Closed Bug 1711769 Opened 2 years ago Closed 2 years ago

Nightly hang on tab close

Categories

(Core :: Layout, defect)

Product:
Core
Component:
Layout
Type:
defect

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1713170

People

(Reporter: jgraham, Unassigned)

References

Details

Attachments

(1 file)

gdb.log
271.04 KB, text/plain
Details

I've been seeing an intermittent hang, which I think is triggered by a tab close (but I'm not certain; at least the tab bar seems to end up in an intermediate state like it's half way through running an animation). The main thread trace at the time of the hang is:

#2  0x00007fecdbdad4e8 in __new_sem_wait_slow (sem=0x7fecc9185580, abstime=0x0, clockid=0) at sem_waitcommon.c:184
#3  0x00007fecd2e4ca6a in SigprofHandler(int, siginfo_t*, void*) () at /home/jgraham/local/firefox/libxul.so
#4  0x00007fecdbdaf3c0 in <signal handler called> () at /lib/x86_64-linux-gnu/libpthread.so.0
#5  0x0000560f835b821e in arena_t::DallocSmall(arena_chunk_t*, void*, arena_chunk_map_t*) ()
#6  0x0000560f835b618c in free ()
#7  0x00007fecd456adc2 in Gecko_Destroy_nsStyleMargin () at /home/jgraham/local/firefox/libxul.so
#8  0x00007fecd5c4c343 in servo_arc::Arc<T>::drop_slow () at /home/jgraham/local/firefox/libxul.so
#9  0x00007fecd4bec084 in _ZN9servo_arc12Arc$LT$T$GT$9drop_slow17hbca94886b7154198E.llvm.7279804915577430383 () at /home/jgraham/local/firefox/libxul.so
#10 0x00007fecd4c0cf27 in Servo_ComputedStyle_Release () at /home/jgraham/local/firefox/libxul.so
#11 0x00007fecd459fc97 in mozilla::RestyleManager::ProcessPostTraversal(mozilla::dom::Element*, mozilla::ServoRestyleState&, mozilla::ServoPostTraversalFlags) () at /home/jgraham/local/firefox/libxul.so
#12 0x00007fecd459fde2 in mozilla::RestyleManager::ProcessPostTraversal(mozilla::dom::Element*, mozilla::ServoRestyleState&, mozilla::ServoPostTraversalFlags) () at /home/jgraham/local/firefox/libxul.so
#13 0x00007fecd459fde2 in mozilla::RestyleManager::ProcessPostTraversal(mozilla::dom::Element*, mozilla::ServoRestyleState&, mozilla::ServoPostTraversalFlags) () at /home/jgraham/local/firefox/libxul.so
#14 0x00007fecd459fde2 in mozilla::RestyleManager::ProcessPostTraversal(mozilla::dom::Element*, mozilla::ServoRestyleState&, mozilla::ServoPostTraversalFlags) () at /home/jgraham/local/firefox/libxul.so
#15 0x00007fecd459fde2 in mozilla::RestyleManager::ProcessPostTraversal(mozilla::dom::Element*, mozilla::ServoRestyleState&, mozilla::ServoPostTraversalFlags) () at /home/jgraham/local/firefox/libxul.so
#16 0x00007fecd459fde2 in mozilla::RestyleManager::ProcessPostTraversal(mozilla::dom::Element*, mozilla::ServoRestyleState&, mozilla::ServoPostTraversalFlags) () at /home/jgraham/local/firefox/libxul.so
#17 0x00007fecd459fde2 in mozilla::RestyleManager::ProcessPostTraversal(mozilla::dom::Element*, mozilla::ServoRestyleState&, mozilla::ServoPostTraversalFlags) () at /home/jgraham/local/firefox/libxul.so
#18 0x00007fecd459fde2 in mozilla::RestyleManager::ProcessPostTraversal(mozilla::dom::Element*, mozilla::ServoRestyleState&, mozilla::ServoPostTraversalFlags) () at /home/jgraham/local/firefox/libxul.so
#19 0x00007fecd459fde2 in mozilla::RestyleManager::ProcessPostTraversal(mozilla::dom::Element*, mozilla::ServoRestyleState&, mozilla::ServoPostTraversalFlags) () at /home/jgraham/local/firefox/libxul.so
#20 0x00007fecd459fde2 in mozilla::RestyleManager::ProcessPostTraversal(mozilla::dom::Element*, mozilla::ServoRestyleState&, mozilla::ServoPostTraversalFlags) () at /home/jgraham/local/firefox/libxul.so
#21 0x00007fecd459fde2 in mozilla::RestyleManager::ProcessPostTraversal(mozilla::dom::Element*, mozilla::ServoRestyleState&, mozilla::ServoPostTraversalFlags) () at /home/jgraham/local/firefox/libxul.so
#22 0x00007fecd459fde2 in mozilla::RestyleManager::ProcessPostTraversal(mozilla::dom::Element*, mozilla::ServoRestyleState&, mozilla::ServoPostTraversalFlags) () at /home/jgraham/local/firefox/libxul.so
#23 0x00007fecd459fde2 in mozilla::RestyleManager::ProcessPostTraversal(mozilla::dom::Element*, mozilla::ServoRestyleState&, mozilla::ServoPostTraversalFlags) () at /home/jgraham/local/firefox/libxul.so
#24 0x00007fecd459fde2 in mozilla::RestyleManager::ProcessPostTraversal(mozilla::dom::Element*, mozilla::ServoRestyleState&, mozilla::ServoPostTraversalFlags) () at /home/jgraham/local/firefox/libxul.so
#25 0x00007fecd459fde2 in mozilla::RestyleManager::ProcessPostTraversal(mozilla::dom::Element*, mozilla::ServoRestyleState&, mozilla::ServoPostTraversalFlags) () at /home/jgraham/local/firefox/libxul.so
#26 0x00007fecd459fde2 in mozilla::RestyleManager::ProcessPostTraversal(mozilla::dom::Element*, mozilla::ServoRestyleState&, mozilla::ServoPostTraversalFlags) () at /home/jgraham/local/firefox/libxul.so
#27 0x00007fecd459fde2 in mozilla::RestyleManager::ProcessPostTraversal(mozilla::dom::Element*, mozilla::ServoRestyleState&, mozilla::ServoPostTraversalFlags) () at /home/jgraham/local/firefox/libxul.so
#28 0x00007fecd45a2935 in mozilla::RestyleManager::DoProcessPendingRestyles(mozilla::ServoTraversalFlags) () at /home/jgraham/local/firefox/libxul.so
#29 0x00007fecd45967da in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) () at /home/jgraham/local/firefox/libxul.so
#30 0x00007fecd442d26f in mozilla::dom::Document::FlushPendingNotifications(mozilla::ChangesToFlush) () at /home/jgraham/local/firefox/libxul.so
#31 0x00007fecd55b022c in mozilla::PresShell::ScrollContentIntoView(nsIContent*, mozilla::ScrollAxis, mozilla::ScrollAxis, mozilla::ScrollFlags) () at /home/jgraham/local/firefox/libxul.so
#32 0x00007fecd11289b9 in mozilla::dom::Element::ScrollIntoView(mozilla::dom::ScrollIntoViewOptions const&) () at /home/jgraham/local/firefox/libxul.so
#33 0x00007fecd11288d1 in mozilla::dom::Element::ScrollIntoView(mozilla::dom::BooleanOrScrollIntoViewOptions const&) () at /home/jgraham/local/firefox/libxul.so
#34 0x00007fecd18070d3 in mozilla::dom::Element_Binding::scrollIntoView(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) () at /home/jgraham/local/firefox/libxul.so
#35 0x00007fecd44d03c9 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) () at /home/jgraham/local/firefox/libxul.so
#36 0x0000139dcb472542 in  ()
#37 0x0000000000000000 in  ()

Which looks a little like the crash in bug 1634144

If it happens again I can try to gather some more useful information, if there's anything that would help.

How often do you see it? (Multiple times per week/day/...?)

emilio, does this sound familiar, and do you have any theories about what might be going on? And is there anything that might be useful for jgraham to capture the next time this happens?

Flags: needinfo?(emilio)

(ni=jgraham for the first part of comment 1)

Flags: needinfo?(james)

Maybe around weekly? I think it happened twice on the day I filed this, but there were a couple of instances that were probably the same thing before, and at least one since.

Flags: needinfo?(james)

That stack off-hand seems normal... I wonder if we end up doing a massive restyle somehow, and what causes it... A profile would provide the cause stack for what triggered the restyle at least.

Flags: needinfo?(emilio)

This has happened a couple of times again. I'm not sure if I can capture a profile given it happens at "random", and I end up having to kill the whole browser process?

(In reply to James Graham [:jgraham] from comment #5)

This has happened a couple of times again. I'm not sure if I can capture a profile given it happens at "random", and I end up having to kill the whole browser process?

When it happens, can you get a full backtrace of all threads? Also see if it's running code or is somehow locked up in jemalloc?

Flags: needinfo?(james)

I'm seeing t hangs quite regularly. I have attached stack traces of all threads in bug 1711582 comment 1

Attached file gdb.log —

Attached the backtraces from all main process threads.

Flags: needinfo?(james)
See Also: → 1711582
Attachment #9227767 - Attachment mime type: text/x-log → text/plain

So something I had not realized is that this is somehow on a SIGPROF signal handler. Seems this signal is delivered from the profiler code, and it gets delivered during free() while an allocator lock is held. Meanwhile, the profiler code tries to allocate something and presumably deadlocks:

Thread 9 (Thread 0x7f55d51be700 (LWP 178899)):
#0  __lll_lock_wait (futex=futex@entry=0x7f55e7b00020, private=0) at lowlevellock.c:52
#1  0x00007f55e81ed235 in __GI___pthread_mutex_lock (mutex=0x7f55e7b00020) at ../nptl/pthread_mutex_lock.c:135
#2  0x000055d34db48063 in BaseAllocator::malloc(unsigned long) ()
#3  0x000055d34db44cc0 in malloc ()
#4  0x00007f55e0e6910c in nsTSubstring<char>::SetLength(unsigned int) () at /home/jgraham/local/firefox/libxul.so
#5  0x00007f55e23358d1 in mozilla::ThreadStackHelper::CollectProfilingStackFrame(js::ProfilingStackFrame const&) () at /home/jgraham/local/firefox/libxul.so
#6  0x00007f55e2314703 in MergeStacks(unsigned int, bool, RegisteredThread const&, Registers const&, NativeStack const&, ProfilerStackCollector&, JS::ProfilingFrameIterator::Frame*, unsigned int) () at /home/jgraham/local/firefox/libxul.so
#7  0x00007f55dfa03897 in profiler_suspend_and_sample_thread(int, unsigned int, ProfilerStackCollector&, bool) () at /home/jgraham/local/firefox/libxul.so
#8  0x00007f55dfaae3f5 in mozilla::ThreadStackHelper::GetStack(mozilla::HangStack&, nsTSubstring<char>&, bool) () at /home/jgraham/local/firefox/libxul.so
#9  0x00007f55e233473f in mozilla::BackgroundHangManager::MonitorThread(void*) () at /home/jgraham/local/firefox/libxul.so
#10 0x00007f55e79e4acd in _pt_root () at /home/jgraham/local/firefox/libnspr4.so
#11 0x00007f55e81ea609 in start_thread (arg=<optimised out>) at pthread_create.c:477
#12 0x00007f55e7dc0293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Gerald, does this ring a bell?

Flags: needinfo?(gsquelart)

Now the question is why does this happen usually with the restyle code. Is it just because it is a common source of long restyles? Or is it something deeper?

The stacks in https://bugzilla.mozilla.org/show_bug.cgi?id=1711582#c1 are in malloc() rather than free, fwiw.

Let's unify these with bug 1713170, which has an assignee.

Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → DUPLICATE

Filed bug 1717386; I'll comment further in bug 1713170.

Flags: needinfo?(gsquelart)
You need to log in before you can comment on or make changes to this bug.