Closed Bug 1337578 Opened 3 years ago Closed 3 years ago

Intermittent application crashed [@ js::GCMarker::eagerlyMarkChildren][@ js::GCMarker::eagerlyMarkChildren(JSLinearString*)][@ js::GCMarker::eagerlyMarkChildren(JSRope*)]

Categories

(Core :: JavaScript: GC, defect)

defect
Not set

Tracking

()

RESOLVED FIXED
mozilla55
Tracking Status
firefox52 --- unaffected
firefox-esr52 --- unaffected
firefox53 --- unaffected
firefox54 + fixed
firefox55 + fixed

People

(Reporter: intermittent-bug-filer, Assigned: jonco)

References

(Blocks 1 open bug, )

Details

(Keywords: intermittent-failure, regression, Whiteboard: [stockwell fixed])

Crash Data

Attachments

(1 file)

Looks like a crash in GC. I'm not sure who could evaluate this stack, Olly, could you please help finding the appropriate person? I've no idea if this is actionable.
Flags: needinfo?(bugs)
Flags: needinfo?(bugs) → needinfo?(jcoppeard)
See Also: → 1338702
Tests in which this is happening:

browser/base/content/test/urlbar/browser_urlbarRaceWithTabs.js
browser/base/content/test/general/browser_tab_dragdrop2.js
browser/components/search/test/browser_webapi.js
browser/components/extensions/test/browser/test-oop-extensions/browser_ext_tabs_detectLanguage.js
browser/components/customizableui/test/browser_885052_customize_mode_observers_disabed.js
browser/components/extensions/test/browser/browser_ext_tabs_cookieStoreId.js
browser/base/content/test/general/browser_tab_drag_drop_perwindow.js
browser_ext_tabs_duplicate.js
browser/base/content/test/general/browser_tabs_owner.js
browser/base/content/test/general/browser_temporary_permissions.js
browser/base/content/test/general/browser_trackingUI_4.js
browser/base/content/test/general/browser_tabs_isActive.js
browser/base/content/test/general/browser_testOpenNewRemoteTabsFromNonRemoteBrowsers.js

I'm going to try to dedupe these bugs so we collect failures in one place and can accurately assess how bad this is.
Component: Location Bar → JavaScript: GC
Product: Firefox → Core
Summary: Intermittent browser/base/content/test/urlbar/browser_urlbarSearchSingleWordNotification.js | application crashed [@ js::GCMarker::eagerlyMarkChildren] → Intermittent <random-browser-test>.js | application crashed [@ js::GCMarker::eagerlyMarkChildren][@ js::GCMarker::eagerlyMarkChildren(JSLinearString*)][@ js::GCMarker::eagerlyMarkChildren(JSLinearString*)]
There's a possible regressor in bug 1335582, so I guess I'll add that as see also and leave open
URL: 1335582
See Also: 1338702, 1344514
Duplicate of this bug: 1338688
Duplicate of this bug: 1340629
Duplicate of this bug: 1338702
Duplicate of this bug: 1344514
Duplicate of this bug: 1346455
Duplicate of this bug: 1349289
Duplicate of this bug: 1350249
Duplicate of this bug: 1351125
Duplicate of this bug: 1351127
Duplicate of this bug: 1351441
Duplicate of this bug: 1351458
Duplicate of this bug: 1351649
Summary: Intermittent <random-browser-test>.js | application crashed [@ js::GCMarker::eagerlyMarkChildren][@ js::GCMarker::eagerlyMarkChildren(JSLinearString*)][@ js::GCMarker::eagerlyMarkChildren(JSLinearString*)] → Intermittent <random-browser-test>.js | application crashed [@ js::GCMarker::eagerlyMarkChildren][@ js::GCMarker::eagerlyMarkChildren(JSLinearString*)][@ js::GCMarker::eagerlyMarkChildren(JSRope*)]
Duplicate of this bug: 1351969
Crash Signature: [@ js::GCMarker::eagerlyMarkChildren] [@ js::GCMarker::eagerlyMarkChildren(JSLinearString*)] [@ js::GCMarker::eagerlyMarkChildren(JSRope*)]
Summary: Intermittent <random-browser-test>.js | application crashed [@ js::GCMarker::eagerlyMarkChildren][@ js::GCMarker::eagerlyMarkChildren(JSLinearString*)][@ js::GCMarker::eagerlyMarkChildren(JSRope*)] → Intermittent application crashed [@ js::GCMarker::eagerlyMarkChildren][@ js::GCMarker::eagerlyMarkChildren(JSLinearString*)][@ js::GCMarker::eagerlyMarkChildren(JSRope*)]
this seems to have started up again on March 29th at a pretty high rate, doing some retriggers of win7-debug-bc-7 (although there are other patterns):
https://treeherder.mozilla.org/#/jobs?repo=mozilla-inbound&filter-searchStr=browser-chrome-7%20win%20debug&tochange=73779bff009253588da41b6e4a30b1d3b80b990d&fromchange=8b964027442044f5fe933e2fc92eb6704e706798&selectedJob=87278080
Whiteboard: [stockwell needswork]
odd, disabling a couple reftests caused this?  I suspect it is a build specific issue, although this leads me to more confusion than usefulness.

I see :jonco has been needinfo'd for 2 months now, this is something someone on his team would need to help out with.
Not sure if this is helpful, but just got six crashes here with this signature and the exact same crashing thread within 12 seconds of each other, which is one crash every two seconds.

https://crash-stats.mozilla.com/report/index/bp-4306d0a4-0361-409d-a62e-0171c2170323
https://crash-stats.mozilla.com/report/index/bp-f6798ba9-caa7-40da-8071-f16572170323
https://crash-stats.mozilla.com/report/index/bp-21eb016e-5123-4149-9913-809e02170323
https://crash-stats.mozilla.com/report/index/bp-9e0e0b04-0ca4-41bf-980f-3f51b2170323
https://crash-stats.mozilla.com/report/index/bp-9b10ecd0-1acd-4908-bfbd-b1b882170323
https://crash-stats.mozilla.com/report/index/bp-5df473a7-3854-4eff-90fc-d62f12170323

I am not sure what exactly I was doing at that time. Any way to figure out what I was doing at that day on that time?

This is not a new crash bug. Eagerly Mark Children has been crashing a lot in versions 49 for me, all iterations. It's one of the most common crashes. So this crash has been going on for at least since v. 49 and in the older bug reports, I believe they were saying that it started a lot earlier. They also thought it was unfixable because they could not figure out what was crashing it. Seems to be related to Rope crashes, GSRope and JSRope too.
Crash Signature: [@ js::GCMarker::eagerlyMarkChildren] [@ js::GCMarker::eagerlyMarkChildren(JSLinearString*)] [@ js::GCMarker::eagerlyMarkChildren(JSRope*)] → [@ js::GCMarker::eagerlyMarkChildren] [@ js::GCMarker::eagerlyMarkChildren(JSLinearString*)] [@ js::GCMarker::eagerlyMarkChildren(JSLinearString *)] [@ js::GCMarker::eagerlyMarkChildren(JSRope*)]
:jonco, can you comment on this bug with what you believe is going on and when we can expect a fix?
The crash-stats data for js::GCMarker::eagerlyMarkChildren goes back a long time and encompasses many different stacks.

However the intermittent test failures all come through JSFunction::trace when marking the function's atom.   That and the time this was reported suggest bug 1324002 may be implicated.
Flags: needinfo?(jcoppeard)
Some tests that seem to show up more than others. There are 11 of these crashes in the last week in e10s browser/base/content/test/general/browser_testOpenNewRemoteTabsFromNonRemoteBrowsers.js, for instance.
Patch to mark atoms when cloning functions.
Assignee: nobody → jcoppeard
Attachment #8857000 - Flags: review?(bhackett1024)
Duplicate of this bug: 1355515
Attachment #8857000 - Flags: review?(bhackett1024) → review+
Pushed by jcoppeard@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/38889a153f45
Mark atoms when cloning functions r=bhackett
[Tracking Requested - why for this release]: crash regression
https://hg.mozilla.org/mozilla-central/rev/38889a153f45
Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla55
Please request Aurora approval on this.
Flags: needinfo?(jcoppeard)
Comment on attachment 8857000 [details] [diff] [review]
bug1337578-mark-fun-atom

Approval Request Comment
[Feature/Bug causing the regression]: Bug 1324002.
[User impact if declined]: Possible crash.
[Is this code covered by automated tests?]: Yes.
[Has the fix been verified in Nightly?]: Yes.
[Needs manual test from QE? If yes, steps to reproduce]: No.
[List of other uplifts needed for the feature/fix]: None.
[Is the change risky?]: No.
[Why is the change risky/not risky?]: Simple change to mark atoms when they're assigned in functions.
[String changes made/needed]: None.
Flags: needinfo?(jcoppeard)
Attachment #8857000 - Flags: approval-mozilla-aurora?
Tracking 54/55+ for this issue.
Comment on attachment 8857000 [details] [diff] [review]
bug1337578-mark-fun-atom

Fix a crash. Aurora54+.
Attachment #8857000 - Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
Whiteboard: [stockwell needswork] → [stockwell fixed]
Last instance of this was on the 13th according to Orange Factor so it looks like the patch fixed all of these. Awesome!
You need to log in before you can comment on or make changes to this bug.