1275199 - Crashes when running mochitest with GCC 6.1 build

Status: RESOLVED DUPLICATE of bug 1245783

(Core :: JavaScript Engine: JIT, defect)

Description

[Xidorn Quan [:xidorn] UTC+10]

After applying patches from bug 1269171, I successfully build firefox with GCC 6.1.1 on Arch Linux. But I cannot run mochitest normally.

The test usually stops very quick with
> IOError: Connection to Marionette server is lost. Check gecko.log (desktop firefox) or logcat (b2g) for errors.
> 0 ERROR Automation Error: Received unexpected exception while running application

And if e10s is not disabled, also:
> #01: mozilla::ipc::ProcessLink::OnChannelError() (/data/mozilla/central/ipc/glue/MessageLink.cpp:404)
> #02: event_process_active_single_queue (/data/mozilla/central/ipc/chromium/src/third_party/libevent/event.c:1355)
> #03: base::MessagePumpLibevent::Run(base::MessagePump::Delegate*) (/data/mozilla/central/ipc/chromium/src/base/message_pump_libevent.cc:372)
> #04: MessageLoop::RunInternal() (/data/mozilla/central/ipc/chromium/src/base/message_loop.cc:236)
> #05: MessageLoop::AutoRunState::~AutoRunState() (/data/mozilla/central/ipc/chromium/src/base/message_loop.cc:493)
> #06: base::Thread::ThreadMain() (/data/mozilla/central/ipc/chromium/src/base/thread.cc:183)
> #07: ThreadFunc(void*) (/data/mozilla/central/ipc/chromium/src/base/platform_thread_posix.cc:40)
> #08: start_thread (pthread_create.c:?)
> #09: __clone (/usr/lib/libc.so.6)
> #10: ??? (???:???)
> [Child 5454] ###!!! ABORT: Aborting on channel error.: file /data/mozilla/central/ipc/glue/MessageChannel.cpp, line 2050
> Hit MOZ_CRASH() at /data/mozilla/central/memory/mozalloc/mozalloc_abort.cpp:33

And when I specify --debugger=gdb, I see the following backtrace when it crashes:
> Thread 1 "firefox" received signal SIGSEGV, Segmentation fault.
> 0x00007fffc493d9ff in ?? ()
> (gdb) bt
> #0  0x00007fffc493d9ff in ?? ()
> #1  0x00007fffe94628cf in js::jit::SnapshotIterator::numAllocations (this=0x7fffffffa9f0) at /data/mozilla/central/js/src/jit/JitFrames.cpp:2022
> #2  js::jit::IonFrameStackDepthOp::IonFrameStackDepthOp (frame=..., this=<optimized out>) at /data/mozilla/central/js/src/jit/JitFrames.cpp:358
> #3  js::jit::TryNoteIterIon::TryNoteIterIon (frame=..., cx=0x7fffe3587400, this=0x7fffffffa970) at /data/mozilla/central/js/src/jit/JitFrames.cpp:369
> #4  js::jit::HandleExceptionIon (overrecursed=0x7fffffffa8df, rfe=0x7fffffffae78, frame=..., cx=0x7fffe3587400) at /data/mozilla/central/js/src/jit/JitFrames.cpp:416
> #5  js::jit::HandleException (rfe=<optimized out>) at /data/mozilla/central/js/src/jit/JitFrames.cpp:791
> #6  0x00007ffff7e9363d in ?? ()
> #7  0x0000000000000008 in ?? ()
> #8  0x00007fffffffae78 in ?? ()
> #9  0x0000000000000000 in ?? ()

And this is why I set the component to JavaScriptEngine: JIT here.

I can stably reproduce this with |./mach mochitest dom/tests/mochitest/pointerlock/|, either with or without e10s. |./mach mochitest| sometimes runs fine for a long time, sometimes crashes immediately.

I'm using an install of Arch Linux inside VMware Workstation 11.1.3 build-3206955. My compiler is GCC 6.1.1 20160501.

Comment 1

[Jan de Mooij [:jandem]]

It should work with these 2 patches (one bug is still on inbound after 2-3 days):

https://bugzilla.mozilla.org/show_bug.cgi?id=1245783#c36

Can you confirm that fixes it?

Comment 2

[Xidorn Quan [:xidorn] UTC+10]

Yes, that fixes it. Thanks!