Closed
Bug 1284388
Opened 8 years ago
Closed 5 years ago
Crash in js::gc::MovingTracer::onShapeEdge
Categories
(Core :: JavaScript: GC, defect, P3)
Core
JavaScript: GC
Tracking
()
People
(Reporter: ting, Unassigned)
References
(Blocks 1 open bug)
Details
(Keywords: crash, triage-deferred)
Crash Data
Attachments
(1 file)
4.26 KB,
patch
|
terrence
:
review+
|
Details | Diff | Splinter Review |
This bug was filed from the Socorro interface and is report bp-75bebb99-2b18-49be-a38a-7d2ef2160629. ============================================================= #11 of 20160703 linux nightly. I found this happens on all platforms, and there are about a dozen crashes per day.
Reporter | ||
Comment 1•8 years ago
|
||
The number of crashes per day went to a dozen from 06-10 [1], do you know what could cause it? [1] https://crash-stats.mozilla.com/signature/?date=%3E%3D2016-01-01&product=Firefox&signature=js%3A%3Agc%3A%3AMovingTracer%3A%3AonShapeEdge&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=platform&_columns=reason&_columns=address&page=1#graphs
Flags: needinfo?(jcoppeard)
Comment 2•8 years ago
|
||
Not a fix, but this patch adds a debug assertion that it is safe to skip marking a base shape's shape table as we are doing. This should also show us if there is any corruption of the shape table happening.
Assignee: nobody → jcoppeard
Flags: needinfo?(jcoppeard)
Attachment #8768730 -
Flags: review?(terrence)
Updated•8 years ago
|
Attachment #8768730 -
Flags: review?(terrence) → review+
Updated•8 years ago
|
Keywords: leave-open
Pushed by jcoppeard@mozilla.com: https://hg.mozilla.org/integration/mozilla-inbound/rev/78c59d3a3795 Check shape table consistency in debug builds r=terrence
Comment 4•8 years ago
|
||
bugherder |
https://hg.mozilla.org/mozilla-central/rev/78c59d3a3795
Comment 5•8 years ago
|
||
Crash volume for signature 'js::gc::MovingTracer::onShapeEdge': - nightly (version 50): 30 crashes from 2016-06-06. - aurora (version 49): 20 crashes from 2016-06-07. - beta (version 48): 637 crashes from 2016-06-06. - release (version 47): 0 crash from 2016-05-31. - esr (version 45): 0 crash from 2016-04-07. Crash volume on the last weeks: Week N-1 Week N-2 Week N-3 Week N-4 Week N-5 Week N-6 Week N-7 - nightly 1 8 5 2 9 2 1 - aurora 4 4 1 4 2 1 1 - beta 115 84 90 105 94 84 31 - release 0 0 0 0 0 0 0 - esr 0 0 0 0 0 0 0 Affected platforms: Windows, Mac OS X, Linux
status-firefox48:
--- → affected
status-firefox49:
--- → affected
Comment 6•8 years ago
|
||
Crash volume for signature 'js::gc::MovingTracer::onShapeEdge': - nightly (version 51): 9 crashes from 2016-08-01. - aurora (version 50): 14 crashes from 2016-08-01. - beta (version 49): 238 crashes from 2016-08-02. - release (version 48): 248 crashes from 2016-07-25. - esr (version 45): 0 crashes from 2016-05-02. Crash volume on the last weeks (Week N is from 08-22 to 08-28): W. N-1 W. N-2 W. N-3 - nightly 4 4 1 - aurora 6 5 0 - beta 106 63 23 - release 81 68 51 - esr 0 0 0 Affected platforms: Windows, Mac OS X, Linux Crash rank on the last 7 days: Browser Content Plugin - nightly #154 - aurora #593 #155 - beta #230 #122 - release #290 - esr
status-firefox51:
--- → affected
Comment 7•8 years ago
|
||
Crash volume for signature 'js::gc::MovingTracer::onShapeEdge': - nightly (version 52): 4 crashes from 2016-09-19. - aurora (version 51): 3 crashes from 2016-09-19. - beta (version 50): 69 crashes from 2016-09-20. - release (version 49): 271 crashes from 2016-09-05. - esr (version 45): 0 crashes from 2016-06-01. Crash volume on the last weeks (Week N is from 10-03 to 10-09): W. N-1 W. N-2 - nightly 3 1 - aurora 2 1 - beta 62 7 - release 222 49 - esr 0 0 Affected platforms: Windows, Mac OS X, Linux Crash rank on the last 7 days: Browser Content Plugin - nightly #997 #368 - aurora #471 - beta #303 #247 - release #293 #235 - esr
status-firefox52:
--- → affected
Comment 8•7 years ago
|
||
Too late for firefox 52, mass-wontfix.
Updated•7 years ago
|
Keywords: triage-deferred
Priority: -- → P3
Comment 9•7 years ago
|
||
Jon, the bug lays around for a while now. I wonder if the debug assertion helps a bit here to investigate the issue? The crash rate doesn't seem to be that high anymore. In the last 6 months we got about 750 reports: https://crash-stats.mozilla.com/signature/?signature=js%3A%3Agc%3A%3AMovingTracer%3A%3AonShapeEdge&date=%3E%3D2017-04-18T08%3A29%3A38.000Z&date=%3C2017-10-18T08%3A29%3A38.000Z&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=platform&_columns=reason&_columns=address&_columns=install_time&_sort=-date&page=1#reports
Updated•7 years ago
|
Flags: needinfo?(jcoppeard)
Comment 10•7 years ago
|
||
No that assertion didn't catch anything.
Blocks: GCCrashes
Flags: needinfo?(jcoppeard)
Comment 11•6 years ago
|
||
The leave-open keyword is there and there is no activity for 6 months. :jonco, maybe it's time to close this bug?
Flags: needinfo?(jcoppeard)
Comment 12•6 years ago
|
||
This is another ongoing crash tracing the heap. Marking as stalled.
Flags: needinfo?(jcoppeard)
Keywords: stalled
Comment 13•5 years ago
|
||
The leave-open keyword is there and there is no activity for 6 months.
:jonco, maybe it's time to close this bug?
Flags: needinfo?(jcoppeard)
Comment 14•5 years ago
|
||
There's only a handful of crashes under this signature now. Closing.
Assignee: jcoppeard → nobody
Status: NEW → RESOLVED
Closed: 5 years ago
Flags: needinfo?(jcoppeard)
Resolution: --- → WORKSFORME
Updated•5 years ago
|
Keywords: leave-open
You need to log in
before you can comment on or make changes to this bug.
Description
•