Closed Bug 1674714 Opened 4 years ago Closed 4 years ago

Perma SM arm/amr64 mozcrash.py | application crashed [@ 0x2ef6ab70d015]

Categories

(Core :: JavaScript Engine: JIT, defect, P1)

Product:
Core
Component:
JavaScript Engine: JIT
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
84 Branch
Tracking Flags:
Tracking Status
firefox-esr78 --- unaffected
firefox82 --- unaffected
firefox83 --- unaffected
firefox84 --- fixed

People

(Reporter: intermittent-bug-filer, Assigned: nbp)

References

(Regression)

Details

(Keywords: crash, intermittent-failure, regression)

Crash Data

Attachments

(2 files)

Bug 1674714 - Be sure to choose a nonzero exit status, if any
47 bytes, text/x-phabricator-request
Details | Review
Bug 1674714 - jsapi-tests: Use the simulator to execute JIT-ed functions when needed.
47 bytes, text/x-phabricator-request
Details | Review

Filed by: archaeopteryx [at] coole-files.de
Parsed log: https://treeherder.mozilla.org/logviewer?job_id=320156815&repo=autoland
Full log: https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/BxN-5lJcSK6K2ur5aYvznA/runs/0/artifacts/public/logs/live_backing.log

This fails permanently but the SM(arm) and SM(arm64) tasks claim they were successful.

[task 2020-10-29T17:53:16.839Z] TEST-PASS (EXPECTED RANDOM) | non262/regress/regress-404755.js | (args: "--dll /builds/worker/workspace/breakpad-tools/libbreakpadinjector.so") [61.3 s]
[task 2020-10-29T17:53:17.024Z] make[1]: Leaving directory '/builds/worker/workspace/obj-spider/js/src'
[task 2020-10-29T17:53:17.024Z] in directory /builds/worker/workspace/obj-spider, running ['/builds/worker/workspace/obj-spider/_virtualenvs/init_py3/bin/python3', '/builds/worker/checkouts/gecko/testing/mozbase/mozcrash/mozcrash/mozcrash.py', '/tmp', '/builds/worker/workspace/obj-spider/dist/crashreporter-symbols']
[task 2020-10-29T17:53:17.149Z] mozcrash INFO | Copy/paste: /builds/worker/workspace/breakpad-tools/minidump_stackwalk /tmp/a1071456-bba7-4140-1954ae82-792e23ce.dmp /builds/worker/workspace/obj-spider/dist/crashreporter-symbols
[task 2020-10-29T17:53:17.842Z] mozcrash INFO | Saved minidump as /builds/worker/artifacts/a1071456-bba7-4140-1954ae82-792e23ce.dmp
[task 2020-10-29T17:53:17.842Z] mozcrash checking /tmp for minidumps...
[task 2020-10-29T17:53:17.842Z] PROCESS-CRASH | mozcrash.py | application crashed [@ 0x2ef6ab70d015]
[task 2020-10-29T17:53:17.842Z] Crash dump filename: /tmp/a1071456-bba7-4140-1954ae82-792e23ce.dmp
[task 2020-10-29T17:53:17.842Z] Operating system: Linux
[task 2020-10-29T17:53:17.842Z]                   0.0.0 Linux 4.4.0-1014-aws #14taskcluster1-Ubuntu SMP Tue Apr 3 10:27:00 UTC 2018 x86_64
[task 2020-10-29T17:53:17.842Z] CPU: amd64
[task 2020-10-29T17:53:17.842Z]      family 6 model 85 stepping 7
[task 2020-10-29T17:53:17.842Z]      1 CPU
[task 2020-10-29T17:53:17.842Z] 
[task 2020-10-29T17:53:17.842Z] GPU: UNKNOWN
[task 2020-10-29T17:53:17.842Z] 
[task 2020-10-29T17:53:17.842Z] Crash reason:  SIGSEGV
[task 2020-10-29T17:53:17.842Z] Crash address: 0x2a880700
[task 2020-10-29T17:53:17.842Z] Process uptime: not available
[task 2020-10-29T17:53:17.842Z] 
[task 2020-10-29T17:53:17.842Z] Thread 0 (crashed)
[task 2020-10-29T17:53:17.842Z]  0  0x2ef6ab70d015
[task 2020-10-29T17:53:17.842Z]     rax = 0x000000002a880700   rdx = 0x0000000000000005
[task 2020-10-29T17:53:17.842Z]     rcx = 0x000000003c70d40c   rbx = 0x00000f6ea2d7a038
[task 2020-10-29T17:53:17.842Z]     rsi = 0x0000000000000000   rdi = 0x00007ffff470f000
[task 2020-10-29T17:53:17.842Z]     rbp = 0x00007fffffffcf10   rsp = 0x00007fffffffce98
[task 2020-10-29T17:53:17.842Z]      r8 = 0x0000000000000000    r9 = 0x00000a06c17b9a2d
[task 2020-10-29T17:53:17.842Z]     r10 = 0x0000000000001008   r11 = 0x0000000000000297
[task 2020-10-29T17:53:17.842Z]     r12 = 0x00007fffffffcec8   r13 = 0x000000000000013c
[task 2020-10-29T17:53:17.843Z]     r14 = 0x00007ffff4715000   r15 = 0x00007fffffffd650
[task 2020-10-29T17:53:17.843Z]     rip = 0x00002ef6ab70d015
[task 2020-10-29T17:53:17.843Z]     Found by: given as instruction pointer in context
[task 2020-10-29T17:53:17.843Z]  1  jsapi-tests!JitABICall<bool (*)(JSContext*, js::jit::BaselineFrame*, js::jit::ICUnaryArith_Fallback*, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>)>::run(JS::Handle<JSObject*>) [testJitABIcalls.cpp:4865faeaf6e23a504b06811f273d3695e40a9f2f : 716 + 0xc]
[task 2020-10-29T17:53:17.843Z]     rbp = 0x00007fffffffde40   rsp = 0x00007fffffffcf20
[task 2020-10-29T17:53:17.843Z]     rip = 0x0000555555909231
[task 2020-10-29T17:53:17.843Z]     Found by: previous frame's frame pointer
[task 2020-10-29T17:53:17.843Z]  2  jsapi-tests!main [tests.cpp:4865faeaf6e23a504b06811f273d3695e40a9f2f : 164 + 0x10]
[task 2020-10-29T17:53:17.843Z]     rbx = 0x00005555586a3528   rbp = 0x00007fffffffdec0
[task 2020-10-29T17:53:17.843Z]     rsp = 0x00007fffffffde50   r12 = 0x00005555572554f9
[task 2020-10-29T17:53:17.843Z]     r14 = 0x0000000000000000   r15 = 0x00005555586a3558
[task 2020-10-29T17:53:17.843Z]     rip = 0x00005555559b64b8
[task 2020-10-29T17:53:17.843Z]     Found by: call frame info
[task 2020-10-29T17:53:17.843Z]  3  libc-2.19.so + 0x21b45
[task 2020-10-29T17:53:17.843Z]     rbx = 0x0000000000000000   rbp = 0x0000000000000000
[task 2020-10-29T17:53:17.843Z]     rsp = 0x00007fffffffded0   r12 = 0x000055555582b7a9
[task 2020-10-29T17:53:17.843Z]     r13 = 0x00007fffffffdfa0   r14 = 0x0000000000000000
[task 2020-10-29T17:53:17.843Z]     r15 = 0x0000000000000000   rip = 0x00007ffff6edeb45
[task 2020-10-29T17:53:17.843Z]     Found by: call frame info
[task 2020-10-29T17:53:17.843Z]  4  jsapi-tests + 0x462340
[task 2020-10-29T17:53:17.843Z]     rsp = 0x00007fffffffdef0   rip = 0x00005555559b6340
[task 2020-10-29T17:53:17.843Z]     Found by: stack scanning
[task 2020-10-29T17:53:17.843Z]  5  jsapi-tests!_GLOBAL__sub_I_Unified_cpp_js_src_wasm3.cpp + 0x179
[task 2020-10-29T17:53:17.843Z]     rsp = 0x00007fffffffdf08   rip = 0x000055555582b7a9
[task 2020-10-29T17:53:17.843Z]     Found by: stack scanning
[task 2020-10-29T17:53:17.843Z]  6  jsapi-tests!compiler_builtins::int::udiv::__udivmodti4 [udiv.rs : 268 + 0x11]
[task 2020-10-29T17:53:17.843Z]     rsp = 0x00007fffffffdf50   rip = 0x0000555557249730
[task 2020-10-29T17:53:17.843Z]     Found by: stack scanning
[task 2020-10-29T17:53:17.843Z]  7  jsapi-tests!_GLOBAL__sub_I_Unified_cpp_js_src_wasm3.cpp + 0x179
[task 2020-10-29T17:53:17.843Z]     rbx = 0x00007fffffffdfa8   rsp = 0x00007fffffffdf78
[task 2020-10-29T17:53:17.843Z]     r12 = 0x0000000000000001   r14 = 0x0000000000000000
[task 2020-10-29T17:53:17.843Z]     r15 = 0x0000000000000000   rip = 0x000055555582b7a9
[task 2020-10-29T17:53:17.843Z]     Found by: call frame info
[task 2020-10-29T17:53:17.843Z]  8  jsapi-tests!_start + 0x29
[task 2020-10-29T17:53:17.843Z]     rsp = 0x00007fffffffdf90   rip = 0x000055555582b7d2
[task 2020-10-29T17:53:17.843Z]     Found by: stack scanning```

(In reply to Treeherder Bug Filer from comment #0)

This fails permanently but the SM(arm) and SM(arm64) tasks claim they were successful.

Thanks for catching this issue. This is caused by the fact that we are trying to execute this test case using a simulator build instead of using the real architecture. I will fix it soonish.

Side note, I think we should definitely run these test cases on the actual hardware instead of using the simulator. Especially for these new tests which are checking that we correctly implement the ABI.

Assignee: nobody → nicolas.b.pierron
Severity: normal → S4
Status: NEW → ASSIGNED
Flags: needinfo?(nicolas.b.pierron)
Priority: -- → P1

The error should still have been reported. That turns out to be a really dumb bug in autospider.py. I'm worried that if I fix it, I'll discover other things that have been broken for a while and will need to rush to fix them. So far only the same two jobs have failed with the error reporting fixed, but several are still running.

Assignee: nicolas.b.pierron → sphink

(oops, didn't mean to take the whole bug)

Assignee: sphink → nicolas.b.pierron

(In reply to Steve Fink [:sfink] [:s:] from comment #2)

The error should still have been reported. That turns out to be a really dumb bug in autospider.py. I'm worried that if I fix it, I'll discover other things that have been broken for a while and will need to rush to fix them. So far only the same two jobs have failed with the error reporting fixed, but several are still running.

See also bug 1666508 which is a similar problem but on device. Beware :)

Pushed by npierron@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/4f88baca65b4
jsapi-tests: Use the simulator to execute JIT-ed functions when needed. r=jandem
https://hg.mozilla.org/integration/autoland/rev/63e10ddc8381
Be sure to choose a nonzero exit status, if any r=nbp

(In reply to Dorel Luca [:dluca] from comment #8)

Log:
https://treeherder.mozilla.org/logviewer?job_id=320585299&repo=autoland&lineNumber=57781

The problem comes from my patch, I did not noticed this assertion as I only tested it on an optimized build.
I will fix it and re-upload a patch to fix this issue.

Flags: needinfo?(nicolas.b.pierron)
Pushed by npierron@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/ff2785b2c4a5
jsapi-tests: Use the simulator to execute JIT-ed functions when needed. r=jandem
https://hg.mozilla.org/integration/autoland/rev/8d9df03e1def
Be sure to choose a nonzero exit status, if any r=nbp

Filed bug 1675556 for the jsapi-tests with missing log info.

(In reply to Dorel Luca [:dluca] from comment #11)

Backed out 2 changesets (bug 1674714) for Spidermonkey faiure. CLOSED TREE

Log:
https://treeherder.mozilla.org/logviewer?job_id=320733717&repo=autoland&lineNumber=88899

The problem was a lack of saving of the link register on ARM, due to the fact that ARM reuse the link register as a scratch register.

Flags: needinfo?(nicolas.b.pierron)
Pushed by npierron@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/e9d035b60fe3
jsapi-tests: Use the simulator to execute JIT-ed functions when needed. r=jandem
https://hg.mozilla.org/integration/autoland/rev/3c061feccaf9
Be sure to choose a nonzero exit status, if any r=nbp

https://hg.mozilla.org/mozilla-central/rev/e9d035b60fe3
https://hg.mozilla.org/mozilla-central/rev/3c061feccaf9

Status: ASSIGNED → RESOLVED
Closed: 4 years ago
status-firefox84: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → 84 Branch
Has Regression Range: --- → yes
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: