Crash in js::jit::JitProfilingFrameIterator::moveToNextFrame

RESOLVED WORKSFORME

Status

()

Core
JavaScript Engine: JIT
P1
critical
RESOLVED WORKSFORME
a year ago
9 months ago

People

(Reporter: Harald, Unassigned)

Tracking

(Depends on: 1 bug, {crash})

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(1 attachment)

(Reporter)

Description

a year ago
This bug was filed from the Socorro interface and is 
report bp-48a66f40-f9d0-4464-b64e-9d4d82170111.
Also 48a66f40-f9d0-4464-b64e-9d4d82170111
=============================================================

Happened several times on LinkedIn with Profiler enabled. Naveed could reproduce on his Mac Book as well.
Kannan, any ideas?
Flags: needinfo?(kvijayan)
Created attachment 8825649 [details] [diff] [review]
Diagnostic patch

JitProfilingFrameIterator::moveToNextFrame() is missing cases for JitFrame_IonStub, JitFrame_Exit, and JitFrame_Bailout.

It is surprising that we've gone this whole time without this breaking, if the missing cases are actually required...

Harald (or Naveed), could you try compiling with this patch and see which case it crashes on?
Flags: needinfo?(hkirschner)
(Reporter)

Comment 3

a year ago
I just tried reproducing it in Nightly without the patch and it doesn't happen anymore. Naveed, does it still reproduce for you?
Flags: needinfo?(hkirschner) → needinfo?(nihsanullah)
(Reporter)

Comment 6

a year ago
Maybe related (signature is not), but I was profiling using devtools profiler in LinkedIn and got https://crash-stats.mozilla.com/report/index/f45f0458-80f4-4d95-acbb-2b0a72170203
I'm seeing this on Windows 10 when watching videos on twitch.tv. I've just had it while trying to reparent a window containing a video (https://crash-stats.mozilla.com/report/index/83313024-b4d1-40a6-b092-027d12170216). I've also seen it with a static window with a video playing that simply crashed.

I've had periods of high crashability (every few minutes, renders streams unwatchable), but typically this happens every few days.
I currently can't use LinkedIn on Aurora because it crashes every few seconds due to this bug.

Gerv
(In reply to Sean Stangl [:sstangl] from comment #2)
> Created attachment 8825649 [details] [diff] [review]
> Diagnostic patch
> 
> JitProfilingFrameIterator::moveToNextFrame() is missing cases for
> JitFrame_IonStub, JitFrame_Exit, and JitFrame_Bailout.
> 
> It is surprising that we've gone this whole time without this breaking, if
> the missing cases are actually required...
> 
> Harald (or Naveed), could you try compiling with this patch and see which
> case it crashes on?

Can you create a try build with this patch. To make it easier to let others try if they hit it with this patch? We could potentially also land this?

(In reply to Gervase Markham [:gerv] from comment #8)
> I currently can't use LinkedIn on Aurora because it crashes every few
> seconds due to this bug.
> 
> Gerv

This is without the profiler enabled? If this is without the profiler this might be another bug. Can you post a crash report?
Flags: needinfo?(sstangl)
Priority: -- → P1
(In reply to Sean Stangl [:sstangl] from comment #2)
> JitProfilingFrameIterator::moveToNextFrame() is missing cases for
> JitFrame_IonStub, JitFrame_Exit, and JitFrame_Bailout.

I removed JitFrame_IonStub a few days ago but I think it has been dead since bug 1323099. It looks like we still have Nightly crashes after that.

Can you try to reproduce this?
Depends on: 1346335
I think I may be the current top crasher on this. Still seeing it in release, however I can't repro in beta. Looking at the other crash reports, I don't see anyone crashing with a  build ID later than 53. I can't reliably repro this, so it's hard to be sure.
Yes no crashes in 53+ with this signature, let's close this.
Status: NEW → RESOLVED
Last Resolved: 9 months ago
Flags: needinfo?(sstangl)
Flags: needinfo?(nihsanullah)
Flags: needinfo?(kvijayan)
Resolution: --- → WORKSFORME
(Reporter)

Updated

9 months ago
Crash Signature: [@ js::jit::JitProfilingFrameIterator::moveToNextFrame] → [@ mozilla::dom::PerformanceNavigationTiming::Type ]
(Reporter)

Comment 13

9 months ago
(pardon me, edited wrong bug)
Crash Signature: [@ mozilla::dom::PerformanceNavigationTiming::Type ] → [@ js::jit::JitProfilingFrameIterator::moveToNextFrame]
You need to log in before you can comment on or make changes to this bug.