Closed Bug 1520962 Opened 5 years ago Closed 5 years ago

Intermittent awsy\test_memory_usage.py TestMemoryUsage.test_open_tabs | application crashed [@ mozilla::FramePointerStackWalk(void (*)(unsigned int,void *,void *,void *),unsigned int,unsigned int,void *,void * *,void *)]

Categories

(Toolkit :: Performance Monitoring, defect, P5)

defect

Tracking

()

RESOLVED FIXED
mozilla67
Tracking Status
firefox-esr60 --- unaffected
firefox65 --- unaffected
firefox66 --- fixed
firefox67 --- fixed

People

(Reporter: intermittent-bug-filer, Assigned: erahm)

Details

(Keywords: crash, intermittent-failure)

Crash Data

Attachments

(1 file)

Filed by: rgurzau [at] mozilla.com

https://treeherder.mozilla.org/logviewer.html#?job_id=222496092&repo=try

https://queue.taskcluster.net/v1/task/YAWPMNRRTE6Hdq8ebSy2vw/runs/0/artifacts/public/logs/live_backing.log

17:53:16 INFO - ERROR:root:[Errno 10054] An existing connection was forcibly closed by the remote host
17:53:17 INFO - loaded!
17:53:27 INFO - switching to tab
17:53:27 INFO - switched to tab
17:53:27 INFO - loading http://localhost:8042/page_load_test/tp5n/dailymotion.com/www.dailymotion.com/us.html
17:53:27 INFO - loaded!
17:53:37 INFO - switching to tab
17:53:37 INFO - switched to tab
17:53:37 INFO - loading http://localhost:8043/page_load_test/tp5n/goo.ne.jp/goo.ne.jp/index.html
17:53:38 INFO - loaded!
17:53:48 INFO - switching to tab
17:53:48 INFO - switched to tab
17:53:48 INFO - loading http://localhost:8044/page_load_test/tp5n/alipay.com/www.alipay.com/index.html
17:53:48 INFO - loaded!
17:53:58 INFO - switching to tab
17:53:58 INFO - switched to tab
17:53:58 INFO - loading http://localhost:8045/page_load_test/tp5n/stackoverflow.com/stackoverflow.com/questions/184618/what-is-the-best-comment-in-source-code-you-have-ever-encountered.html
17:53:59 INFO - loaded!
17:54:09 INFO - mozcrash Downloading symbols from: https://queue.taskcluster.net/v1/task/T2cuCJY4Qdi1L22R3dTggA/artifacts/public/build/target.crashreporter-symbols.zip
17:54:13 INFO - mozcrash Copy/paste: Z:\task_1547745411\build\win32-minidump_stackwalk.exe c:\users\task_1547745411\appdata\local\temp\tmp6ru5oj.profile\minidumps\a22cc40a-3557-4524-b7ed-d9c8676caf6e.dmp c:\users\task_1547745411\appdata\local\temp\tmpnrlf_c
17:54:21 INFO - mozcrash Saved minidump as Z:\task_1547745411\build\blobber_upload_dir\a22cc40a-3557-4524-b7ed-d9c8676caf6e.dmp
17:54:21 INFO - mozcrash Saved app info as Z:\task_1547745411\build\blobber_upload_dir\a22cc40a-3557-4524-b7ed-d9c8676caf6e.extra
17:54:21 INFO - PROCESS-CRASH | awsy\test_memory_usage.py TestMemoryUsage.test_open_tabs | application crashed [@ mozilla::FramePointerStackWalk(void (*)(unsigned int,void *,void *,void *),unsigned int,unsigned int,void *,void * *,void )]
17:54:21 INFO - Crash dump filename: c:\users\task_1547745411\appdata\local\temp\tmp6ru5oj.profile\minidumps\a22cc40a-3557-4524-b7ed-d9c8676caf6e.dmp
17:54:21 INFO - Operating system: Windows NT
17:54:21 INFO - 6.1.7601 Service Pack 1
17:54:21 INFO - CPU: x86
17:54:21 INFO - GenuineIntel family 6 model 63 stepping 2
17:54:21 INFO - 8 CPUs
17:54:21 INFO -
17:54:21 INFO - GPU: UNKNOWN
17:54:21 INFO -
17:54:21 INFO - Crash reason: EXCEPTION_ACCESS_VIOLATION_READ
17:54:21 INFO - Crash address: 0x200000
17:54:21 INFO - Assertion: Unknown assertion type 0x00000000
17:54:21 INFO - Process uptime: 412 seconds
17:54:21 INFO -
17:54:21 INFO - Thread 0 (crashed)
17:54:21 INFO - 0 mozglue.dll!mozilla::FramePointerStackWalk(void (
)(unsigned int,void *,void *,void *),unsigned int,unsigned int,void *,void * *,void *) [StackWalk.cpp:1bcaa3f29154702c2d5def68c719f2a1b81079a9 : 849 + 0x0]
17:54:21 INFO - eip = 0x6bf274a0 esp = 0x001f2c74 ebp = 0x001f2c84 ebx = 0x00200000
17:54:21 INFO - esi = 0x00000006 edi = 0xfffffffa eax = 0x00200000 ecx = 0x00200000
17:54:21 INFO - edx = 0x00000018 efl = 0x00010206
17:54:21 INFO - Found by: given as instruction pointer in context
17:54:21 INFO - 1 mozglue.dll!static const class mozilla::dmd::StackTrace * mozilla::dmd::StackTrace::Get(class mozilla::dmd::Thread *) [DMD.cpp:1bcaa3f29154702c2d5def68c719f2a1b81079a9 : 686 + 0x18]
17:54:21 INFO - eip = 0x6bf1f83b esp = 0x001f2c8c ebp = 0x001f3018
17:54:21 INFO - Found by: previous frame's frame pointer
17:54:21 INFO - 2 mozglue.dll!static void mozilla::dmd::AllocCallback(void *, unsigned int, class mozilla::dmd::Thread *) [DMD.cpp:1bcaa3f29154702c2d5def68c719f2a1b81079a9 : 1072 + 0x5]
17:54:21 INFO - eip = 0x6bf21a34 esp = 0x001f3020 ebp = 0x001f3088
17:54:21 INFO - Found by: previous frame's frame pointer
17:54:21 INFO - 3 mozglue.dll!static void * replace_malloc(unsigned int) [DMD.cpp:1bcaa3f29154702c2d5def68c719f2a1b81079a9 : 1121 + 0xb]
17:54:21 INFO - eip = 0x6bf1ff37 esp = 0x001f3090 ebp = 0x001f30a0
17:54:21 INFO - Found by: previous frame's frame pointer
17:54:21 INFO - 4 xul.dll!nsTSubstring<char16_t>::StartBulkWriteImpl(unsigned int,unsigned int,bool,unsigned int,unsigned int,unsigned int) [nsTSubstring.cpp:1bcaa3f29154702c2d5def68c719f2a1b81079a9 : 203 + 0xb]
17:54:21 INFO - eip = 0x56868386 esp = 0x001f30a8 ebp = 0x001f30cc
17:54:21 INFO - Found by: previous frame's frame pointer
17:54:21 INFO - 5 xul.dll!Gecko_StartBulkWriteString [nsSubstring.cpp:1bcaa3f29154702c2d5def68c719f2a1b81079a9 : 446 + 0x14]
17:54:21 INFO - eip = 0x56877893 esp = 0x001f30d4 ebp = 0x001f3100
17:54:21 INFO - Found by: previous frame's frame pointer
17:54:21 INFO - 6 xul.dll!bool nsstring::conversions::nsstring_fallible_append_latin1_impl(struct nsstring::nsAString *, unsigned char *, unsigned int, unsigned int, bool) [conversions.rs:1bcaa3f29154702c2d5def68c719f2a1b81079a9 : 698 + 0x26]
17:54:21 INFO - eip = 0x5790f573 esp = 0x001f3108 ebp = 0x001f3154
17:54:21 INFO - Found by: previous frame's frame pointer

Eric, any idea what's going on with these DMD crashes?

Component: AWSY → Performance Monitoring
Flags: needinfo?(erahm)
Product: Testing → Toolkit
Version: Version 3 → unspecified

There are a different amount of blocks in the reports. Nick understands this a bit better than me.

Flags: needinfo?(erahm) → needinfo?(n.nethercote)

(In reply to Eric Rahm [:erahm] (ni? for phab reviews) from comment #4)

There are a different amount of blocks in the reports. Nick understands this a bit better than me.

Sorry I was thinking of a different bug. We're crashing in stack walking, maybe dmajor might be able to help out.

Flags: needinfo?(dmajor)
Flags: needinfo?(n.nethercote)

aBp == aStackEnd, which (on Windows at least) is the first address above your stack, and thus not accessible memory. Maybe this > should be a >= https://searchfox.org/mozilla-central/rev/490ab7f9b84570573a49d7fa018673ce0d5ddf22/mozglue/misc/StackWalk.cpp#856

Flags: needinfo?(dmajor)
Pushed by erahm@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/6dc627ba7a29
Update stackwalking bounds check to avoid aStackEnd. r=dmajor
Status: NEW → RESOLVED
Closed: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla67
Assignee: nobody → erahm

Please nominate this for Beta approval when you get a chance.

Flags: needinfo?(erahm)

Comment on attachment 9042609 [details]
Bug 1520962 - Update stackwalking bounds check to avoid aStackEnd. r=dmajor

Beta/Release Uplift Approval Request

Feature/Bug causing the regression

None

User impact if declined

Possible crashes in stackwalking code, continuing intermittent failures.

Is this code covered by automated tests?

Yes

Has the fix been verified in Nightly?

Yes

Needs manual test from QE?

No

If yes, steps to reproduce

List of other uplifts needed

None

Risk to taking this patch

Low

Why is the change risky/not risky? (and alternatives if risky)

This is a very small scoped change that avoids accessing out of bounds memory.

String changes made/needed

N/A

Flags: needinfo?(erahm)
Attachment #9042609 - Flags: approval-mozilla-beta?

Comment on attachment 9042609 [details]
Bug 1520962 - Update stackwalking bounds check to avoid aStackEnd. r=dmajor

Simple fix to avoid possible OOM crash, intermittent test failure.
OK for uplift to beta 8.

Attachment #9042609 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: