Last Comment Bug 517298 - jsreftest|browser failures - js1_5/GC/regress-203278-2.js | js1_5/Regress/regress-203278-1.js | js1_8/regress/regress-471373.js
: jsreftest|browser failures - js1_5/GC/regress-203278-2.js | js1_5/Regress/reg...
Status: RESOLVED FIXED
: crash, regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86 Mac OS X
: -- normal (vote)
: mozilla11
Assigned To: Ryan VanderMeulen [:RyanVM]
:
Mentors:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2009-09-17 13:09 PDT by Bob Clary [:bc:]
Modified: 2011-12-01 05:55 PST (History)
5 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
patch (1.51 KB, patch)
2011-11-16 02:45 PST, Bob Clary [:bc:]
no flags Details | Diff | Splinter Review
Re-enable tests (2.26 KB, patch)
2011-11-27 17:34 PST, Ryan VanderMeulen [:RyanVM]
bob: review+
Details | Diff | Splinter Review

Description Bob Clary [:bc:] 2009-09-17 13:09:03 PDT
Running jsreftests I found recent regressions in the browser on tracemonkey. These all passed on 1.9.1 and until the last day or so on tracemonkey.

http://test.bclary.com/tests/mozilla.org/js/js-test-driver-standards.html?language=type;text/javascript;test=js1_5/GC/regress-203278-2.js

http://test.bclary.com/tests/mozilla.org/js/js-test-driver-standards.html?language=type;text/javascript;test=js1_5/Regress/regress-203278-1.js

http://test.bclary.com/tests/mozilla.org/js/js-test-driver-standards.html?language=type;text/javascript;test=js1_8/regress/regress-471373.js

js1_5/GC/regress-203278-2.js | timed out waiting for reftest-wait to be removed (after onload fired)

js1_5/Regress/regress-203278-1.js | timed out waiting for reftest-wait to be removed (after onload fired)

js1_8/regress/regress-471373.js | No test results reported. (SCRIPT)

loading 
http://test.bclary.com/tests/mozilla.org/js/js-test-driver-standards.html?language=type;text/javascript;test=js1_5/GC/regress-203278-2.js

crashed mozilla-central @ [JS_SetPrivate]
bp-e13c0a66-c03d-4602-9a4e-00e412090917

Not sure all these failures are the same bug, but dumping them here for the moment.
Comment 1 David Mandelin [:dmandelin] 2009-09-18 17:25:13 PDT
Thanks. I just reran these 3 tests in a debug tinderbox build as of today (7e985a173416), and they seem to pass now. I know there was a shell regression or two recently as well. Maybe those or other fixes took care of these.

BUGNUMBER: 203278 
STATUS: Don't crash in recursive js_MarkGCThing 
STATUS: DSF is prepared 
STATUS: Linked list is prepared 
 PASSED! Don't crash in recursive js_MarkGCThing 

jstest: js1_5/GC/regress-203278-2.js bug:  result: PASSED type: browser description: Don't crash in recursive js_MarkGCThing reason: 
--DOMWINDOW == 10 (0x14a8f190) [serial = 14] [outer = 0x145796f0] [url = http://www.mozilla.org/projects/firefox/prerelease.html]
2009-09-18 17:22:58.545 firefox-bin[22955:10b] Looked for URLs on the pasteboard, but found none.
++DOMWINDOW == 11 (0x169312f0) [serial = 16] [outer = 0x145796f0]
BUGNUMBER: 203278 
STATUS: Don't crash in recursive js_MarkGCThing 
 PASSED! Don't crash in recursive js_MarkGCThing 

jstest: js1_5/Regress/regress-203278-1.js bug:  result: PASSED type: browser description: Don't crash in recursive js_MarkGCThing reason: 
2009-09-18 17:23:10.410 firefox-bin[22955:10b] Looked for URLs on the pasteboard, but found none.
++DOMWINDOW == 12 (0x22fee800) [serial = 17] [outer = 0x145796f0]
BUGNUMBER: 471373 
STATUS: TM: do not assert: (size_t)(regs.pc - script->code) < script->length 
 PASSED! TM: do not assert: (size_t)(regs.pc - script->code) < script->length 

jstest: js1_8/regress/regress-471373.js bug:  result: PASSED type: browser description: TM: do not assert: (size_t)(regs.pc - script->code) < script->length reason:
Comment 2 Sheila Mooney 2011-11-15 09:56:32 PST
Dmandelin, bob, is this bug still valid? If not can we close it?
Comment 3 Bob Clary [:bc:] 2011-11-16 02:45:38 PST
Created attachment 574856 [details] [diff] [review]
patch

js1_5/GC/regress-203278-2.js is marked skipped for browser on mac os x.
js1_5/Regress/regress-203278-1.js is marked skipped for everyone.
js1_8/regress/regress-471373.js is marked skip on Android.

I tested this patch which enables 203278-{1,2} locally for a debug build on mozilla-central for Mac OS X 10.5 with 4G and they passed. I'm not sure if the slow should have been removed or not. I can run it against try in the next couple of days and see how it fares unless dmandelin wants to do something else.
Comment 4 Mozilla RelEng Bot 2011-11-27 17:10:23 PST
Try run for 581abd319c12 is complete.
Detailed breakdown of the results available here:
    https://tbpl.mozilla.org/?tree=Try&rev=581abd319c12
Results (out of 30 total builds):
    success: 28
    warnings: 1
    failure: 1
Builds available at http://ftp.mozilla.org/pub/mozilla.org/firefox/try-builds/ryanvm@gmail.com-581abd319c12
Comment 5 Ryan VanderMeulen [:RyanVM] 2011-11-27 17:34:17 PST
Created attachment 577175 [details] [diff] [review]
Re-enable tests

Looks like they passed OK on all platforms. The Android J3 fail appears to be a problem that occurs on unpatched m-c as well.
Comment 6 Mozilla RelEng Bot 2011-11-27 18:40:21 PST
Try run for bb9dd1ff3610 is complete.
Detailed breakdown of the results available here:
    https://tbpl.mozilla.org/?tree=Try&rev=bb9dd1ff3610
Results (out of 61 total builds):
    success: 60
    failure: 1
Builds available at http://ftp.mozilla.org/pub/mozilla.org/firefox/try-builds/ryanvm@gmail.com-bb9dd1ff3610
Comment 7 Bob Clary [:bc:] 2011-11-28 03:35:31 PST
Try run for 581abd319c12 from comment 4 did not complete. Can you rerun it?
Try run for bb9dd1ff3610 from comment 6 is not for this patch. 

jmaher: can you also check this out on Android?
Comment 8 Ryan VanderMeulen [:RyanVM] 2011-11-28 15:35:53 PST
dholbert retriggered the J3 job and it was green. I've pushed it to try again just for good measure.
Comment 9 Mozilla RelEng Bot 2011-11-28 19:40:24 PST
Try run for a037bc0b2582 is complete.
Detailed breakdown of the results available here:
    https://tbpl.mozilla.org/?tree=Try&rev=a037bc0b2582
Results (out of 33 total builds):
    success: 31
    warnings: 1
    failure: 1
Builds available at http://ftp.mozilla.org/pub/mozilla.org/firefox/try-builds/ryanvm@gmail.com-a037bc0b2582
Comment 10 Bob Clary [:bc:] 2011-11-29 04:39:33 PST
Comment on attachment 577175 [details] [diff] [review]
Re-enable tests

r+. Looks good. Please keep an eye out for random oranges and disable the offenders if needed.
Comment 12 :Ms2ger 2011-11-30 06:27:13 PST
regress-203278-1.js just hit three assertions:

https://tbpl.mozilla.org/php/getParsedLog.php?id=7658314&tree=Mozilla-Inbound
Comment 13 Ryan VanderMeulen [:RyanVM] 2011-11-30 07:04:00 PST
###!!! ASSERTION: null frame: 'aFrame', file e:/builds/moz2_slave/m-in-w32-dbg/build/layout/base/nsPresShell.cpp, line 5726 is the assert being fired. How would a GC test trigger this?
Comment 14 Bob Clary [:bc:] 2011-11-30 16:48:46 PST
I would imagine there is a bug that is only exercised when there is heavy memory pressure which is essentially what these tests do. This looks very much like bug 706284
Comment 15 Ryan VanderMeulen [:RyanVM] 2011-12-01 05:55:02 PST
http://hg.mozilla.org/mozilla-central/rev/b12dd7f965d0

Note You need to log in before you can comment on or make changes to this bug.