Open Bug 1706317 Opened 5 months ago Updated 4 days ago

Intermittent mozcrash.py | application crashed [@ js::jit::MAssertRecoveredOnBailout::writeRecoverData(js::jit::CompactBufferWriter&) const]

Categories

(Core :: JavaScript Engine: JIT, defect)

defect

Tracking

()

Tracking Status
firefox-esr78 --- unaffected
firefox87 --- unaffected
firefox88 --- unaffected
firefox89 --- unaffected
firefox90 --- affected

People

(Reporter: intermittent-bug-filer, Unassigned, NeedInfo)

References

(Blocks 1 open bug, Regression)

Details

(Keywords: crash, intermittent-failure, regression)

Crash Data

Filed by: archaeopteryx [at] coole-files.de
Parsed log: https://treeherder.mozilla.org/logviewer?job_id=337001204&repo=autoland
Full log: https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/OiZ8_vA9ROafV6oocpO5AQ/runs/0/artifacts/public/logs/live_backing.log


Since bug 1697929 landed, several Linux spidermonkey test tasks are successful but contain crashes either about [@ js::jit::MAssertRecoveredOnBailout::writeRecoverData(js::jit::CompactBufferWriter&) const] or [@ Crash(JSContext*, unsigned int, JS::Value*)]

[task 2021-04-19T14:56:15.894Z] TEST-PASS | streams/readable-streams/templated.any.js | (args: "--dll /builds/worker/fetches/injector/libbreakpadinjector.so --ion-eager --ion-offthread-compile=off --more-compartments") [0.1 s]
[task 2021-04-19T14:56:16.048Z] make[1]: Leaving directory '/builds/worker/workspace/sm-package/mozjs-89.0a1.0/obj-spider/js/src'
[task 2021-04-19T14:56:16.048Z] in directory /builds/worker/workspace/sm-package/mozjs-89.0a1.0/obj-spider, running ['/builds/worker/workspace/sm-package/mozjs-89.0a1.0/obj-spider/_virtualenvs/init_py3/bin/python3', '/builds/worker/workspace/sm-package/mozjs-89.0a1.0/testing/mozbase/mozcrash/mozcrash/mozcrash.py', '/tmp', '/builds/worker/workspace/sm-package/mozjs-89.0a1.0/obj-spider/dist/crashreporter-symbols']
[task 2021-04-19T14:56:16.128Z] mozcrash INFO | Copy/paste: /builds/worker/fetches/minidump_stackwalk/minidump_stackwalk /tmp/539f1e1e-0cc8-0712-8da8-8464c60d3835.dmp /builds/worker/workspace/sm-package/mozjs-89.0a1.0/obj-spider/dist/crashreporter-symbols
[task 2021-04-19T14:56:17.029Z] mozcrash INFO | Saved minidump as /builds/worker/workspace/sm-package/mozjs-89.0a1.0/obj-spider/539f1e1e-0cc8-0712-8da8-8464c60d3835.dmp
[task 2021-04-19T14:56:17.029Z] mozcrash checking /tmp for minidumps...
[task 2021-04-19T14:56:17.029Z] PROCESS-CRASH | mozcrash.py | application crashed [@ js::jit::MAssertRecoveredOnBailout::writeRecoverData(js::jit::CompactBufferWriter&) const]
[task 2021-04-19T14:56:17.029Z] Crash dump filename: /tmp/539f1e1e-0cc8-0712-8da8-8464c60d3835.dmp
[task 2021-04-19T14:56:17.029Z] Operating system: Linux
[task 2021-04-19T14:56:17.029Z]                   0.0.0 Linux 4.4.0-1014-aws #14taskcluster1-Ubuntu SMP Tue Apr 3 10:27:00 UTC 2018 x86_64
[task 2021-04-19T14:56:17.029Z] CPU: amd64
[task 2021-04-19T14:56:17.029Z]      family 6 model 85 stepping 4
[task 2021-04-19T14:56:17.029Z]      16 CPUs
[task 2021-04-19T14:56:17.029Z] 
[task 2021-04-19T14:56:17.029Z] GPU: UNKNOWN
[task 2021-04-19T14:56:17.029Z] 
[task 2021-04-19T14:56:17.029Z] Crash reason:  SIGSEGV /SEGV_MAPERR
[task 2021-04-19T14:56:17.029Z] Crash address: 0x0
[task 2021-04-19T14:56:17.029Z] Process uptime: not available
[task 2021-04-19T14:56:17.029Z] 
[task 2021-04-19T14:56:17.029Z] Thread 0 (crashed)
[task 2021-04-19T14:56:17.029Z]  0  js!js::jit::MAssertRecoveredOnBailout::writeRecoverData(js::jit::CompactBufferWriter&) const [Recover.cpp : 1837 + 0x11]
[task 2021-04-19T14:56:17.029Z]     rax = 0x00005555576804e0   rdx = 0x0000000000000008
[task 2021-04-19T14:56:17.029Z]     rcx = 0x00005555565f69f8   rbx = 0x00007ffff6c52a68
[task 2021-04-19T14:56:17.029Z]     rsi = 0x00007ffff6c52a68   rdi = 0x00007ffff5adef38
[task 2021-04-19T14:56:17.029Z]     rbp = 0x00007fffffffc130   rsp = 0x00007fffffffc118
[task 2021-04-19T14:56:17.029Z]      r8 = 0x00007ffff5aee000    r9 = 0x0000000000000001
[task 2021-04-19T14:56:17.029Z]     r10 = 0x00006df50bf1f1cb   r11 = 0x0000000000000040
[task 2021-04-19T14:56:17.029Z]     r12 = 0x00007ffff5ae0de0   r13 = 0x00007ffff5ae0d88
[task 2021-04-19T14:56:17.029Z]     r14 = 0x00007ffff6c52000   r15 = 0x00007ffff5ae0dd8
[task 2021-04-19T14:56:17.030Z]     rip = 0x0000555555f8b141
[task 2021-04-19T14:56:17.030Z]     Found by: given as instruction pointer in context
[task 2021-04-19T14:56:17.030Z]  1  js!js::jit::RecoverWriter::writeInstruction(js::jit::MNode const*) [Snapshots.cpp : 643 + 0x9]
[task 2021-04-19T14:56:17.030Z]     rbx = 0x00007ffff5ae0d88   rbp = 0x00007fffffffc130
[task 2021-04-19T14:56:17.030Z]     rsp = 0x00007fffffffc120   r12 = 0x00007ffff5ae0de0
[task 2021-04-19T14:56:17.030Z]     r13 = 0x00007ffff5ae0d88   r14 = 0x00007ffff6c52000
[task 2021-04-19T14:56:17.030Z]     r15 = 0x00007ffff5ae0dd8   rip = 0x0000555555dada38
[task 2021-04-19T14:56:17.030Z]     Found by: call frame info
[task 2021-04-19T14:56:17.030Z]  2  js!js::jit::CodeGeneratorShared::encode(js::jit::LRecoverInfo*) [clone .part.242] [CodeGenerator-shared.cpp : 533 + 0xf]
[task 2021-04-19T14:56:17.030Z]     rbx = 0x00007ffff6c52a68   rbp = 0x00007fffffffc180
[task 2021-04-19T14:56:17.030Z]     rsp = 0x00007fffffffc140   r12 = 0x00007ffff5ae0de0
[task 2021-04-19T14:56:17.030Z]     r13 = 0x00007ffff5ae0d88   r14 = 0x00007ffff6c52000
[task 2021-04-19T14:56:17.030Z]     r15 = 0x00007ffff5ae0dd8   rip = 0x0000555555dd012f
[task 2021-04-19T14:56:17.030Z]     Found by: call frame info
[task 2021-04-19T14:56:17.030Z]  3  js!js::jit::CodeGeneratorShared::encode(js::jit::LSnapshot*) [clone .part.243] [CodeGenerator-shared.cpp : 547 + 0x8]
[task 2021-04-19T14:56:17.030Z]     rbx = 0x00007ffff6c52000   rbp = 0x00007fffffffc220
[task 2021-04-19T14:56:17.030Z]     rsp = 0x00007fffffffc190   r12 = 0x00007ffff5ae0de0
[task 2021-04-19T14:56:17.030Z]     r13 = 0x00007ffff5ae0d88   r14 = 0x00002b576db9c3d0
[task 2021-04-19T14:56:17.030Z]     r15 = 0x00007ffff6c52000   rip = 0x0000555555dd1088
[task 2021-04-19T14:56:17.030Z]     Found by: call frame info
[task 2021-04-19T14:56:17.030Z]  4  js!js::jit::CodeGenerator::generateBody() [CodeGenerator.cpp : 6571 + 0x34ea]
[task 2021-04-19T14:56:17.030Z]     rbx = 0x00005555565f08e0   rbp = 0x00007fffffffc2f0
[task 2021-04-19T14:56:17.030Z]     rsp = 0x00007fffffffc230   r12 = 0x00007ffff5ae0d48
[task 2021-04-19T14:56:17.030Z]     r13 = 0x0000000000000000   r14 = 0x00002b576db9c3d0
[task 2021-04-19T14:56:17.030Z]     r15 = 0x00007ffff6c52000   rip = 0x0000555555ed65fb
[task 2021-04-19T14:56:17.030Z]     Found by: call frame info
[task 2021-04-19T14:56:17.030Z]  5  js!js::jit::CodeGenerator::generate() [CodeGenerator.cpp : 11450 + 0x8]
[task 2021-04-19T14:56:17.030Z]     rbx = 0x00007ffff6c52000   rbp = 0x00007fffffffc330
[task 2021-04-19T14:56:17.030Z]     rsp = 0x00007fffffffc300   r12 = 0x00007ffff5a65d81
[task 2021-04-19T14:56:17.030Z]     r13 = 0x00007ffff5ae4640   r14 = 0x00007ffff5ade0a8
[task 2021-04-19T14:56:17.030Z]     r15 = 0x0000000000000000   rip = 0x0000555555ed71f4
[task 2021-04-19T14:56:17.030Z]     Found by: call frame info
[task 2021-04-19T14:56:17.030Z]  6  js!js::jit::GenerateCode(js::jit::MIRGenerator*, js::jit::LIRGraph*) [Ion.cpp : 1567 + 0x8]
[task 2021-04-19T14:56:17.030Z]     rbx = 0x00007ffff6c52000   rbp = 0x00007fffffffc390
[task 2021-04-19T14:56:17.030Z]     rsp = 0x00007fffffffc340   r12 = 0x00007fffffffc340
[task 2021-04-19T14:56:17.030Z]     r13 = 0x00007ffff5ade128   r14 = 0x00007ffff5ae0530
[task 2021-04-19T14:56:17.030Z]     r15 = 0x0000000000000000   rip = 0x0000555555ee64bf
[task 2021-04-19T14:56:17.030Z]     Found by: call frame info
[task 2021-04-19T14:56:17.030Z]  7  js!js::jit::CompileBackEnd(js::jit::MIRGenerator*, js::jit::WarpSnapshot*) [Ion.cpp : 1596 + 0xb]
[task 2021-04-19T14:56:17.030Z]     rbx = 0x00007ffff6c26000   rbp = 0x00007fffffffc710
[task 2021-04-19T14:56:17.030Z]     rsp = 0x00007fffffffc3a0   r12 = 0x00007fffffffc980
[task 2021-04-19T14:56:17.030Z]     r13 = 0x00007fffffffc4c0   r14 = 0x00007ffff5ade128
[task 2021-04-19T14:56:17.030Z]     r15 = 0x0000000000000000   rip = 0x0000555555efc805
[task 2021-04-19T14:56:17.030Z]     Found by: call frame info
[task 2021-04-19T14:56:17.030Z]  8  js!js::jit::IonCompile(JSContext*, JS::Handle<JSScript*>, unsigned char*) [Ion.cpp : 1723 + 0xf]
[task 2021-04-19T14:56:17.030Z]     rbx = 0x00007ffff6c26000   rbp = 0x00007fffffffc8e0
[task 2021-04-19T14:56:17.030Z]     rsp = 0x00007fffffffc720   r12 = 0x00007fffffffc980
[task 2021-04-19T14:56:17.030Z]     r13 = 0x00007ffff5ade348   r14 = 0x00007fffffffc7f0
[task 2021-04-19T14:56:17.030Z]     r15 = 0x00007ffff5a765e0   rip = 0x0000555555efd80e
[task 2021-04-19T14:56:17.030Z]     Found by: call frame info
[task 2021-04-19T14:56:17.030Z]  9  js!js::jit::Compile(JSContext*, JS::Handle<JSScript*>, js::jit::BaselineFrame*, unsigned char*) [Ion.cpp : 1908 + 0xe]
[task 2021-04-19T14:56:17.030Z]     rbx = 0x00002b576db9c3d0   rbp = 0x00007fffffffc950
[task 2021-04-19T14:56:17.030Z]     rsp = 0x00007fffffffc8f0   r12 = 0x00007ffff6c26000
[task 2021-04-19T14:56:17.030Z]     r13 = 0x00007fffffffc980   r14 = 0x0000000000000000
[task 2021-04-19T14:56:17.030Z]     r15 = 0x0000000000000001   rip = 0x0000555555efda23
[task 2021-04-19T14:56:17.030Z]     Found by: call frame info
[task 2021-04-19T14:56:17.030Z] 10  js!IonCompileScriptForBaseline(JSContext*, js::jit::BaselineFrame*, unsigned char*) [Ion.cpp : 2164 + 0x64]
[task 2021-04-19T14:56:17.030Z]     rbx = 0x00007ffff6c26000   rbp = 0x00007fffffffc9c0
[task 2021-04-19T14:56:17.030Z]     rsp = 0x00007fffffffc960   r12 = 0x00007fffffffca10
[task 2021-04-19T14:56:17.030Z]     r13 = 0x00007ffff5a65d81   r14 = 0x00007fffffffc980
[task 2021-04-19T14:56:17.030Z]     r15 = 0x0000000000000001   rip = 0x0000555555effbfe
[task 2021-04-19T14:56:17.030Z]     Found by: call frame info
[task 2021-04-19T14:56:17.030Z] 11  0x1723ffadbcea
[task 2021-04-19T14:56:17.030Z]     rbx = 0x00001723ffb1c610   rbp = 0x00007fffffffca58
[task 2021-04-19T14:56:17.030Z]     rsp = 0x00007fffffffc9d0   r12 = 0x0000000000000000
[task 2021-04-19T14:56:17.030Z]     r13 = 0x0000000000000000   r14 = 0x0000000000000043
[task 2021-04-19T14:56:17.030Z]     r15 = 0x00007fffffffcbe0   rip = 0x00001723ffadbcea
[task 2021-04-19T14:56:17.030Z]     Found by: call frame info
[task 2021-04-19T14:56:17.030Z] 12  0x1723ffb18973
[task 2021-04-19T14:56:17.030Z]     rbp = 0x00007fffffffca88   rsp = 0x00007fffffffca68
[task 2021-04-19T14:56:17.030Z]     rip = 0x00001723ffb18973
[task 2021-04-19T14:56:17.030Z]     Found by: previous frame's frame pointer
[task 2021-04-19T14:56:17.030Z] 13  0x7ffff6c4d6d0
[task 2021-04-19T14:56:17.030Z]     rbp = 0x00007fffffffcb08   rsp = 0x00007fffffffca98
[task 2021-04-19T14:56:17.030Z]     rip = 0x00007ffff6c4d6d0
[task 2021-04-19T14:56:17.030Z]     Found by: previous frame's frame pointer
[task 2021-04-19T14:56:17.030Z] 14  0x1723ffad856f
[task 2021-04-19T14:56:17.030Z]     rbp = 0x00007fffffffcb60   rsp = 0x00007fffffffcb18
[task 2021-04-19T14:56:17.030Z]     rip = 0x00001723ffad856f
[task 2021-04-19T14:56:17.030Z]     Found by: previous frame's frame pointer
[task 2021-04-19T14:56:17.030Z] 15  js!EnterJit(JSContext*, js::RunState&, unsigned char*) [Jit.cpp : 109 + 0x8]
[task 2021-04-19T14:56:17.030Z]     rbp = 0x00007fffffffcd20   rsp = 0x00007fffffffcb70
[task 2021-04-19T14:56:17.030Z]     rip = 0x0000555555f04ba6
[task 2021-04-19T14:56:17.030Z]     Found by: previous frame's frame pointer
[task 2021-04-19T14:56:17.030Z] 16  js!js::RunScript(JSContext*, js::RunState&) [Interpreter.cpp : 396 + 0x5]
[task 2021-04-19T14:56:17.030Z]     rbx = 0x00007ffff6c26000   rbp = 0x00007fffffffcd90
[task 2021-04-19T14:56:17.030Z]     rsp = 0x00007fffffffcd30   r12 = 0x00007fffffffcda0
[task 2021-04-19T14:56:17.030Z]     r13 = 0x0000000000000001   r14 = 0x0000000000000000
[task 2021-04-19T14:56:17.030Z]     r15 = 0x000000d614f28217   rip = 0x00005555557ef732
[task 2021-04-19T14:56:17.030Z]     Found by: call frame info
[task 2021-04-19T14:56:17.030Z] 17  js!js::Execute(JSContext*, JS::Handle<JSScript*>, JS::Handle<JSObject*>, JS::MutableHandle<JS::Value>) [Interpreter.cpp : 809 + 0xa7]
[task 2021-04-19T14:56:17.030Z]     rbx = 0x00007ffff6c26000   rbp = 0x00007fffffffce20
[task 2021-04-19T14:56:17.030Z]     rsp = 0x00007fffffffcda0   r12 = 0x00007fffffffced0
[task 2021-04-19T14:56:17.030Z]     r13 = 0x00007fffffffce40   r14 = 0x00007fffffffce60
[task 2021-04-19T14:56:17.030Z]     r15 = 0x00007fffffffdf26   rip = 0x00005555557f20b3
[task 2021-04-19T14:56:17.030Z]     Found by: call frame info
[task 2021-04-19T14:56:17.030Z] 18  js!JS_ExecuteScript(JSContext*, JS::Handle<JSScript*>) [CompilationAndEvaluation.cpp : 466 + 0x5]
[task 2021-04-19T14:56:17.030Z]     rbx = 0x00007ffff6c26000   rbp = 0x00007fffffffce80
[task 2021-04-19T14:56:17.030Z]     rsp = 0x00007fffffffce30   r12 = 0x00007fffffffced0
[task 2021-04-19T14:56:17.030Z]     r13 = 0x00007ffff7621400   r14 = 0x00007fffffffcf00
[task 2021-04-19T14:56:17.030Z]     r15 = 0x00007fffffffdf26   rip = 0x00005555558d2185
[task 2021-04-19T14:56:17.030Z]     Found by: call frame info
[task 2021-04-19T14:56:17.030Z] 19  js!RunFile(JSContext*, char const*, _IO_FILE*, CompileUtf8, bool) [js.cpp : 1062 + 0x13]
[task 2021-04-19T14:56:17.030Z]     rbx = 0x00007ffff6c26000   rbp = 0x00007fffffffd020
[task 2021-04-19T14:56:17.030Z]     rsp = 0x00007fffffffce90   r12 = 0x0000000000000001
[task 2021-04-19T14:56:17.030Z]     r13 = 0x00007ffff7621400   r14 = 0x00007fffffffcf00
[task 2021-04-19T14:56:17.030Z]     r15 = 0x00007fffffffdf26   rip = 0x00005555557032ac
[task 2021-04-19T14:56:17.030Z]     Found by: call frame info
[task 2021-04-19T14:56:17.030Z] 20  js!Process(JSContext*, char const*, bool, FileKind) [js.cpp : 1659 + 0x18]
[task 2021-04-19T14:56:17.030Z]     rbx = 0x00007ffff6c26000   rbp = 0x00007fffffffd0a0
[task 2021-04-19T14:56:17.030Z]     rsp = 0x00007fffffffd030   r12 = 0x00007ffff7a0b800
[task 2021-04-19T14:56:17.030Z]     r13 = 0x00007fffffffdf26   r14 = 0x0000000000000000
[task 2021-04-19T14:56:17.030Z]     r15 = 0x0000000000000000   rip = 0x0000555555704be9
[task 2021-04-19T14:56:17.030Z]     Found by: call frame info
[task 2021-04-19T14:56:17.030Z] 21  js!main [js.cpp : 12526 + 0x126c]
[task 2021-04-19T14:56:17.030Z]     rbx = 0x00007ffff6c21400   rbp = 0x00007fffffffd710
[task 2021-04-19T14:56:17.030Z]     rsp = 0x00007fffffffd0b0   r12 = 0x00007ffff7a0b840
[task 2021-04-19T14:56:17.030Z]     r13 = 0x00007ffff6c26000   r14 = 0x0000000000000010
[task 2021-04-19T14:56:17.030Z]     r15 = 0x0000000000000010   rip = 0x000055555570d910
[task 2021-04-19T14:56:17.030Z]     Found by: call frame info
[task 2021-04-19T14:56:17.030Z] 22  libc.so.6 + 0x2409b
[task 2021-04-19T14:56:17.030Z]     rbx = 0x0000000000000000   rbp = 0x0000555556586240
[task 2021-04-19T14:56:17.030Z]     rsp = 0x00007fffffffd720   r12 = 0x000055555572321f
[task 2021-04-19T14:56:17.030Z]     r13 = 0x00007fffffffd7f0   r14 = 0x0000000000000000
[task 2021-04-19T14:56:17.030Z]     r15 = 0x0000000000000000   rip = 0x00007ffff787309b
[task 2021-04-19T14:56:17.030Z]     Found by: call frame info
[task 2021-04-19T14:56:17.030Z] 23  js + 0x1b63e0
[task 2021-04-19T14:56:17.030Z]     rsp = 0x00007fffffffd740   rip = 0x000055555570a3e0
[task 2021-04-19T14:56:17.030Z]     Found by: stack scanning
[task 2021-04-19T14:56:17.030Z] 24  js!_GLOBAL__sub_I_Unified_cpp_js_src_wasm3.cpp [WasmValidate.cpp : 3566 + 0xaf]
[task 2021-04-19T14:56:17.030Z]     rsp = 0x00007fffffffd758   rip = 0x000055555572321f
[task 2021-04-19T14:56:17.030Z]     Found by: stack scanning
[task 2021-04-19T14:56:17.030Z] 25  ld-linux-x86-64.so.2 + 0xf476
[task 2021-04-19T14:56:17.030Z]     rsp = 0x00007fffffffd7b0   rip = 0x00007ffff7fe4476
[task 2021-04-19T14:56:17.030Z]     Found by: stack scanning
[task 2021-04-19T14:56:17.030Z] 26  js!_GLOBAL__sub_I_Unified_cpp_js_src_wasm3.cpp [WasmValidate.cpp : 3566 + 0xaf]
[task 2021-04-19T14:56:17.030Z]     rsp = 0x00007fffffffd7c8   rip = 0x000055555572321f
[task 2021-04-19T14:56:17.030Z]     Found by: stack scanning
[task 2021-04-19T14:56:17.031Z] 27  js!_start + 0x29
[task 2021-04-19T14:56:17.031Z]     rsp = 0x00007fffffffd7e0   rip = 0x0000555555723248
[task 2021-04-19T14:56:17.031Z]     Found by: stack scanning```
Crash Signature: [@ js::jit::MAssertRecoveredOnBailout::writeRecoverData(js::jit::CompactBufferWriter&) const] → [@ Crash(JSContext*, unsigned int, JS::Value*)] [@ js::jit::MAssertRecoveredOnBailout::writeRecoverData(js::jit::CompactBufferWriter&) const]

Steve, could you look at this bug since it might be related to your bug fix for bug 1697929

Flags: needinfo?(sphink)

Thanks for filing. I have seen similar things happen on numerous occasions with the old setup as well. Last time I tried to dig into it, they stopped happening when I changed some seemingly unrelated stuff. I guess it must just be intermittent?

Anyway, I don't think the issue is new. It's still serious.

See Also: → 1718823
See Also: → 1718819
You need to log in before you can comment on or make changes to this bug.