 - release #29       #17
 - esr     #411