729425 - Binaries segfaulting on startup when built with LLVM/Clang SVN HEAD

Status: RESOLVED FIXED

(Firefox Build System :: General, defect)

Description

[Gregory Szorc [:gps]]

When building m-c with LLVM/Clang pulled from their SVN trunk, binaries are segfaulting near startup. I've reproduced the problem on OS X and Linux with LLVM/Clang builds from over the course of the past week, so I don't think it was a single bad commit in LLVM/Clang that hasn't been backed out yet.

I'm able to reproduce very easily by building LLVM/Clang then running xpcshell tests. Interestingly, only some of the xpcshell tests fail. For example:

chrome PASS
netwerk PASS
libjar CRASH
uriloader MIXED
dom MOSTLY PASS

If I attach GDB and run dist/bin/firefox, the output is:

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff37cdd43 in NS_TableDrivenQI (aThis=0x7ffff5408c98, entries=0x7ffff533ab50, aIID=..., aInstancePtr=0x7fffffffa1a0) at nsISupportsImpl.cpp:49
49            NS_ADDREF(r);
(gdb) bt
#0  0x00007ffff37cdd43 in NS_TableDrivenQI (aThis=0x7ffff5408c98, entries=0x7ffff533ab50, aIID=..., aInstancePtr=0x7fffffffa1a0) at nsISupportsImpl.cpp:49
#1  0x00007ffff38721bc in nsMemoryImpl::QueryInterface (this=0x7ffff5408c98, aIID=..., aInstancePtr=0x7fffffffa1a0)
    at /home/jenkins-slave/workspace/mozilla-central-linux-x64-debug-llvm-tip/xpcom/base/nsMemoryImpl.cpp:58
#2  0x00007ffff387263e in NS_GetMemoryManager_P (result=0x7fffffffa1a0)
    at /home/jenkins-slave/workspace/mozilla-central-linux-x64-debug-llvm-tip/xpcom/base/nsMemoryImpl.cpp:213
#3  0x00007ffff37ce021 in nsMemory::GetGlobalMemoryService () at nsMemory.cpp:71
#4  0x00007ffff3833c71 in nsSegmentedBuffer::Init (this=0x7fffe0c15190, segmentSize=256, maxSize=4294967295, allocator=0x0)
    at /home/jenkins-slave/workspace/mozilla-central-linux-x64-debug-llvm-tip/xpcom/io/nsSegmentedBuffer.cpp:51
#5  0x00007ffff38347c2 in nsStorageStream::Init (this=0x7fffe40ffa10, segmentSize=256, maxSize=4294967295, segmentAllocator=0x0)
    at /home/jenkins-slave/workspace/mozilla-central-linux-x64-debug-llvm-tip/xpcom/io/nsStorageStream.cpp:106
#6  0x00007ffff383617d in NS_NewStorageStream (segmentSize=256, maxSize=4294967295, result=0x7fffffffa368)
    at /home/jenkins-slave/workspace/mozilla-central-linux-x64-debug-llvm-tip/xpcom/io/nsStorageStream.cpp:555
#7  0x00007ffff1cb844e in mozilla::scache::NewObjectOutputWrappedStorageStream (wrapperStream=0x7fffffffa448, stream=0x7fffffffa440, wantDebugStream=true)
    at /home/jenkins-slave/workspace/mozilla-central-linux-x64-debug-llvm-tip/startupcache/StartupCacheUtils.cpp:78
#8  0x00007ffff2fcac47 in WriteCachedScript (cache=0x7fffe4040110, uri=..., cx=0x7fffe4028800, script=0x7fffe0e2e7d8)
    at /home/jenkins-slave/workspace/mozilla-central-linux-x64-debug-llvm-tip/js/xpconnect/loader/mozJSLoaderUtils.cpp:176
#9  0x00007ffff2fc320a in mozJSComponentLoader::GlobalForLocation (this=0x7fffe40489a0, aComponentFile=0x7fffe403e680, aURI=0x7fffe4048a90, aGlobal=0x7fffe40ff5f0,
    aLocation=0x7fffe40ff5f8, exception=0x0) at /home/jenkins-slave/workspace/mozilla-central-linux-x64-debug-llvm-tip/js/xpconnect/loader/mozJSComponentLoader.cpp:949
#10 0x00007ffff2fc0dbd in mozJSComponentLoader::LoadModule (this=0x7fffe40489a0, aFile=...)
    at /home/jenkins-slave/workspace/mozilla-central-linux-x64-debug-llvm-tip/js/xpconnect/loader/mozJSComponentLoader.cpp:516
#11 0x00007ffff384c926 in nsComponentManagerImpl::KnownModule::Load (this=0x7fffe403b900)
    at /home/jenkins-slave/workspace/mozilla-central-linux-x64-debug-llvm-tip/xpcom/components/nsComponentManager.cpp:723
#12 0x00007ffff384d77b in nsFactoryEntry::GetFactory (this=0x7fffe403c900)
    at /home/jenkins-slave/workspace/mozilla-central-linux-x64-debug-llvm-tip/xpcom/components/nsComponentManager.cpp:1738
#13 0x00007ffff384e0e2 in nsComponentManagerImpl::CreateInstanceByContractID (this=0x7ffff6d87330, aContractID=0x7fffe0c15078 "@mozilla.org/weave/service;1",
    aDelegate=0x0, aIID=..., aResult=0x7fffffffb070) at /home/jenkins-slave/workspace/mozilla-central-linux-x64-debug-llvm-tip/xpcom/components/nsComponentManager.cpp:1060
#14 0x00007ffff3849c2f in nsComponentManagerImpl::GetServiceByContractID (this=0x7ffff6d87330, aContractID=0x7fffe0c15078 "@mozilla.org/weave/service;1", aIID=...,
    result=0x7fffffffb1a0) at /home/jenkins-slave/workspace/mozilla-central-linux-x64-debug-llvm-tip/xpcom/components/nsComponentManager.cpp:1466
#15 0x00007ffff37ca4db in CallGetService (aContractID=0x7fffe0c15078 "@mozilla.org/weave/service;1", aIID=..., aResult=0x7fffffffb1a0) at nsComponentManagerUtils.cpp:92
#16 0x00007ffff37cac1f in nsGetServiceByContractIDWithError::operator() (this=0x7fffffffb380, aIID=..., aInstancePtr=0x7fffffffb1a0) at nsComponentManagerUtils.cpp:288
#17 0x00007ffff37c9143 in nsCOMPtr_base::assign_from_gs_contractid_with_error (this=0x7fffffffb3a0, gs=..., iid=...) at nsCOMPtr.cpp:141
#18 0x00007ffff3092c3e in nsCOMPtr<nsISupports>::operator= (this=0x7fffffffb3a0, rhs=...) at ../../../../dist/include/nsCOMPtr.h:1029
---Type <return> to continue, or q <return> to quit---
#19 0x00007ffff3092968 in nsAppStartupNotifier::Observe (this=0x7fffe40cec60, aSubject=0x0, aTopic=0x7ffff42aa7d4 "app-startup", someData=0x0)
    at /home/jenkins-slave/workspace/mozilla-central-linux-x64-debug-llvm-tip/embedding/components/appstartup/src/nsAppStartupNotifier.cpp:100
#20 0x00007ffff1a07260 in XRE_main (argc=1, argv=0x7fffffffe508, aAppData=0x621c60)
    at /home/jenkins-slave/workspace/mozilla-central-linux-x64-debug-llvm-tip/toolkit/xre/nsAppRunner.cpp:3398
#21 0x0000000000402606 in do_main (argc=1, argv=0x7fffffffe508) at /home/jenkins-slave/workspace/mozilla-central-linux-x64-debug-llvm-tip/browser/app/nsBrowserApp.cpp:189
#22 0x0000000000401eec in main (argc=1, argv=0x7fffffffe508) at /home/jenkins-slave/workspace/mozilla-central-linux-x64-debug-llvm-tip/browser/app/nsBrowserApp.cpp:276

(gdb) info threads
  Id   Target Id         Frame
  7    Thread 0x7fffe1796700 (LWP 17089) "firefox" pthread_cond_timedwait@@GLIBC_2.3.2 () at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_timedwait.S:216
  6    Thread 0x7fffe2397700 (LWP 17088) "firefox" pthread_cond_wait@@GLIBC_2.3.2 () at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:162
  5    Thread 0x7fffe2d9b700 (LWP 17087) "firefox" pthread_cond_wait@@GLIBC_2.3.2 () at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:162
  4    Thread 0x7fffe3fff700 (LWP 17086) "firefox" 0x00007ffff6f50773 in __GI___poll (fds=<optimized out>, nfds=<optimized out>, timeout=<optimized out>)
    at ../sysdeps/unix/sysv/linux/poll.c:87
  3    Thread 0x7fffe4bfa700 (LWP 17085) "firefox" pthread_cond_wait@@GLIBC_2.3.2 () at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:162
  2    Thread 0x7fffe53fb700 (LWP 17084) "firefox" syscall () at ../sysdeps/unix/sysv/linux/x86_64/syscall.S:39
* 1    Thread 0x7ffff7fd7740 (LWP 16635) "firefox" 0x00007ffff37cdd43 in NS_TableDrivenQI (aThis=0x7ffff5408c98, entries=0x7ffff533ab50, aIID=...,
    aInstancePtr=0x7fffffffa1a0) at nsISupportsImpl.cpp:49

I'm sure this belongs in another bug component, but I have no clue which. Bug 602102 looks similar, but the stacks are different.

I can reproduce in both debug and optimized builds using Clang HEAD. However, Clang 3.0 is fine.

Comment 1

[Gregory Szorc [:gps]]

According to my LLVM Git reflog, I'm pretty sure r148042 runs m-c properly. This is a commit from Jan 12.

Comment 2

[Gregory Szorc [:gps]]

From my Git reflog, I'm pretty confident the regression occurred in LLVM/Clang between r148042 and r148594 (only 8 days).

Comment 3

[Rafael Ávila de Espíndola (:espindola) (not reading bugmail)]

I have a testcase. The problem is only with c++11, so you can work around it by removing -std=gnu++0x from the command line.

Comment 4

[Gregory Szorc [:gps]]

Can you upload the test case so I can bisect faster? Speaking of bisecting, I've narrowed it down to r148161..r148191.

Comment 5

[Rafael Ávila de Espíndola (:espindola) (not reading bugmail)]

This is now http://llvm.org/bugs/show_bug.cgi?id=12067

Comment 6

[Rafael Ávila de Espíndola (:espindola) (not reading bugmail)]

The clang bug has been fixed, I have started a new firefox build to check.

Comment 7

[Rafael Ávila de Espíndola (:espindola) (not reading bugmail)]

This was fixed in clang.