Closed
Bug 1259306
Opened 8 years ago
Closed 8 years ago
Intermittent bug-1252329.js | Unknown (code -1073741819, args "--ion-eager --ion-offthread-compile=off")
Categories
(Core :: JavaScript: GC, defect)
Core
JavaScript: GC
Tracking
()
RESOLVED
FIXED
mozilla48
Tracking | Status | |
---|---|---|
firefox48 | --- | fixed |
People
(Reporter: philor, Assigned: jonco)
References
Details
(Keywords: intermittent-failure)
Attachments
(2 files, 1 obsolete file)
3.39 KB,
patch
|
jonco
:
review+
|
Details | Diff | Splinter Review |
1.91 KB,
patch
|
terrence
:
review+
|
Details | Diff | Splinter Review |
Assignee | ||
Comment 1•8 years ago
|
||
It seems we don't currently trace ShapeTables. This doesn't matter in most cases because if a shape is unreachable then any base shape that has a shape table containing it will be unreachable too. In this situation however a base shape is marked because it's part of a Rooted<StackShape> without any shapes in its shape table necessarily be marked. Compacting GC then visits the shape table to fix it up and tries to access dead shapes. It should probably have occurred to me when writing the fixup method that we really needed to trace this instead.
Assignee: nobody → jcoppeard
Attachment #8734363 -
Flags: review?(terrence)
Comment 2•8 years ago
|
||
Comment on attachment 8734363 [details] [diff] [review] bug1215834-trace-shape-tables Review of attachment 8734363 [details] [diff] [review]: ----------------------------------------------------------------- Yeah, that's always bothered me.
Attachment #8734363 -
Flags: review?(terrence) → review+
Comment hidden (Intermittent Failures Robot) |
Assignee | ||
Comment 4•8 years ago
|
||
The patch here causes quite a few stack overflows on try. It looks like this is because of the CC recursively tracing through BaseShapes.
Assignee | ||
Comment 5•8 years ago
|
||
Update patch with correct bug number
Attachment #8734363 -
Attachment is obsolete: true
Attachment #8735878 -
Flags: review+
Assignee | ||
Comment 6•8 years ago
|
||
It turns out that when the cycle collector traces object groups we can get into long cycles tracing through shape tables. As noted elsewhere, the cycle collector doesn't need to see any of these edges so we can just ignore base shapes in this case. Try is looking much greener now.
Attachment #8735879 -
Flags: review?(terrence)
Updated•8 years ago
|
Attachment #8735879 -
Flags: review?(terrence) → review+
Comment 11•8 years ago
|
||
bugherder |
https://hg.mozilla.org/mozilla-central/rev/457e7d5b1136
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla48
Comment hidden (Intermittent Failures Robot) |
Comment hidden (Intermittent Failures Robot) |
You need to log in
before you can comment on or make changes to this bug.
Description
•