1290469 - Crash in OOM | unknown | js::AutoEnterOOMUnsafeRegion::crash | js::detail::HashTable<T>::prepareHash | js::SavedStacks::getOrCreateSavedFrame

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Marcia Knous [:marcia]]

This bug was filed from the Socorro interface and is 
report bp-0bb416de-6370-4968-a9a7-a5adf2160729.
=============================================================

Crash showing up in RC2 Beta: http://bit.ly/2am0xZO

It was present in very small numbers in one previous beta, and seems to have risen in early crash data for RC2. Largest percentage of crashes are on Windows 7.

Comment 1

[Marcia Knous [:marcia]]

Fairly high correlation to Kaspersky Light Plugin:

OOM | unknown | js::AutoEnterOOMUnsafeRegion::crash | js::detail::HashTable<T>::prepareHash | js::SavedStacks::getOrCreateSavedFrame|EXCEPTION_BREAKPOINT (17 crashes)
     59% (10/17) vs.   2% (229/12243) [e-mail] (4.6.3-7)
     18% (3/17) vs.   2% (286/12243) [e-mail]
          0% (0/17) vs.   0% (1/12243) 4.6.0.375
         18% (3/17) vs.   2% (268/12243) 4.6.2-40
          0% (0/17) vs.   0% (5/12243) 4.6.2.21
          0% (0/17) vs.   0% (1/12243) 4.6.2.23.1
          0% (0/17) vs.   0% (11/12243) 4.6.2.31

Comment 2

[Jon Coppeard (:jonco)]

Attachment: bug1290469-fallible-saved-frame-hasher

We can make this fallible in the same way as was done for all the bare instances of MovableCellHasher.

Comment 3

[Terrence Cole [:terrence]]

Comment on attachment 8776033 [details] [diff] [review]
bug1290469-fallible-saved-frame-hasher

Review of attachment 8776033 [details] [diff] [review]:
-----------------------------------------------------------------

Nice!

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'OOM | unknown | js::AutoEnterOOMUnsafeRegion::crash | js::detail::HashTable<T>::prepareHash | js::SavedStacks::getOrCreateSavedFrame':
 - nightly(version 50):0 crashes from 2016-06-06.
 - aurora (version 49):0 crashes from 2016-06-07.
 - beta   (version 48):399 crashes from 2016-06-06.
 - release(version 47):594 crashes from 2016-05-31.
 - esr    (version 45):0 crashes from 2016-04-07.

Crash volume on the last weeks:
            W. N-1  W. N-2  W. N-3  W. N-4  W. N-5  W. N-6  W. N-7
 - nightly       0       0       0       0       0       0       0
 - aurora        0       0       0       0       0       0       0
 - beta        303      37      37       0       0       0       0
 - release      88      77      83      65      81      93      77
 - esr           0       0       0       0       0       0       0

Affected platform: Windows

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/63293464e2a2
Use fallible hashing for SavedFrame r=terrence

Comment 6

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/63293464e2a2

Comment 7

[Marco Castelluccio [:marco]]

#20 top crasher on Firefox 48. Also affects many users with AdBlock Plus (~50% of crashes with this signature have AdBlock Plus installed vs ~20% overall).

Should we consider uplifting?

Comment 8

[Marco Castelluccio [:marco]]

Also affects 49 and 50, but changed signature.

Comment 9

[Terrence Cole [:terrence]]

We already lifted the infrastructure, so I think it should be doable. Jon, what do you think?

Comment 10

[Sylvestre Ledru [:Sylvestre]]

We could take it as a ride along in 48 it is super safe

Comment 11

[Jon Coppeard (:jonco)]

Comment on attachment 8776033 [details] [diff] [review]
bug1290469-fallible-saved-frame-hasher

Approval Request Comment
[Feature/regressing bug #]: Bug 1224044.
[User impact if declined]: Possible crash on OOM.
[Describe test coverage new/current, TreeHerder]: On m-c since 1st August.
[Risks and why]: Low.
[String/UUID change made/needed]: None.

Comment 12

[Sylvestre Ledru [:Sylvestre]]

Comment on attachment 8776033 [details] [diff] [review]
bug1290469-fallible-saved-frame-hasher

Fix a top crash, let's take it on aurora & beta.

Comment 13

[Jon Coppeard (:jonco)]

https://hg.mozilla.org/releases/mozilla-aurora/rev/33ac1652a6f6dc6d524d2396219e59a1e7239df2
https://hg.mozilla.org/releases/mozilla-beta/rev/971a19e5b78efd339687430321f42e1aa81b8062

Comment 14

[Jon Coppeard (:jonco)]

Comment on attachment 8776033 [details] [diff] [review]
bug1290469-fallible-saved-frame-hasher

Approval Request Comment
[Feature/regressing bug #]: Bug 1224044.
[User impact if declined]: Possible crash on OOM
[Describe test coverage new/current, TreeHerder]: On m-c since 1st August.
[Risks and why]: Low.
[String/UUID change made/needed]: None.

Comment 15

[Sylvestre Ledru [:Sylvestre]]

Comment on attachment 8776033 [details] [diff] [review]
bug1290469-fallible-saved-frame-hasher

Taking it as it is a top crash, hopefully won't cause a regression.

Comment 16

[Mark Banner (:standard8)]

https://hg.mozilla.org/releases/mozilla-release/rev/a86f28044dd4

Comment 17

[Gerry Chang [:gchang]]

Added in the 48.0.1 release notes: "Fix a top crash in the JavaScript engine".