503840 - Crash after update to Weave 0.5pre1 only with History sync enabled [@ SetProperty_tn]

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect, P2)

Description

[Aiing]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.1; en-GB; rv:1.9.1) Gecko/20090624 Firefox/3.5 (.NET CLR 3.5.30729)
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-GB; rv:1.9.1) Gecko/20090624 Firefox/3.5 (.NET CLR 3.5.30729) ID:20090624025744

After update to Weave version 0.5pre1 Firefox iscontinually crashing during sync only when History sync is enabled.

With History sync is disabled no crash occours

Crash IDs:
aafadd2b-5802-4f00-a477-ecbc92090713
a44daf37-0609-47ca-8917-8cf1b2090713
827996f1-758a-424e-9065-4b11d2090713

Firefox 3.5
Windows 7 x64

Addons:
Adblock Plus 1.0.2
ColorfulTabs 3.9.2
Java Console 6.0.14
Microsoft .NET Framework Assistant 1.1
Nightly Tester Tools 2.0.2
NoScript 1.9.5
Personas for Firefox 1.2.1
QuickProxy 2009.03.28
Tweak Network 1.3
Weave 0.5pre1


Versone log at time of crash
2009-07-13 11:12:48	Service.Main         INFO	Weave 0.5pre1 initializing <-- Restart after crash here.

2009-07-13 11:12:42	Store.HistStore      TRACE	Creating SQL statement: _visitStm

2009-07-13 11:12:42	Store.HistStore      TRACE	Creating SQL statement: _pidStm

2009-07-13 11:12:42	Store.HistStore      TRACE	Creating SQL statement: _urlStm

2009-07-13 11:12:42	Store.HistStore      TRACE	Creating SQL statement: _findPidByAnnoStm

2009-07-13 11:12:42	Store.HistStore      TRACE	Creating SQL statement: _annoAttrIdStm

2009-07-13 11:12:42	Engine.History       DEBUG	Preparing 100 outgoing records

Reproducible: Always

Steps to Reproduce:
1. Update Weave to 0.5pre1
2. Enable History Sync
3. Perform a Sync
4. Crash

Comment 1

[timeless]

Signature	SetProperty_tn
UUID	aafadd2b-5802-4f00-a477-ecbc92090713
Time 	2009-07-13 02:44:34.335968
Uptime	39
Last Crash	115 seconds before submission
Product	Firefox
Version	3.5
Build ID	20090624025744
Branch	1.9.1
OS	Windows NT
OS Version	6.1.7201
CPU	x86
CPU Info	GenuineIntel family 6 model 15 stepping 11
Crash Reason	EXCEPTION_ACCESS_VIOLATION
Crash Address	0x2
User Comments	
Processor Notes 	
Related Bugs

OPEN

        * 499610 NEW TM: Crash during local mochitest-browser-chrome run [@ SetProperty_tn]

Crashing Thread
Frame 	Module 	Signature [Expand] 	Source
0 	js3250.dll 	SetProperty_tn 	js/src/jstracer.cpp:8351
1 		@0x4c94e9e 	
2 		@0x19d6fb 	
3 	js3250.dll 	js_MonitorLoopEdge 	js/src/jstracer.cpp:4862
4 	js3250.dll 	js_Interpret 	js/src/jsinterp.cpp:3308

Comment 2

[Ed Lee :Mardak]

I'm assuming you have jit.chrome set to true? Try toggling that off and turn history sync back on?

Comment 3

[Aiing]

Yes I had jit.chrome set to true.

I turned it off and reenabled history sync and no crash.

Comment 4

[Ed Lee :Mardak]

Aiing: Did you have Weave 0.4 installed with jit.chrome=true and that didn't crash?

Comment 5

[Aiing]

Yes. I have had jit.chrome=true for some time and I was on 0.4 before upgrading to 0.5pre1.

Comment 6

[Aiing]

Sorry, to clariry - Before upgrading I was not getting constant crashes like I was after upgrading to 0.5pre1.

Comment 7

[Ed Lee :Mardak]

I'm not sure if this is the same crash, but Fennec has jit.chrome default true, so the latest Weave is causing Fennec to crash. I don't have the stack from a maemo build (all it says is Segmentation Fault), but running Fennec on OS X:

0 TypeMap::matches(TypeMap&) const + 928
1 0 + 350105421
2 0 + 3221208456
3 js_MonitorLoopEdge(JSContext*, unsigned int&) + 832
4 jsInterpret + 44470
5 jsInvoke + 1723
6 js_fun_call + 391
7 js_Interpret + 37353
8 js_Invoke + 1723
9 js_fun_call + 391

Viewing just the weave verbose log, I see a number of these before crashing:
2009-07-15 15:18:12	Store.HistStore      DEBUG	     visit 1247696186652913

Some crashes show 17 of those entries.. other times it's 12 entries.

But the weave code that prints those out:
let visit;
while ((visit = record.visits.pop())) {
  if (curvisits.filter(function(i) i.date == visit.date).length)
    continue;
  this._log.debug("     visit " + visit.date);                                 
  this._hsvc.addVisit(uri, visit.date, null, visit.type,                       
                      (visit.type == 5 || visit.type == 6), 0);                
}

Comment 8

[Ed Lee :Mardak]

The crash from comment 7 is different from this bug I believe..

Here's a crash report from os x:
http://crash-stats.mozilla.com/report/index/9cde1dfd-df99-430e-af72-7458c2090716?p=1

I triggered it while *uploading* history items. The previous comment was triggering crashes while downloading items on Fennec.

Any way to know for sure what js functions were being called before the crash?

When I turn on "Trace level" logging for weave, I see 3 "Outgoing:" messages before the crash, so it's probably this loop

  _uploadOutgoing: function SyncEngine__uploadOutgoing() {
..
      for (let id in this._tracker.changedIDs) {
        let out = this._createRecord(id);
        this._log.trace("Outgoing:\n" + out);
        // skip getting siblings of already processed and deleted records
        if (!out.deleted && !(out.id in meta))
          this._store.createMetaRecords(out.id, meta);
        out.encrypt(ID.get("WeaveCryptoID"));
        up.pushData(JSON.parse(out.serialize())); // FIXME: inefficient
        Sync.sleep(0);
      }

I'll try reducing this.. tips? debug firefox build?

Comment 9

[Ed Lee :Mardak]

Oh hey! It's already been fixed on 1.9.1 and m-c. Somewhere here:

http://hg.mozilla.org/releases/mozilla-1.9.1/pushloghtml?fromchange=f223409207c0&tochange=b91c9ee69e6e

I would guess it's something aborting the trace now.. ?

Bug 499772  - TM: TraceRecorder::test_property_cache needs JSClass.getProperty checks when a property isn't found on an object. r=jorendorff, r=brendan 

Deep abort is not detected in JSOP_IN (500108, r=dvander).

Comment 10

[Damon Sicore (:damons)]

Assigning to dvander.

Comment 11

[Robert Sayre]

dvander, we need to make some progress here.

Comment 12

[Robert Sayre]

looks like this is WFM