1284388 - Crash in js::gc::MovingTracer::onShapeEdge

Status: RESOLVED WORKSFORME

(Core :: JavaScript: GC, defect, P3)

Description

[Ting-Yu Chou [:ting] (away)]

This bug was filed from the Socorro interface and is 
report bp-75bebb99-2b18-49be-a38a-7d2ef2160629.
=============================================================

#11 of 20160703 linux nightly.

I found this happens on all platforms, and there are about a dozen crashes per day.

Comment 1

[Ting-Yu Chou [:ting] (away)]

The number of crashes per day went to a dozen from 06-10 [1], do you know what could cause it?

[1] https://crash-stats.mozilla.com/signature/?date=%3E%3D2016-01-01&product=Firefox&signature=js%3A%3Agc%3A%3AMovingTracer%3A%3AonShapeEdge&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=platform&_columns=reason&_columns=address&page=1#graphs

Comment 2

[Jon Coppeard (:jonco)]

Attachment: bug1284388-debug-checks

Not a fix, but this patch adds a debug assertion that it is safe to skip marking a base shape's shape table as we are doing.  This should also show us if there is any corruption of the shape table happening.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/78c59d3a3795
Check shape table consistency in debug builds r=terrence

Comment 4

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/78c59d3a3795

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'js::gc::MovingTracer::onShapeEdge':
 - nightly (version 50): 30 crashes from 2016-06-06.
 - aurora  (version 49): 20 crashes from 2016-06-07.
 - beta    (version 48): 637 crashes from 2016-06-06.
 - release (version 47): 0 crash from 2016-05-31.
 - esr     (version 45): 0 crash from 2016-04-07.

Crash volume on the last weeks:
             Week N-1   Week N-2   Week N-3   Week N-4   Week N-5   Week N-6   Week N-7
 - nightly          1          8          5          2          9          2          1
 - aurora           4          4          1          4          2          1          1
 - beta           115         84         90        105         94         84         31
 - release          0          0          0          0          0          0          0
 - esr              0          0          0          0          0          0          0

Affected platforms: Windows, Mac OS X, Linux

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'js::gc::MovingTracer::onShapeEdge':
 - nightly (version 51): 9 crashes from 2016-08-01.
 - aurora  (version 50): 14 crashes from 2016-08-01.
 - beta    (version 49): 238 crashes from 2016-08-02.
 - release (version 48): 248 crashes from 2016-07-25.
 - esr     (version 45): 0 crashes from 2016-05-02.

Crash volume on the last weeks (Week N is from 08-22 to 08-28):
            W. N-1  W. N-2  W. N-3
 - nightly       4       4       1
 - aurora        6       5       0
 - beta        106      63      23
 - release      81      68      51
 - esr           0       0       0

Affected platforms: Windows, Mac OS X, Linux

Crash rank on the last 7 days:
           Browser   Content     Plugin
 - nightly           #154
 - aurora  #593      #155
 - beta    #230      #122
 - release #290
 - esr

Comment 7

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'js::gc::MovingTracer::onShapeEdge':
 - nightly (version 52): 4 crashes from 2016-09-19.
 - aurora  (version 51): 3 crashes from 2016-09-19.
 - beta    (version 50): 69 crashes from 2016-09-20.
 - release (version 49): 271 crashes from 2016-09-05.
 - esr     (version 45): 0 crashes from 2016-06-01.

Crash volume on the last weeks (Week N is from 10-03 to 10-09):
            W. N-1  W. N-2
 - nightly       3       1
 - aurora        2       1
 - beta         62       7
 - release     222      49
 - esr           0       0

Affected platforms: Windows, Mac OS X, Linux

Crash rank on the last 7 days:
           Browser   Content     Plugin
 - nightly #997      #368
 - aurora            #471
 - beta    #303      #247
 - release #293      #235
 - esr

Comment 8

[Julien Cristau [:jcristau] (back August 18)]

Too late for firefox 52, mass-wontfix.

Comment 9

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Jon, the bug lays around for a while now. I wonder if the debug assertion helps a bit here to investigate the issue? 

The crash rate doesn't seem to be that high anymore. In the last 6 months we got about 750 reports:

https://crash-stats.mozilla.com/signature/?signature=js%3A%3Agc%3A%3AMovingTracer%3A%3AonShapeEdge&date=%3E%3D2017-04-18T08%3A29%3A38.000Z&date=%3C2017-10-18T08%3A29%3A38.000Z&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=platform&_columns=reason&_columns=address&_columns=install_time&_sort=-date&page=1#reports

Comment 10

[Jon Coppeard (:jonco)]

No that assertion didn't catch anything.

Comment 11

[BugBot [:suhaib / :marco/ :calixte]]

The leave-open keyword is there and there is no activity for 6 months.
:jonco, maybe it's time to close this bug?

Comment 12

[Jon Coppeard (:jonco)]

This is another ongoing crash tracing the heap.  Marking as stalled.

Comment 13

[BugBot [:suhaib / :marco/ :calixte]]

The leave-open keyword is there and there is no activity for 6 months.
:jonco, maybe it's time to close this bug?

Comment 14

[Jon Coppeard (:jonco)]

There's only a handful of crashes under this signature now. Closing.