bugzilla.mozilla.org will be intermittently unavailable on Saturday, March 24th, from 16:00 until 20:00 UTC.

Crash in js::jit::BacktrackingAllocator::hasFixedUseOverlap

RESOLVED FIXED in Firefox 52



JavaScript Engine: JIT
a year ago
a year ago


(Reporter: marcia, Assigned: bhackett)


(Blocks: 1 bug, {crash})

Windows 7

Firefox Tracking Flags

(firefox51 unaffected, firefox52+ fixed, firefox-esr52 fixed, firefox53+ fixed, firefox54+ fixed)


(crash signature)


(1 attachment, 1 obsolete attachment)

This bug was filed from the Socorro interface and is 
report bp-b3f1115a-8645-49de-b52b-173772170206.

Seen while looking at crash stats - first crashes on trunk started using 2017020503020: http://bit.ly/2l1SqHc

This crash is present on 54, 53 and 52 betas.
This function was introduced in bug 1315596.
Blocks: 1315596
status-firefox51: --- → unaffected
Flags: needinfo?(sunfish)
Flags: needinfo?(bhackett1024)
Priority: -- → P1

Comment 2

a year ago
Created attachment 8839124 [details] [diff] [review]

It's kind of strange that this is just starting to crash now, but it would be fine to backout bug 1315596.  Bug 1325450 has since added a simpler and more robust way of fixing the same issue as bug 1315596, and the extra complexity of bug 1315596 probably isn't worth keeping anyways.
Assignee: nobody → bhackett1024
Flags: needinfo?(bhackett1024)
Attachment #8839124 - Flags: review?(sunfish)

Comment 3

a year ago
Created attachment 8839125 [details] [diff] [review]

Sorry, I attached the wrong patch.
Attachment #8839124 - Attachment is obsolete: true
Attachment #8839124 - Flags: review?(sunfish)
Attachment #8839125 - Flags: review?(sunfish)
Flags: needinfo?(sunfish)
Attachment #8839125 - Flags: review?(sunfish) → review+

Comment 4

a year ago
Pushed by bhackett@mozilla.com:
Backout bug 1315596 (Don't evict bundles which won't help with allocating the target bundle), r=sunfish.

Comment 5

a year ago
Landed 6 hours after hitting inbound. Didn't get marked because it starts with 'backout'.
Last Resolved: a year ago
status-firefox54: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla54
Please request uplift if you think this is safe to take on beta.
tracking-firefox52: --- → ?
tracking-firefox53: --- → ?
tracking-firefox54: --- → ?

Comment 7

a year ago
Comment on attachment 8839125 [details] [diff] [review]

Approval Request Comment
[Feature/Bug causing the regression]: bug 1315596
[User impact if declined]: potential crashes
[Is this code covered by automated tests?]: yes
[Has the fix been verified in Nightly?]: no
[Is the change risky?]: no
[Why is the change risky/not risky?]: backs out some changes
Attachment #8839125 - Flags: approval-mozilla-beta?
Attachment #8839125 - Flags: approval-mozilla-aurora?
Tracking this JIT crash for 52/53/54.
tracking-firefox52: ? → +
tracking-firefox53: ? → +
tracking-firefox54: ? → +
This uplift request really doesn't have much details, for a last minute uplift this is not exactly confidence inspiring.
E.g. if this is covered by automated tests, how come they didn't catch this crash?  And if we don't understand the steps causing the crash, how confident are we that this won't cause other issues (and why).
Flags: needinfo?(bhackett1024)

Comment 10

a year ago
We don't know why this is crashing because we haven't been able to reproduce it.  The crash is in code that was recently added, and this patch just backs out that code.
Flags: needinfo?(bhackett1024)
Comment on attachment 8839125 [details] [diff] [review]

ok, let's try and fix this jit regression for 52 rc2
Attachment #8839125 - Flags: approval-mozilla-beta?
Attachment #8839125 - Flags: approval-mozilla-beta+
Attachment #8839125 - Flags: approval-mozilla-aurora?
Attachment #8839125 - Flags: approval-mozilla-aurora+
You need to log in before you can comment on or make changes to this bug.