Last Comment Bug 517298 - jsreftest|browser failures - js1_5/GC/regress-203278-2.js | js1_5/Regress/regress-203278-1.js | js1_8/regress/regress-471373.js
: jsreftest|browser failures - js1_5/GC/regress-203278-2.js | js1_5/Regress/reg...
Status: RESOLVED FIXED
: crash, regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86 Mac OS X
: -- normal (vote)
: mozilla11
Assigned To: Ryan VanderMeulen [:RyanVM]
:
: Jason Orendorff [:jorendorff]
Mentors:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2009-09-17 13:09 PDT by Bob Clary [:bc:]
Modified: 2011-12-01 05:55 PST (History)
5 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
patch (1.51 KB, patch)
2011-11-16 02:45 PST, Bob Clary [:bc:]
no flags Details | Diff | Splinter Review
Re-enable tests (2.26 KB, patch)
2011-11-27 17:34 PST, Ryan VanderMeulen [:RyanVM]
bob: review+
Details | Diff | Splinter Review

Description User image Bob Clary [:bc:] 2009-09-17 13:09:03 PDT
Running jsreftests I found recent regressions in the browser on tracemonkey. These all passed on 1.9.1 and until the last day or so on tracemonkey.

http://test.bclary.com/tests/mozilla.org/js/js-test-driver-standards.html?language=type;text/javascript;test=js1_5/GC/regress-203278-2.js

http://test.bclary.com/tests/mozilla.org/js/js-test-driver-standards.html?language=type;text/javascript;test=js1_5/Regress/regress-203278-1.js

http://test.bclary.com/tests/mozilla.org/js/js-test-driver-standards.html?language=type;text/javascript;test=js1_8/regress/regress-471373.js

js1_5/GC/regress-203278-2.js | timed out waiting for reftest-wait to be removed (after onload fired)

js1_5/Regress/regress-203278-1.js | timed out waiting for reftest-wait to be removed (after onload fired)

js1_8/regress/regress-471373.js | No test results reported. (SCRIPT)

loading 
http://test.bclary.com/tests/mozilla.org/js/js-test-driver-standards.html?language=type;text/javascript;test=js1_5/GC/regress-203278-2.js

crashed mozilla-central @ [JS_SetPrivate]
bp-e13c0a66-c03d-4602-9a4e-00e412090917

Not sure all these failures are the same bug, but dumping them here for the moment.
Comment 1 User image David Mandelin [:dmandelin] 2009-09-18 17:25:13 PDT
Thanks. I just reran these 3 tests in a debug tinderbox build as of today (7e985a173416), and they seem to pass now. I know there was a shell regression or two recently as well. Maybe those or other fixes took care of these.

BUGNUMBER: 203278 
STATUS: Don't crash in recursive js_MarkGCThing 
STATUS: DSF is prepared 
STATUS: Linked list is prepared 
 PASSED! Don't crash in recursive js_MarkGCThing 

jstest: js1_5/GC/regress-203278-2.js bug:  result: PASSED type: browser description: Don't crash in recursive js_MarkGCThing reason: 
--DOMWINDOW == 10 (0x14a8f190) [serial = 14] [outer = 0x145796f0] [url = http://www.mozilla.org/projects/firefox/prerelease.html]
2009-09-18 17:22:58.545 firefox-bin[22955:10b] Looked for URLs on the pasteboard, but found none.
++DOMWINDOW == 11 (0x169312f0) [serial = 16] [outer = 0x145796f0]
BUGNUMBER: 203278 
STATUS: Don't crash in recursive js_MarkGCThing 
 PASSED! Don't crash in recursive js_MarkGCThing 

jstest: js1_5/Regress/regress-203278-1.js bug:  result: PASSED type: browser description: Don't crash in recursive js_MarkGCThing reason: 
2009-09-18 17:23:10.410 firefox-bin[22955:10b] Looked for URLs on the pasteboard, but found none.
++DOMWINDOW == 12 (0x22fee800) [serial = 17] [outer = 0x145796f0]
BUGNUMBER: 471373 
STATUS: TM: do not assert: (size_t)(regs.pc - script->code) < script->length 
 PASSED! TM: do not assert: (size_t)(regs.pc - script->code) < script->length 

jstest: js1_8/regress/regress-471373.js bug:  result: PASSED type: browser description: TM: do not assert: (size_t)(regs.pc - script->code) < script->length reason:
Comment 2 User image Sheila Mooney 2011-11-15 09:56:32 PST
Dmandelin, bob, is this bug still valid? If not can we close it?
Comment 3 User image Bob Clary [:bc:] 2011-11-16 02:45:38 PST
Created attachment 574856 [details] [diff] [review]
patch

js1_5/GC/regress-203278-2.js is marked skipped for browser on mac os x.
js1_5/Regress/regress-203278-1.js is marked skipped for everyone.
js1_8/regress/regress-471373.js is marked skip on Android.

I tested this patch which enables 203278-{1,2} locally for a debug build on mozilla-central for Mac OS X 10.5 with 4G and they passed. I'm not sure if the slow should have been removed or not. I can run it against try in the next couple of days and see how it fares unless dmandelin wants to do something else.
Comment 4 User image Mozilla RelEng Bot 2011-11-27 17:10:23 PST
Try run for 581abd319c12 is complete.
Detailed breakdown of the results available here:
    https://tbpl.mozilla.org/?tree=Try&rev=581abd319c12
Results (out of 30 total builds):
    success: 28
    warnings: 1
    failure: 1
Builds available at http://ftp.mozilla.org/pub/mozilla.org/firefox/try-builds/ryanvm@gmail.com-581abd319c12
Comment 5 User image Ryan VanderMeulen [:RyanVM] 2011-11-27 17:34:17 PST
Created attachment 577175 [details] [diff] [review]
Re-enable tests

Looks like they passed OK on all platforms. The Android J3 fail appears to be a problem that occurs on unpatched m-c as well.
Comment 6 User image Mozilla RelEng Bot 2011-11-27 18:40:21 PST
Try run for bb9dd1ff3610 is complete.
Detailed breakdown of the results available here:
    https://tbpl.mozilla.org/?tree=Try&rev=bb9dd1ff3610
Results (out of 61 total builds):
    success: 60
    failure: 1
Builds available at http://ftp.mozilla.org/pub/mozilla.org/firefox/try-builds/ryanvm@gmail.com-bb9dd1ff3610
Comment 7 User image Bob Clary [:bc:] 2011-11-28 03:35:31 PST
Try run for 581abd319c12 from comment 4 did not complete. Can you rerun it?
Try run for bb9dd1ff3610 from comment 6 is not for this patch. 

jmaher: can you also check this out on Android?
Comment 8 User image Ryan VanderMeulen [:RyanVM] 2011-11-28 15:35:53 PST
dholbert retriggered the J3 job and it was green. I've pushed it to try again just for good measure.
Comment 9 User image Mozilla RelEng Bot 2011-11-28 19:40:24 PST
Try run for a037bc0b2582 is complete.
Detailed breakdown of the results available here:
    https://tbpl.mozilla.org/?tree=Try&rev=a037bc0b2582
Results (out of 33 total builds):
    success: 31
    warnings: 1
    failure: 1
Builds available at http://ftp.mozilla.org/pub/mozilla.org/firefox/try-builds/ryanvm@gmail.com-a037bc0b2582
Comment 10 User image Bob Clary [:bc:] 2011-11-29 04:39:33 PST
Comment on attachment 577175 [details] [diff] [review]
Re-enable tests

r+. Looks good. Please keep an eye out for random oranges and disable the offenders if needed.
Comment 12 User image :Ms2ger (⌚ UTC+1/+2) 2011-11-30 06:27:13 PST
regress-203278-1.js just hit three assertions:

https://tbpl.mozilla.org/php/getParsedLog.php?id=7658314&tree=Mozilla-Inbound
Comment 13 User image Ryan VanderMeulen [:RyanVM] 2011-11-30 07:04:00 PST
###!!! ASSERTION: null frame: 'aFrame', file e:/builds/moz2_slave/m-in-w32-dbg/build/layout/base/nsPresShell.cpp, line 5726 is the assert being fired. How would a GC test trigger this?
Comment 14 User image Bob Clary [:bc:] 2011-11-30 16:48:46 PST
I would imagine there is a bug that is only exercised when there is heavy memory pressure which is essentially what these tests do. This looks very much like bug 706284
Comment 15 User image Ryan VanderMeulen [:RyanVM] 2011-12-01 05:55:02 PST
http://hg.mozilla.org/mozilla-central/rev/b12dd7f965d0

Note You need to log in before you can comment on or make changes to this bug.