Closed
Bug 1338642
Opened 7 years ago
Closed 7 years ago
Crash in js::jit::BacktrackingAllocator::hasFixedUseOverlap
Categories
(Core :: JavaScript Engine: JIT, defect, P1)
Tracking
()
RESOLVED
FIXED
mozilla54
People
(Reporter: marcia, Assigned: bhackett1024)
References
Details
(Keywords: crash)
Crash Data
Attachments
(1 file, 1 obsolete file)
4.06 KB,
patch
|
sunfish
:
review+
jcristau
:
approval-mozilla-aurora+
jcristau
:
approval-mozilla-beta+
|
Details | Diff | Splinter Review |
This bug was filed from the Socorro interface and is report bp-b3f1115a-8645-49de-b52b-173772170206. ============================================================= Seen while looking at crash stats - first crashes on trunk started using 2017020503020: http://bit.ly/2l1SqHc This crash is present on 54, 53 and 52 betas.
This function was introduced in bug 1315596.
Blocks: 1315596
status-firefox51:
--- → unaffected
Flags: needinfo?(sunfish)
Flags: needinfo?(bhackett1024)
Updated•7 years ago
|
Priority: -- → P1
Assignee | ||
Comment 2•7 years ago
|
||
It's kind of strange that this is just starting to crash now, but it would be fine to backout bug 1315596. Bug 1325450 has since added a simpler and more robust way of fixing the same issue as bug 1315596, and the extra complexity of bug 1315596 probably isn't worth keeping anyways.
Assignee: nobody → bhackett1024
Flags: needinfo?(bhackett1024)
Attachment #8839124 -
Flags: review?(sunfish)
Assignee | ||
Comment 3•7 years ago
|
||
Sorry, I attached the wrong patch.
Attachment #8839124 -
Attachment is obsolete: true
Attachment #8839124 -
Flags: review?(sunfish)
Attachment #8839125 -
Flags: review?(sunfish)
Updated•7 years ago
|
Attachment #8839125 -
Flags: review?(sunfish) → review+
Pushed by bhackett@mozilla.com: https://hg.mozilla.org/integration/mozilla-inbound/rev/85e40ef81409 Backout bug 1315596 (Don't evict bundles which won't help with allocating the target bundle), r=sunfish.
Comment 5•7 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/85e40ef81409 Landed 6 hours after hitting inbound. Didn't get marked because it starts with 'backout'.
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla54
Comment 6•7 years ago
|
||
Please request uplift if you think this is safe to take on beta.
Assignee | ||
Comment 7•7 years ago
|
||
Comment on attachment 8839125 [details] [diff] [review] backout Approval Request Comment [Feature/Bug causing the regression]: bug 1315596 [User impact if declined]: potential crashes [Is this code covered by automated tests?]: yes [Has the fix been verified in Nightly?]: no [Is the change risky?]: no [Why is the change risky/not risky?]: backs out some changes
Attachment #8839125 -
Flags: approval-mozilla-beta?
Attachment #8839125 -
Flags: approval-mozilla-aurora?
Reporter | ||
Comment 8•7 years ago
|
||
Tracking this JIT crash for 52/53/54.
Comment 9•7 years ago
|
||
This uplift request really doesn't have much details, for a last minute uplift this is not exactly confidence inspiring. E.g. if this is covered by automated tests, how come they didn't catch this crash? And if we don't understand the steps causing the crash, how confident are we that this won't cause other issues (and why).
Flags: needinfo?(bhackett1024)
Assignee | ||
Comment 10•7 years ago
|
||
We don't know why this is crashing because we haven't been able to reproduce it. The crash is in code that was recently added, and this patch just backs out that code.
Flags: needinfo?(bhackett1024)
Comment 11•7 years ago
|
||
Comment on attachment 8839125 [details] [diff] [review] backout ok, let's try and fix this jit regression for 52 rc2
Attachment #8839125 -
Flags: approval-mozilla-beta?
Attachment #8839125 -
Flags: approval-mozilla-beta+
Attachment #8839125 -
Flags: approval-mozilla-aurora?
Attachment #8839125 -
Flags: approval-mozilla-aurora+
Comment 12•7 years ago
|
||
uplift |
https://hg.mozilla.org/releases/mozilla-aurora/rev/0b67d410dd2d
Comment 13•7 years ago
|
||
uplift |
https://hg.mozilla.org/releases/mozilla-beta/rev/5392976baadb https://hg.mozilla.org/releases/mozilla-esr52/rev/5392976baadb
status-firefox-esr52:
--- → fixed
Comment 14•7 years ago
|
||
uplift |
https://hg.mozilla.org/releases/mozilla-release/rev/5392976baadb
You need to log in
before you can comment on or make changes to this bug.
Description
•