Closed Bug 1338642 Opened 7 years ago Closed 7 years ago

Crash in js::jit::BacktrackingAllocator::hasFixedUseOverlap

Categories

(Core :: JavaScript Engine: JIT, defect, P1)

Unspecified
Windows 7
defect

Tracking

()

RESOLVED FIXED
mozilla54
Tracking Status
firefox51 --- unaffected
firefox52 + fixed
firefox-esr52 --- fixed
firefox53 + fixed
firefox54 + fixed

People

(Reporter: marcia, Assigned: bhackett1024)

References

Details

(Keywords: crash)

Crash Data

Attachments

(1 file, 1 obsolete file)

This bug was filed from the Socorro interface and is 
report bp-b3f1115a-8645-49de-b52b-173772170206.
=============================================================

Seen while looking at crash stats - first crashes on trunk started using 2017020503020: http://bit.ly/2l1SqHc

This crash is present on 54, 53 and 52 betas.
This function was introduced in bug 1315596.
Blocks: 1315596
Flags: needinfo?(sunfish)
Flags: needinfo?(bhackett1024)
Priority: -- → P1
Attached patch backout (obsolete) — Splinter Review
It's kind of strange that this is just starting to crash now, but it would be fine to backout bug 1315596.  Bug 1325450 has since added a simpler and more robust way of fixing the same issue as bug 1315596, and the extra complexity of bug 1315596 probably isn't worth keeping anyways.
Assignee: nobody → bhackett1024
Flags: needinfo?(bhackett1024)
Attachment #8839124 - Flags: review?(sunfish)
Attached patch backoutSplinter Review
Sorry, I attached the wrong patch.
Attachment #8839124 - Attachment is obsolete: true
Attachment #8839124 - Flags: review?(sunfish)
Attachment #8839125 - Flags: review?(sunfish)
Flags: needinfo?(sunfish)
Attachment #8839125 - Flags: review?(sunfish) → review+
Pushed by bhackett@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/85e40ef81409
Backout bug 1315596 (Don't evict bundles which won't help with allocating the target bundle), r=sunfish.
https://hg.mozilla.org/mozilla-central/rev/85e40ef81409
Landed 6 hours after hitting inbound. Didn't get marked because it starts with 'backout'.
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla54
Please request uplift if you think this is safe to take on beta.
Comment on attachment 8839125 [details] [diff] [review]
backout

Approval Request Comment
[Feature/Bug causing the regression]: bug 1315596
[User impact if declined]: potential crashes
[Is this code covered by automated tests?]: yes
[Has the fix been verified in Nightly?]: no
[Is the change risky?]: no
[Why is the change risky/not risky?]: backs out some changes
Attachment #8839125 - Flags: approval-mozilla-beta?
Attachment #8839125 - Flags: approval-mozilla-aurora?
Tracking this JIT crash for 52/53/54.
This uplift request really doesn't have much details, for a last minute uplift this is not exactly confidence inspiring.
E.g. if this is covered by automated tests, how come they didn't catch this crash?  And if we don't understand the steps causing the crash, how confident are we that this won't cause other issues (and why).
Flags: needinfo?(bhackett1024)
We don't know why this is crashing because we haven't been able to reproduce it.  The crash is in code that was recently added, and this patch just backs out that code.
Flags: needinfo?(bhackett1024)
Comment on attachment 8839125 [details] [diff] [review]
backout

ok, let's try and fix this jit regression for 52 rc2
Attachment #8839125 - Flags: approval-mozilla-beta?
Attachment #8839125 - Flags: approval-mozilla-beta+
Attachment #8839125 - Flags: approval-mozilla-aurora?
Attachment #8839125 - Flags: approval-mozilla-aurora+
You need to log in before you can comment on or make changes to this bug.