Last Comment Bug 644047 - Hang [@ js::Interpret ]
: Hang [@ js::Interpret ]
Status: RESOLVED FIXED
: hang
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86_64 Linux
: -- critical (vote)
: ---
Assigned To: general
:
: Jason Orendorff [:jorendorff]
Mentors:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2011-03-22 20:13 PDT by Mats Palmgren (:mats)
Modified: 2012-01-26 15:24 PST (History)
4 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
stack (15.31 KB, text/plain)
2011-03-22 20:13 PDT, Mats Palmgren (:mats)
no flags Details
bt full (48.81 KB, text/plain)
2011-03-22 20:23 PDT, Mats Palmgren (:mats)
no flags Details

Description Mats Palmgren (:mats) 2011-03-22 20:13:53 PDT
Created attachment 521108 [details]
stack

I have this hang caught in GDB right now if anyone wants
debug data.  Please let me know what data you want from it.
I'll terminate the session in an hour.

It never returns from frame #25 js::Interpret
which repeatedly calls js::MonitorLoopEdge, the return value
from that function is js::MONITOR_NOT_RECORDING every time
it seems.  The file name in frame 26 is
"chrome://browser/content/browser.xul"

It's a nightly Linux x86-64 build, I have downloaded symbols for it.
Mozilla/5.0 (X11; Linux x86_64; rv:2.0b13pre) Gecko/20110316 Firefox/4.0b13pre

I think the JS Engine should be the same as in 4.0 final.
Comment 1 Mats Palmgren (:mats) 2011-03-22 20:23:33 PDT
Created attachment 521109 [details]
bt full
Comment 2 Alice0775 White 2012-01-24 23:10:06 PST
bp-a521de5d-ca63-4e0f-964d-1a3ea2120125
bp-218db58b-7305-4c53-8322-9a87f2120125

http://hg.mozilla.org/releases/mozilla-beta/rev/52b82032a40b
Mozilla/5.0 (X11; Linux i686; rv:10.0) Gecko/20100101 Firefox/10.0

STR (slow PC is required)
1. Open more than 2 tab and https://developer.mozilla.org/en-US/demos/detail/javascript-ray-tracer
2. Click "LAUNCH DEMO" red button
3. Click "single_light" (at 2nd row/5th column)
4. Click "Ray Trace!" blue button
5. Close this tab  just before slow script dialog pops up (15-20second)
6. Wait until the tab is completely closed
7. Slow script dialog will pops up, click Stop
8. Repeat step3 to step7 if browser does not crash.

Actual result
  Browser crashes w/ crash report
Comment 3 David Mandelin [:dmandelin] 2012-01-25 18:30:03 PST
Looks like some sort of web-worker-related bustage.
Comment 4 Ben Turner (not reading bugmail, use the needinfo flag!) 2012-01-26 01:48:03 PST
(In reply to David Mandelin from comment #3)
> Looks like some sort of web-worker-related bustage.

Hm, I don't see any worker stuff in the stacks... Looks like all main-thread-only stuff.
Comment 5 Luke Wagner [:luke] 2012-01-26 08:53:02 PST
Mats, does this repro with javascript.options.tracejit.* set to false?
Comment 6 David Mandelin [:dmandelin] 2012-01-26 11:00:29 PST
I think Alice is saying it still repros now. I see WorkerRun (I'm assuming that's what starts up a worker) in both of her stacks in comment 2.
Comment 7 Luke Wagner [:luke] 2012-01-26 11:07:10 PST
comment 2 links to a mozilla-beta rev which still contains jstracer.cpp
Comment 8 Alice0775 White 2012-01-26 11:18:50 PST
The str comment#2 cannot be reprodiced anymore on 
http://hg.mozilla.org/mozilla-central/rev/402b394b6623
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0a1) Gecko/20120126 Firefox/12.0a1 ID:20120126031113
And comment#2 was fixed by Bug 675078.

However,I cannot confirm whether original comment#0 was fixed.
Comment 9 Luke Wagner [:luke] 2012-01-26 12:05:09 PST
Wow, unexpected bug fix #2 for bug 675078.
Comment 10 Mats Palmgren (:mats) 2012-01-26 14:36:31 PST
I haven't seen this hang in a very long time so I think you can close this bug now.

Note You need to log in before you can comment on or make changes to this bug.