Closed Bug 1220385 Opened 9 years ago Closed 7 years ago

crash in js::ConstraintTypeSet::sweep

Categories

(Core :: JavaScript: GC, defect)

Product:
Core
Component:
JavaScript: GC
Platform:
x86
All
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1112741
Tracking Flags:
Tracking Status
firefox45 --- wontfix
firefox46 --- affected
firefox47 --- affected
firefox48 --- affected
firefox49 + affected
firefox-esr45 --- affected
firefox50 --- affected
firefox51 --- affected
firefox52 --- affected
firefox53 --- affected

People

(Reporter: chiorean.ioana, Unassigned)

References

Details

(Keywords: crash, topcrash, topcrash-win) 

This bug was filed from the Socorro interface and is 
report bp-b8b9082b-7497-45c6-93b5-d78b42151031.
=============================================================
0 		@0x17db6ce40 	
1 	XUL 	js::ConstraintTypeSet::sweep(JS::Zone*, js::AutoClearTypeInferenceStateOnOOM&) 	js/src/vm/TypeInference.cpp
2 	XUL 	JSScript::maybeSweepTypes(js::AutoClearTypeInferenceStateOnOOM*) 	js/src/vm/TypeInference.cpp
3 	XUL 	js::gc::GCRuntime::sweepPhase(js::SliceBudget&) 	js/src/jsgc.cpp
4 	XUL 	js::gc::GCRuntime::incrementalCollectSlice(js::SliceBudget&, JS::gcreason::Reason) 	js/src/jsgc.cpp
5 	XUL 	js::gc::GCRuntime::gcCycle(bool, js::SliceBudget&, JS::gcreason::Reason) 	js/src/jsgc.cpp
6 	XUL 	js::gc::GCRuntime::collect(bool, js::SliceBudget, JS::gcreason::Reason) 	js/src/jsgc.cpp
7 	XUL 	js::gc::GCRuntime::notifyDidPaint() 	js/src/jsgc.cpp
8 	XUL 	nsXPConnect::NotifyDidPaint() 	js/xpconnect/src/nsXPConnect.cpp
9 	XUL 	nsRefreshDriver::Tick(long long, mozilla::TimeStamp) 	layout/base/nsRefreshDriver.cpp
10 	XUL 	mozilla::RefreshDriverTimer::Tick(long long, mozilla::TimeStamp) 	layout/base/nsRefreshDriver.cpp
11 	XUL 	nsRunnableMethodImpl<void (mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::*)(mozilla::TimeStamp), true, mozilla::TimeStamp>::Run 	xpcom/glue/nsThreadUtils.h
12 	XUL 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp
13 	XUL 	NS_ProcessPendingEvents(nsIThread*, unsigned int) 	xpcom/glue/nsThreadUtils.cpp
14 	XUL 	nsBaseAppShell::NativeEventCallback() 	widget/nsBaseAppShell.cpp
15 	XUL 	nsAppShell::ProcessGeckoEvents(void*) 	widget/cocoa/nsAppShell.mm
16 	CoreFoundation 	__CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ 	
17 	CoreFoundation 	__CFRunLoopDoSources0 	
18 	CoreFoundation 	__CFRunLoopRun 	
19 	CoreFoundation 	CFRunLoopRunSpecific 	
20 	HIToolbox 	RunCurrentEventLoopInMode 	
21 	HIToolbox 	ReceiveNextEventCommon 	
22 	HIToolbox 	_BlockUntilNextEventMatchingListInModeWithFilter 	
23 	AppKit 	_DPSNextEvent 	
24 	AppKit 	-[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] 	
25 	XUL 	-[GeckoNSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] 	widget/cocoa/nsAppShell.mm
26 	AppKit 	-[NSApplication run] 	
27 	XUL 	nsAppShell::Run() 	widget/cocoa/nsAppShell.mm
28 	XUL 	nsAppStartup::Run() 	toolkit/components/startup/nsAppStartup.cpp
29 	XUL 	XREMain::XRE_mainRun() 	toolkit/xre/nsAppRunner.cpp
30 	XUL 	XREMain::XRE_main(int, char**, nsXREAppData const*) 	toolkit/xre/nsAppRunner.cpp
31 	XUL 	XRE_main 	toolkit/xre/nsAppRunner.cpp
32 	firefox 	main 	browser/app/nsBrowserApp.cpp
33 	firefox 	start
Ioana, is this something you can reproduce?
Component: General → JavaScript: GC
Flags: needinfo?(chiorean.ioana)
Product: Firefox → Core
Also seen on Linux. Filing from Sumo: https://support.mozilla.org/en-US/questions/1115516
bp-bab24358-80d4-4b70-a7aa-bbec02160323

Sorry no STR. Noted as a random crash. Other signatures also seen.
Unfortunately - I am getting so so many crashes lately that if I did not add the steps then, I can't tell now. So sorry :(
Flags: needinfo?(chiorean.ioana)
See Also: → 1174997
(In reply to Ioana Chiorean from comment #4)
> Unfortunately - I am getting so so many crashes lately 

You do ineed
ad1acd36-1006-4c20-b012-399912160426	2016-04-26 18:47:36
303e5cb1-ab0d-4c03-abe2-4998a2160425	2016-04-25 19:56:16
f4b891a9-18ff-49e5-b9c0-8b3972160425	2016-04-25 19:52:57
c2de7658-4740-4c6d-8e91-519ee2160425	2016-04-25 19:50:55
23bd2b62-061d-49db-995f-2a4d12160424	2016-04-24 20:37:04
d04de37e-ff34-4047-8bbd-cef092160424	2016-04-24 20:32:29
910fe4a0-70d3-4d83-8088-5e8592160423	2016-04-23 07:37:41 

Have you considered the possibility that you have a hardware issue?
Well not really as I am getting them both on my Mac machine but also on my linux one.
Can you be more specific?
(In reply to Ioana Chiorean from comment #6)
> Well not really as I am getting them both on my Mac machine but also on my
> linux one.
I'm seeing only Mac crash reports. Are you able to create mozilla crash reports or backgraces for the linux crashes?

>> Have you considered the possibility that you have a hardware issue?
> Can you be more specific?

since you are also crashing linux, let's consider first potentially more likely causes. 
Do you have the same mail accounts defined to both Mac and linux?
Can you try an experiment of disabling half your addons on Mac, and the *other* half onlinux?
This is now #15 top crasher on Firefox 46.
Keywords: topcrash-win
Sorry - I missed to reply here. 
I am not encountering the crashes anymore. I am always using nightly so probably one of the updates fixed it.
Crash volume for signature 'js::ConstraintTypeSet::sweep':
 - nightly (version 51): 41 crashes from 2016-08-01.
 - aurora  (version 50): 138 crashes from 2016-08-01.
 - beta    (version 49): 1292 crashes from 2016-08-02.
 - release (version 48): 215 crashes from 2016-07-25.
 - esr     (version 45): 132 crashes from 2016-05-02.

Crash volume on the last weeks (Week N is from 08-22 to 08-28):
            W. N-1  W. N-2  W. N-3
 - nightly      11      13       8
 - aurora       40      55      23
 - beta        410     435     177
 - release      76      49      26
 - esr          10      22      15

Affected platforms: Windows, Mac OS X, Linux

Crash rank on the last 7 days:
           Browser   Content     Plugin
 - nightly #147      #56
 - aurora  #51       #33
 - beta    #36       #18
 - release #240
 - esr     #688
status-firefox48: --- → affected
status-firefox49: --- → affected
status-firefox50: --- → affected
status-firefox51: --- → affected
status-firefox-esr45: --- → affected
[Tracking Requested - why for this release]:
this signature starts noticeably increasing since 49.0b builds: 
https://crash-stats.mozilla.com/signature/?release_channel=beta&product=Firefox&date=%3E2016-04-01&signature=js%3A%3AConstraintTypeSet%3A%3Asweep#graphs
tracking-firefox49: --- → ?
Flags: needinfo?(continuation)
Flags: needinfo?(continuation) → needinfo?(terrence)
Track for 49+ as the volume of crashes is increasing.
tracking-firefox49: ? → +
This spiked in beta 8 but looks much better for beta 10. We can keep an eye on it but a fix for 49 is unlikely at this point as we are hoping to build RC2 today and release next week.
Naveed, this bug may need a new owner... Can you help find someone to work on it at least for the 50 timeframe? Thanks!
Flags: needinfo?(nihsanullah)
Jon please take a look. Thanks.
Assignee: nobody → jcoppeard
Flags: needinfo?(nihsanullah) → needinfo?(jcoppeard)
The crashes seem to be at a variety of addresses, including addresses containing the free poison pattern.

I'm going to work on bug 1294767 which will add assertions that may shed light on this.
Flags: needinfo?(terrence)
Flags: needinfo?(jcoppeard)
Blocks: 1174997, 1287306
Depends on: 1294767
See Also: 1174997 → 
Crash volume for signature 'js::ConstraintTypeSet::sweep':
 - nightly (version 52): 55 crashes from 2016-09-19.
 - aurora  (version 51): 19 crashes from 2016-09-19.
 - beta    (version 50): 663 crashes from 2016-09-20.
 - release (version 49): 5029 crashes from 2016-09-05.
 - esr     (version 45): 171 crashes from 2016-06-01.

Crash volume on the last weeks (Week N is from 10-03 to 10-09):
            W. N-1  W. N-2
 - nightly      21      34
 - aurora       16       3
 - beta        572      91
 - release    4002    1026
 - esr          10      14

Affected platforms: Windows, Mac OS X, Linux

Crash rank on the last 7 days:
           Browser   Content     Plugin
 - nightly #216      #68
 - aurora  #147      #111
 - beta    #23       #16
 - release #10       #5
 - esr     #788
status-firefox52: --- → affected
The volume of crashes for 49.0.1 is 10291 (it was 636 in 49.0).
Depends on: 1314299
Unassigning myself because I'm not actively working on this.

I added some assertions in bug 1314299 but they haven't shown up anything.

Jan, off the top of your head do you have any idea how we could track this down?
Assignee: jcoppeard → nobody
Flags: needinfo?(jdemooij)
Crash volume for signature 'js::ConstraintTypeSet::sweep':
 - nightly (version 53): 177 crashes from 2016-11-14.
 - aurora  (version 52): 113 crashes from 2016-11-14.
 - beta    (version 51): 6775 crashes from 2016-11-14.
 - release (version 50): 14894 crashes from 2016-11-01.
 - esr     (version 45): 587 crashes from 2016-07-06.

Crash volume on the last weeks (Week N is from 01-02 to 01-08):
            W. N-1  W. N-2  W. N-3  W. N-4  W. N-5  W. N-6  W. N-7
 - nightly      19      13      38      40      27      17      13
 - aurora       17      20      12      26      22      11       0
 - beta       1295    1415     998     452     675     851     681
 - release    1257    1329    1378    1420    3142    4295    1715
 - esr          11      19      15      34     101     111      72

Affected platforms: Windows, Mac OS X, Linux

Crash rank on the last 7 days:
           Browser   Content   Plugin
 - nightly #137      #42
 - aurora  #288      #75
 - beta    #14       #8
 - release #29       #17
 - esr     #411
status-firefox53: --- → affected
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → DUPLICATE
Crash Signature: [@ js::ConstraintTypeSet::sweep]
Depends on: 1332601
No longer blocks: 1287306
Flags: needinfo?(jdemooij)
You need to log in before you can comment on or make changes to this bug.