Closed Bug 1585874 Opened 5 years ago Closed 5 years ago

Intermittent Android PROCESS-CRASH | Mochitest | application crashed [@ <name omitted>]

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla71
Tracking Flags:
Tracking Status
firefox-esr60 --- unaffected
firefox-esr68 --- unaffected
firefox67 --- unaffected
firefox68 --- unaffected
firefox69 --- unaffected
firefox70 --- unaffected
firefox71 --- fixed

People

(Reporter: intermittent-bug-filer, Assigned: iain)

References

(Regression)

Details

(Keywords: crash, intermittent-failure, regression)

Crash Data

Attachments

(1 file)

Bug 1585874: Clear GC pointers in ScriptSource when canonical ScriptSourceObject is finalized r=tcampbell
47 bytes, text/x-phabricator-request
Details | Review

Brian: Can you please take a look at this bug?

Flags: needinfo?(bgrinstead)

From https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=269534878&repo=autoland&lineNumber=6199

After tests in layout/inspector/tests/ got executed:

[task 2019-10-02T23:52:42.161Z] 23:52:42 INFO - MochitestServer : launching [u'/builds/worker/workspace/build/hostutils/host-utils-68.0a1.en-US.linux-x86_64/xpcshell', '-g', '/builds/worker/workspace/build/hostutils/host-utils-68.0a1.en-US.linux-x86_64', '-f', '/builds/worker/workspace/build/hostutils/host-utils-68.0a1.en-US.linux-x86_64/components/httpd.js', '-e', "const _PROFILE_PATH = '/tmp/tmpZgR8iy.mozrunner'; const _SERVER_PORT = '8854'; const _SERVER_ADDR = '10.0.2.2'; const _TEST_PREFIX = undefined; const _DISPLAY_RESULTS = false;", '-f', '/builds/worker/workspace/build/tests/mochitest/server.js']
[task 2019-10-02T23:52:42.161Z] 23:52:42 INFO - runtests.py | Server pid: 9185
[task 2019-10-02T23:52:42.164Z] 23:52:42 INFO - runtests.py | Websocket server pid: 9188
[task 2019-10-02T23:52:42.168Z] 23:52:42 INFO - runtests.py | SSL tunnel pid: 9191
[task 2019-10-02T23:52:42.899Z] 23:52:42 INFO - runtests.py | Running with scheme: http
[task 2019-10-02T23:52:42.899Z] 23:52:42 INFO - runtests.py | Running with e10s: True
[task 2019-10-02T23:52:42.899Z] 23:52:42 INFO - runtests.py | Running with fission: False
[task 2019-10-02T23:52:42.899Z] 23:52:42 INFO - runtests.py | Running with serviceworker_e10s: False
[task 2019-10-02T23:52:42.899Z] 23:52:42 INFO - runtests.py | Running with socketprocess_e10s: False
[task 2019-10-02T23:52:42.899Z] 23:52:42 INFO - runtests.py | Running tests: start.
[task 2019-10-02T23:52:43.209Z] 23:52:43 INFO - adb Granting important runtime permissions to org.mozilla.geckoview.test
[task 2019-10-02T23:52:44.428Z] 23:52:44 INFO - adb launch_application: am start -W -n org.mozilla.geckoview.test/org.mozilla.geckoview.test.TestRunnerActivity -a android.intent.action.MAIN --es env9 MOZ_UPLOAD_DIR=/sdcard/tests/mozlog --es env8 R_LOG_DESTINATION=stderr --es args "-no-remote -profile /sdcard/tests/profile//" --es env3 R_LOG_VERBOSE=1 --es env2 XPCOM_DEBUG_BREAK=stack --es env1 MOZ_WEBRENDER=0 --es env0 MOZ_CRASHREPORTER=1 --es env7 MOZ_CRASHREPORTER_SHUTDOWN=1 --es env6 MOZ_IN_AUTOMATION=1 --es env5 MOZ_DISABLE_NONLOCAL_CONNECTIONS=1 --es env4 DISABLE_UNSAFE_CPOW_WARNINGS=1 --ez use_multiprocess True --es env12 MOZ_HIDE_RESULTS_TABLE=1 --es env11 R_LOG_LEVEL=6 --es env10 MOZ_CRASHREPORTER_NO_REPORT=1 -d "http://mochi.test:8888/tests?autorun=1&closeWhenDone=1&logFile=%2Fsdcard%2Ftests%2Flogs%2Fmochitest.log&fileLevel=INFO&consoleLevel=INFO&hideResultsTable=1&manifestFile=tests.json&dumpOutputDirectory=%2Fsdcard%2Ftests"
[task 2019-10-02T23:52:45.841Z] 23:52:45 INFO - remoteautomation.py | Application pid: 15921
[task 2019-10-02T23:52:56.157Z] 23:52:56 INFO - wait for org.mozilla.geckoview.test complete; top activity=com.android.launcher3
[task 2019-10-02T23:52:56.259Z] 23:52:56 INFO - remoteautomation.py | Application ran for: 0:00:13.256704
[task 2019-10-02T23:52:57.007Z] 23:52:57 INFO - mozcrash Copy/paste: /builds/worker/workspace/build/linux64-minidump_stackwalk /tmp/tmpzcOpRi/0b5f37da-d87e-7497-730a-6d019fc8354c.dmp /builds/worker/workspace/build/symbols
[task 2019-10-02T23:53:08.909Z] 23:53:08 INFO - mozcrash Saved minidump as /builds/worker/workspace/build/blobber_upload_dir/0b5f37da-d87e-7497-730a-6d019fc8354c.dmp
[task 2019-10-02T23:53:08.912Z] 23:53:08 WARNING - PROCESS-CRASH | remoteautomation.py | application crashed [@ <name omitted>]
[task 2019-10-02T23:53:08.912Z] 23:53:08 INFO - Crash dump filename: /tmp/tmpzcOpRi/0b5f37da-d87e-7497-730a-6d019fc8354c.dmp
[task 2019-10-02T23:53:08.912Z] 23:53:08 INFO - Operating system: Android
[task 2019-10-02T23:53:08.912Z] 23:53:08 INFO - 0.0.0 Linux 3.10.0+ #260 SMP PREEMPT Fri May 19 12:48:14 PDT 2017 x86_64
[task 2019-10-02T23:53:08.912Z] 23:53:08 INFO - CPU: amd64
[task 2019-10-02T23:53:08.912Z] 23:53:08 INFO - family 6 model 6 stepping 3
[task 2019-10-02T23:53:08.912Z] 23:53:08 INFO - 4 CPUs
[task 2019-10-02T23:53:08.912Z] 23:53:08 INFO - GPU: UNKNOWN
[task 2019-10-02T23:53:08.912Z] 23:53:08 INFO - Crash reason: SIGSEGV /SEGV_MAPERR
[task 2019-10-02T23:53:08.912Z] 23:53:08 INFO - Crash address: 0x10
[task 2019-10-02T23:53:08.913Z] 23:53:08 INFO - Process uptime: not available
[task 2019-10-02T23:53:08.913Z] 23:53:08 INFO - Thread 16 (crashed)
[task 2019-10-02T23:53:08.913Z] 23:53:08 INFO - 0 libxul.so!<name omitted> [Verifier.cpp:83b9448bbfafc3dcec439577045c0fd8cee83633 : 312 + 0x0]
[task 2019-10-02T23:53:08.913Z] 23:53:08 INFO - rax = 0x0000000000000000 rdx = 0x0000000000030401
[task 2019-10-02T23:53:08.913Z] 23:53:08 INFO - rcx = 0x0000000000000001 rbx = 0x00001f1301d30420
[task 2019-10-02T23:53:08.913Z] 23:53:08 INFO - rsi = 0x00001f1301d00000 rdi = 0x00001f1301d30420
[task 2019-10-02T23:53:08.913Z] 23:53:08 INFO - rbp = 0x0000795603b000e0 rsp = 0x0000795603b000e0
[task 2019-10-02T23:53:08.913Z] 23:53:08 INFO - r8 = 0x0000000000003e8c r9 = 0x0000795603b00450
[task 2019-10-02T23:53:08.913Z] 23:53:08 INFO - r10 = 0x0000000000000000 r11 = 0x0000000000000246
[task 2019-10-02T23:53:08.913Z] 23:53:08 INFO - r12 = 0x00007956032ab430 r13 = 0x0000000000000100
[task 2019-10-02T23:53:08.913Z] 23:53:08 INFO - r14 = 0x000079560239e310 r15 = 0x00007956032ab000
[task 2019-10-02T23:53:08.913Z] 23:53:08 INFO - rip = 0x000079560d7c46bd
[task 2019-10-02T23:53:08.913Z] 23:53:08 INFO - Found by: given as instruction pointer in context
[task 2019-10-02T23:53:08.913Z] 23:53:08 INFO - 1 libxul.so!js::gc::TenuredCell::writeBarrierPre(js::gc::TenuredCell*) [Cell.h:83b9448bbfafc3dcec439577045c0fd8cee83633 : 414 + 0x8]
[task 2019-10-02T23:53:08.914Z] 23:53:08 INFO - rbp = 0x0000795603b00110 rsp = 0x0000795603b000f0
[task 2019-10-02T23:53:08.914Z] 23:53:08 INFO - rip = 0x000079560ced8a58
[task 2019-10-02T23:53:08.914Z] 23:53:08 INFO - Found by: previous frame's frame pointer
[task 2019-10-02T23:53:08.914Z] 23:53:08 INFO - 2 libxul.so!mozilla::HashMapEntry<js::HeapPtr<JSAtom*>, unsigned int>::~HashMapEntry() [HashTable.h:83b9448bbfafc3dcec439577045c0fd8cee83633 : 100 + 0x56]
[task 2019-10-02T23:53:08.914Z] 23:53:08 INFO - rbp = 0x0000795603b00140 rsp = 0x0000795603b00120
[task 2019-10-02T23:53:08.914Z] 23:53:08 INFO - rip = 0x000079560d40d5d6
[task 2019-10-02T23:53:08.914Z] 23:53:08 INFO - Found by: previous frame's frame pointer
[task 2019-10-02T23:53:08.914Z] 23:53:08 INFO - 3 libxul.so!js::XDRIncrementalEncoder::~XDRIncrementalEncoder() [Xdr.h:83b9448bbfafc3dcec439577045c0fd8cee83633 : 562 + 0x5f]
[task 2019-10-02T23:53:08.914Z] 23:53:08 INFO - rbp = 0x0000795603b00180 rsp = 0x0000795603b00150
[task 2019-10-02T23:53:08.914Z] 23:53:08 INFO - rip = 0x000079560d40d28f
[task 2019-10-02T23:53:08.914Z] 23:53:08 INFO - Found by: previous frame's frame pointer
[task 2019-10-02T23:53:08.914Z] 23:53:08 INFO - 4 libxul.so!js::ScriptSource::~ScriptSource() [JSScript.h:83b9448bbfafc3dcec439577045c0fd8cee83633 : 732 + 0x30]
[task 2019-10-02T23:53:08.914Z] 23:53:08 INFO - rbp = 0x0000795603b001b0 rsp = 0x0000795603b00190
[task 2019-10-02T23:53:08.914Z] 23:53:08 INFO - rip = 0x000079560d258735
[task 2019-10-02T23:53:08.914Z] 23:53:08 INFO - Found by: previous frame's frame pointer
[task 2019-10-02T23:53:08.914Z] 23:53:08 INFO - 5 libxul.so!js::SourceCompressionTask::~SourceCompressionTask() [HelperThreads.h:83b9448bbfafc3dcec439577045c0fd8cee83633 : 838 + 0x42]
[task 2019-10-02T23:53:08.914Z] 23:53:08 INFO - rbp = 0x0000795603b001e0 rsp = 0x0000795603b001c0
[task 2019-10-02T23:53:08.915Z] 23:53:08 INFO - rip = 0x000079560d258211
[task 2019-10-02T23:53:08.915Z] 23:53:08 INFO - Found by: previous frame's frame pointer
[task 2019-10-02T23:53:08.915Z] 23:53:08 INFO - 6 libxul.so!js::AttachFinishedCompressions(JSRuntime*, js::AutoLockHelperThreadState&) [HelperThreads.cpp:83b9448bbfafc3dcec439577045c0fd8cee83633 : 2459 + 0x9]
[task 2019-10-02T23:53:08.915Z] 23:53:08 INFO - rbp = 0x0000795603b00230 rsp = 0x0000795603b001f0
[task 2019-10-02T23:53:08.917Z] 23:53:08 INFO - rip = 0x000079560d10ebc9
[task 2019-10-02T23:53:08.917Z] 23:53:08 INFO - Found by: previous frame's frame pointer
[task 2019-10-02T23:53:08.917Z] 23:53:08 INFO - 7 libxul.so!SweepCompressionTasks(js::GCParallelTask*) [GC.cpp:83b9448bbfafc3dcec439577045c0fd8cee83633 : 5110 + 0x8]
[task 2019-10-02T23:53:08.917Z] 23:53:08 INFO - rbp = 0x0000795603b00290 rsp = 0x0000795603b00240
[task 2019-10-02T23:53:08.917Z] 23:53:08 INFO - rip = 0x000079560d7293e9
[task 2019-10-02T23:53:08.917Z] 23:53:08 INFO - Found by: previous frame's frame pointer
[task 2019-10-02T23:53:08.917Z] 23:53:08 INFO - 8 libxul.so!js::GCParallelTask::runFromHelperThread(js::AutoLockHelperThreadState&) [HelperThreads.cpp:83b9448bbfafc3dcec439577045c0fd8cee83633 : 1806 + 0x9]
[task 2019-10-02T23:53:08.917Z] 23:53:08 INFO - rbp = 0x0000795603b002d0 rsp = 0x0000795603b002a0
[task 2019-10-02T23:53:08.917Z] 23:53:08 INFO - rip = 0x000079560d10a007
[task 2019-10-02T23:53:08.917Z] 23:53:08 INFO - Found by: previous frame's frame pointer
[task 2019-10-02T23:53:08.917Z] 23:53:08 INFO - 9 libxul.so!js::HelperThread::handleGCParallelWorkload(js::AutoLockHelperThreadState&) [HelperThreads.cpp:83b9448bbfafc3dcec439577045c0fd8cee83633 : 1827 + 0xb]
[task 2019-10-02T23:53:08.917Z] 23:53:08 INFO - rbp = 0x0000795603b00340 rsp = 0x0000795603b002e0
[task 2019-10-02T23:53:08.917Z] 23:53:08 INFO - rip = 0x000079560d10a4cd
[task 2019-10-02T23:53:08.917Z] 23:53:08 INFO - Found by: previous frame's frame pointer
[task 2019-10-02T23:53:08.917Z] 23:53:08 INFO - 10 libxul.so!js::HelperThread::threadLoop() [HelperThreads.cpp:83b9448bbfafc3dcec439577045c0fd8cee83633 : 2628 + 0x1c]
[task 2019-10-02T23:53:08.917Z] 23:53:08 INFO - rbp = 0x0000795603b003b0 rsp = 0x0000795603b00350
[task 2019-10-02T23:53:08.917Z] 23:53:08 INFO - rip = 0x000079560d10c45f
[task 2019-10-02T23:53:08.917Z] 23:53:08 INFO - Found by: previous frame's frame pointer
[task 2019-10-02T23:53:08.917Z] 23:53:08 INFO - 11 libxul.so!js::detail::ThreadTrampoline<void (&)(void*), js::HelperThread*>::Start(void*) [Thread.h:83b9448bbfafc3dcec439577045c0fd8cee83633 : 199 + 0x1a]
[task 2019-10-02T23:53:08.917Z] 23:53:08 INFO - rbp = 0x0000795603b003e0 rsp = 0x0000795603b003c0
[task 2019-10-02T23:53:08.917Z] 23:53:08 INFO - rip = 0x000079560d139da5
[task 2019-10-02T23:53:08.917Z] 23:53:08 INFO - Found by: previous frame's frame pointer
[task 2019-10-02T23:53:08.917Z] 23:53:08 INFO - 12 libc.so + 0x89772
[task 2019-10-02T23:53:08.917Z] 23:53:08 INFO - rsp = 0x0000795603b003f0 rip = 0x000079562c8ee772
[task 2019-10-02T23:53:08.917Z] 23:53:08 INFO - Found by: stack scanning
[task 2019-10-02T23:53:08.917Z] 23:53:08 INFO - 13 libxul.so + 0x45ded70
[task 2019-10-02T23:53:08.917Z] 23:53:08 INFO - rsp = 0x0000795603b00428 rip = 0x000079560d139d70
[task 2019-10-02T23:53:08.917Z] 23:53:08 INFO - Found by: stack scanning
[task 2019-10-02T23:53:08.917Z] 23:53:08 INFO - 14 libc.so + 0x299ec
[task 2019-10-02T23:53:08.917Z] 23:53:08 INFO - rsp = 0x0000795603b00440 rip = 0x000079562c88e9ec
[task 2019-10-02T23:53:08.917Z] 23:53:08 INFO - Found by: stack scanning
[task 2019-10-02T23:53:08.917Z] 23:53:08 INFO - 15 libc.so + 0x896c0
[task 2019-10-02T23:53:08.917Z] 23:53:08 INFO - rsp = 0x0000795603b00448 rip = 0x000079562c8ee6c0
[task 2019-10-02T23:53:08.917Z] 23:53:08 INFO - Found by: stack scanning
[task 2019-10-02T23:53:08.917Z] 23:53:08 INFO - 16 libc.so + 0x1ca66
[task 2019-10-02T23:53:08.917Z] 23:53:08 INFO - rsp = 0x0000795603b00450 rip = 0x000079562c881a66
[task 2019-10-02T23:53:08.917Z] 23:53:08 INFO - Found by: stack scanning
[task 2019-10-02T23:53:08.917Z] 23:53:08 INFO - 17 libxul.so + 0x45ded70
[task 2019-10-02T23:53:08.917Z] 23:53:08 INFO - rsp = 0x0000795603b004b8 rip = 0x000079560d139d70
[task 2019-10-02T23:53:08.917Z] 23:53:08 INFO - Found by: stack scanning

Component: Mochitest → JavaScript Engine
Flags: needinfo?(bgrinstead) → needinfo?(iireland)
Product: Testing → Core
Regressed by: 1585158
Summary: Intermittent PROCESS-CRASH | Mochitest | application crashed [@ <name omitted>] → Intermittent Android PROCESS-CRASH | Mochitest | application crashed [@ <name omitted>]
Version: Version 3 → unspecified
Crash Signature: [@ <name omitted>] → [@ <name omitted>] [@ js::gc::AssertSafeToSkipBarrier(js::gc::TenuredCell *)]
Crash Signature: [@ <name omitted>] [@ js::gc::AssertSafeToSkipBarrier(js::gc::TenuredCell *)] → [@ <name omitted>] [@ js::gc::AssertSafeToSkipBarrier(js::gc::TenuredCell *)] [@ mozilla::HashMapEntry<js::HeapPtr<JSAtom*>, unsigned int>::~HashMapEntry()] [@ mozilla::detail::HashTable<mozilla::HashMapEntry<js::HeapPtr<JSAtom*>, unsigned int>, mozilla::…

The problem is that it's not really safe to destroy HeapPtrs off the main thread, because there's a barrier that may need to happen there. We only assert in cases where we need to do the barrier but can't, which explains why this is intermittent.

Crash Signature: [@ <name omitted>] [@ js::gc::AssertSafeToSkipBarrier(js::gc::TenuredCell *)] [@ mozilla::HashMapEntry<js::HeapPtr<JSAtom*>, unsigned int>::~HashMapEntry()] [@ mozilla::detail::HashTable<mozilla::HashMapEntry<js::HeapPtr<JSAtom*>, unsigned int> → [@ <name omitted>] [@ js::gc::AssertSafeToSkipBarrier(js::gc::TenuredCell *)] [@ mozilla::HashMapEntry<js::HeapPtr<JSAtom*>, unsigned int>::~HashMapEntry()] [@ mozilla::detail::HashTable<mozilla::HashMapEntry<js::HeapPtr<JSAtom*>, unsigned int>
Pushed by iireland@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/def6f90657bd
Clear GC pointers in ScriptSource when canonical ScriptSourceObject is finalized r=tcampbell
Assignee: nobody → iireland
Flags: needinfo?(iireland)

https://hg.mozilla.org/mozilla-central/rev/def6f90657bd

Status: NEW → RESOLVED
Closed: 5 years ago
status-firefox71: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla71
Crash Signature: , mozilla::HashMap<js::HeapPtr<JSAtom*>, unsigned int, mozilla::DefaultHasher<js::HeapPtr<JSAtom*> >, js::TempAllocPolicy>::MapHashPolicy, js::TempAllocPolicy>::destroyTable(js::TempAllocPolicy&, char*, unsigned int)] → , mozilla::HashMap<js::HeapPtr<JSAtom*>, unsigned int, mozilla::DefaultHasher<js::HeapPtr<JSAtom*> >, js::TempAllocPolicy>::MapHashPolicy, js::TempAllocPolicy>::destroyTable(js::TempAllocPolicy&, char*, unsigned int)] [@ mozilla::detail::HashTable<T>::des…
Has Regression Range: --- → yes
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: