Open Bug 1511615 Opened 2 years ago Updated 10 months ago

Intermittent Tier 2 Android tests/jit-test/jit-test/tests/ctypes/conversion-finalizer.js | Segmentation fault (code 139, args "--ion-eager --ion-offthread-compile=off --ion-check-range-analysis --ion-extra-checks --no-sse3 --no-threads") [0.3 s]


(Core :: JavaScript Engine: JIT, defect, P2)




Tracking Status
firefox64 --- wontfix
firefox65 --- wontfix
firefox66 --- fix-optional


(Reporter: intermittent-bug-filer, Unassigned)


(Blocks 1 open bug)


(Keywords: intermittent-failure, Whiteboard: [geckoview:p2][leave-open])


(1 file)

Filed by: btara [at]

15:34:42     INFO -  TEST-PASS | tests/jit-test/jit-test/tests/ctypes/conversion-finalizer.js | Success (code 0, args "--ion-eager --ion-offthread-compile=off") [0.3 s]
15:34:42     INFO -  {"action": "test_start", "jitflags": "--ion-eager --ion-offthread-compile=off", "pid": 475, "source": "jittests", "test": "ctypes/conversion-finalizer.js", "thread": "main", "time": 1543678482.457999}
15:34:42     INFO -  {"action": "test_end", "extra": {"jitflags": "--ion-eager --ion-offthread-compile=off"}, "jitflags": "--ion-eager --ion-offthread-compile=off", "message": "Success", "pid": 475, "source": "jittests", "status": "PASS", "test": "ctypes/conversion-finalizer.js", "thread": "main", "time": 1543678482.762991}
15:34:43     INFO -  exception output: Segmentation fault
15:34:43     INFO -  Segmentation faultSegmentation faultExit code: 139
15:34:43     INFO -  FAIL - ctypes/conversion-finalizer.js
15:34:43  WARNING -  TEST-UNEXPECTED-FAIL | tests/jit-test/jit-test/tests/ctypes/conversion-finalizer.js | Segmentation fault (code 139, args "--ion-eager --ion-offthread-compile=off --ion-check-range-analysis --ion-extra-checks --no-sse3 --no-threads") [0.3 s]
15:34:43     INFO -  {"action": "test_start", "jitflags": "--ion-eager --ion-offthread-compile=off --ion-check-range-analysis --ion-extra-checks --no-sse3 --no-threads", "pid": 475, "source": "jittests", "test": "ctypes/conversion-finalizer.js", "thread": "main", "time": 1543678482.7640018}
15:34:43     INFO -  {"action": "test_end", "extra": {"jitflags": "--ion-eager --ion-offthread-compile=off --ion-check-range-analysis --ion-extra-checks --no-sse3 --no-threads"}, "jitflags": "--ion-eager --ion-offthread-compile=off --ion-check-range-analysis --ion-extra-checks --no-sse3 --no-threads", "message": "Segmentation fault", "pid": 475, "source": "jittests", "status": "FAIL", "test": "ctypes/conversion-finalizer.js", "thread": "main", "time": 1543678483.068821}
15:34:43     INFO -  INFO exit-status     : 139
15:34:43     INFO -  INFO timed-out       : False
15:34:43     INFO -  INFO stdout          > Segmentation fault
15:34:43     INFO -  INFO stderr         2> Segmentation fault
15:34:43     INFO -  TEST-PASS | tests/jit-test/jit-test/tests/ctypes/conversion-finalizer.js | Success (code 0, args "--baseline-eager") [0.3 s]
This test failure affects both ARMv7 and ARM64 and is blocking us from enabling ARM jit-tests in automation.
Priority: P5 → --
Whiteboard: [arm64:m1][geckoview:p1]
64=wontfix because this is a long-standing test failure so we don't need to uplift the fix to the GV 64 relbranch.
Once Bug 1516913 and Bug 1511618 are resolved we will need to disable this test until it is fixed in order to enable the jit tests in production.
Assignee: nobody → bob
Attachment #9033714 - Flags: review?(jmaher)
Whiteboard: [arm64:m1][geckoview:p1] → [arm64:m1][geckoview:p1][leave-open]
Comment on attachment 9033714 [details] [diff] [review]

Review of attachment 9033714 [details] [diff] [review]:

r+ with addressing my comment (at the very least explain why we are skipping)

::: js/src/jit-test/tests/ctypes/conversion-finalizer.js
@@ +1,1 @@
> +// |jit-test| skip-if: !getBuildConfiguration()['x86'] && !getBuildConfiguration()['x64']

can we just do getBuildConfiguration()['arm'] || getBuildConfiguration()['arm64']

I guess it is just as verbose, maybe a comment here indicating why we are skipping this (link to bug, simple scope of problem: crash on android, etc.)
Attachment #9033714 - Flags: review?(jmaher) → review+ doesn't support 'arm' so the hack is to detect when it is not x86/x64. I'll put a comment pointing to this bug.
See Also: → 1516915
Pushed by
disable js/src/jit-test/tests/ctypes/conversion-finalizer.js for android-hw-p2, r=jmaher.
Unassigning Bob because he is not responsible for fixing the test failure. He just disabled the failing test.
Assignee: bob → nobody
Priority: -- → P1
Removing [arm64] whiteboard tag since this test failure appears to affect both ARMv7 and ARM64 (and hasn't stopped us from shipping ARMv7 Fennec).
Whiteboard: [arm64:m1][geckoview:p1][leave-open] → [geckoview:p2][leave-open]

As mentioned in comment 12, we shipped with it for ARMv7, so this is probably not a P1.

Priority: P1 → P2

I've been poking away at this on and off, trying to replicate the crash. I've run tens of thousands of iterations on Sean's ARM box, and I haven't seen a single segfault. It therefore seems pretty likely that this is android-specific.

It took me a while, but I eventually managed to turn up this log on treeherder. It gives a short backtrace and indicates that a tombstone was created, but the tombstone itself was not uploaded.

(Technically, there are five different copies of the backtrace, each with a different pid. This looks like five retries, but there's indication anywhere else that we re-ran the testcase.)

It looks like I'm going to have to figure out how to run the shell on a phone to make more progress here.

You need to log in before you can comment on or make changes to this bug.