Intermittent bug-1252329.js | Unknown (code -1073741819, args "--ion-eager --ion-offthread-compile=off")

RESOLVED FIXED in Firefox 48

Status

()

Core
JavaScript: GC
RESOLVED FIXED
2 years ago
2 years ago

People

(Reporter: philor, Assigned: jonco)

Tracking

({intermittent-failure})

Trunk
mozilla48
intermittent-failure
Points:
---

Firefox Tracking Flags

(firefox48 fixed)

Details

Attachments

(2 attachments, 1 obsolete attachment)

(Assignee)

Comment 1

2 years ago
Created attachment 8734363 [details] [diff] [review]
bug1215834-trace-shape-tables

It seems we don't currently trace ShapeTables.  This doesn't matter in most cases because if a shape is unreachable then any base shape that has a shape table containing it will be unreachable too.  

In this situation however a base shape is marked because it's part of a Rooted<StackShape> without any shapes in its shape table necessarily be marked.  Compacting GC then visits the shape table to fix it up and tries to access dead shapes.

It should probably have occurred to me when writing the fixup method that we really needed to trace this instead.
Assignee: nobody → jcoppeard
Attachment #8734363 - Flags: review?(terrence)
Comment on attachment 8734363 [details] [diff] [review]
bug1215834-trace-shape-tables

Review of attachment 8734363 [details] [diff] [review]:
-----------------------------------------------------------------

Yeah, that's always bothered me.
Attachment #8734363 - Flags: review?(terrence) → review+

Comment 3

2 years ago
13 automation job failures were associated with this bug in the last 7 days.

Repository breakdown:
* mozilla-inbound: 11
* fx-team: 2

Platform breakdown:
* windows8-64: 11
* osx-10-6: 2

For more details, see:
https://brasstacks.mozilla.com/orangefactor/?display=Bug&bugid=1259306&startday=2016-03-21&endday=2016-03-27&tree=all
(Assignee)

Comment 4

2 years ago
The patch here causes quite a few stack overflows on try.  It looks like this is because of the CC recursively tracing through BaseShapes.
(Assignee)

Comment 5

2 years ago
Created attachment 8735878 [details] [diff] [review]
bug1259306-trace-shape-tables

Update patch with correct bug number
Attachment #8734363 - Attachment is obsolete: true
Attachment #8735878 - Flags: review+
(Assignee)

Comment 6

2 years ago
Created attachment 8735879 [details] [diff] [review]
bug1259306-fix-cycle-collection

It turns out that when the cycle collector traces object groups we can get into long cycles tracing through shape tables.  As noted elsewhere, the cycle collector doesn't need to see any of these edges so we can just ignore base shapes in this case.

Try is looking much greener now.
Attachment #8735879 - Flags: review?(terrence)
Attachment #8735879 - Flags: review?(terrence) → review+
(Assignee)

Updated

2 years ago
Duplicate of this bug: 1260405
(Assignee)

Updated

2 years ago
Duplicate of this bug: 1260331
(Assignee)

Updated

2 years ago
Duplicate of this bug: 1260158

Comment 11

2 years ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/457e7d5b1136
Status: NEW → RESOLVED
Last Resolved: 2 years ago
status-firefox48: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla48

Comment 12

2 years ago
8 automation job failures were associated with this bug in the last 7 days.

Repository breakdown:
* mozilla-inbound: 7
* fx-team: 1

Platform breakdown:
* windows8-64: 8

For more details, see:
https://brasstacks.mozilla.com/orangefactor/?display=Bug&bugid=1259306&startday=2016-03-28&endday=2016-04-03&tree=all
Depends on: 1262203

Comment 13

2 years ago
5 automation job failures were associated with this bug in the last 7 days.

Repository breakdown:
* mozilla-inbound: 4
* fx-team: 1

Platform breakdown:
* windows8-64: 4
* windowsxp: 1

For more details, see:
https://brasstacks.mozilla.com/orangefactor/?display=Bug&bugid=1259306&startday=2016-06-06&endday=2016-06-12&tree=all
You need to log in before you can comment on or make changes to this bug.