764223 - More detailed bucketing for JIT crashes

Status: RESOLVED DUPLICATE of bug 1268029

(Socorro :: Backend, task)

Description

[Robert Kaiser]

Crashes with EnterMethodJIT or JaegerShot signatures (maybe others) are really crashes in JITed code, we should do another bucketing / signature generation pass to get something more reasonable.

Comment 1

[(not currently active) Ted Mielczarek]

dvander and I collaborated on jit-crash-categorize, which takes a minidump and spits out a bucket:
http://hg.mozilla.org/users/tmielczarek_mozilla.com/jit-crash-categorize/

Comment 2

[K Lars Lohn [:lars] [:klohn]]

I must have an algorithm before I can act on this.  Passing the buck to Ted to tell me exactly what to do.

Comment 3

[(not currently active) Ted Mielczarek]

I *think* what I'd want is to be able to configure certain signatures to trigger an extra step that could modify the signature. So something like:
1) Run the existing signature algorithm, produce a signature
2) Consult a list from the config for an entry that matches that signature
3) If a match is found, it provides a path to an additional binary to run on the minidump, which can output a string
4) Prepend/append(?) that string to the signature.

For a concrete example, we might have:
1) Signature is "js::mjit::EnterMethodJIT(JSContext*, js::StackFrame*, void*, JS::Value*, bool)"
2) Entry in config is "js::mjit::EnterMethodJIT(JSContext*, js::StackFrame*, void*, JS::Value*, bool)" -> "/path/to/jit-crash-categorize"
3) jit-crash-categorize outputs "BAD_EIP_INSTRUCTION"
4) New signature is "BAD_EIP_INSTRUCTION | js::mjit::EnterMethodJIT(JSContext*, js::StackFrame*, void*, JS::Value*, bool)"

dvander: does that sound useful?

lars: does that sound sane?

Comment 4

[Robert Kaiser]

Turns out we should even be able to stalk JIT frames nowadays that TraceMonkey and JaegerMonkey (which had EnterMethodJIT) are no more and we use IonMonkey and Baseline JIT.
See bug 951176.

Does the approach there replace the plans of this bug here?

Comment 5

[(not currently active) Ted Mielczarek]

I don't think so, this was never about getting better stack traces, but about differentiating types of crashes in JIT code by looking at the specifics of the crash, the code that was generated, etc.

I'm not sure if the existing jit-crash-categorize is useful with IonMonkey, or if we'd need to do something different.

Comment 6

[Lonnen :lonnen]

Signature experimentation can now be done on a.t.m.o

please file a new bug or reopen when there is a specific technique to integrate into socorro

Comment 7

[(not currently active) Ted Mielczarek]

Turns out we totally fixed this, we just used a different bug!