Intermittent crash in test_pointer-events.xhtml, test_value_storage.html, test_bug416317-1.html, test_bug416317-2.html, test_pathAnimInterpolation.xhtml, test_canvas.html [@ js::ion::AutoFlushCache::updateTop] [@ js::ion::AutoFlushCache::update]

RESOLVED FIXED in Firefox 18

Status

()

defect
--
critical
RESOLVED FIXED
7 years ago
5 years ago

People

(Reporter: ttaubert, Assigned: mjrosenb)

Tracking

({crash, intermittent-failure, regression})

Trunk
mozilla19
ARM
Android
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(firefox18 fixed, firefox19 fixed)

Details

(Whiteboard: [ion:p1], crash signature)

Attachments

(1 attachment)

https://tbpl.mozilla.org/php/getParsedLog.php?id=15381218&tree=Fx-Team#error0

 0  libxul.so!js::ion::AutoFlushCache::updateTop [Ion.cpp : 1696 + 0xa]
     r4 = 0x00000004    r5 = 0x4e64d62c    r6 = 0x44b07974    r7 = 0x5597f298
     r8 = 0x56aad000    r9 = 0x55bc4ad4   r10 = 0x44b079a0    fp = 0x51a41448
     sp = 0x44b07920    lr = 0x449be777    pc = 0x5564ce3e
    Found by: given as instruction pointer in context
 1  libxul.so!js::ion::Assembler::patchWrite_NearCall [Assembler-arm.cpp : 2279 + 0x0]
     r4 = 0x44b079c8    r5 = 0x4ec07800    r6 = 0x44b07974    r7 = 0x5597f298
     r8 = 0x56aad000    r9 = 0x55bc4ad4   r10 = 0x44b079a0    fp = 0x51a41448
     sp = 0x44b07930    pc = 0x556a41ab
    Found by: call frame info
 2  libxul.so!js::ion::InvalidateAll [Ion.cpp : 1520 + 0x4]
     r4 = 0x44b079c8    r5 = 0x4ec07800    r6 = 0x44b07974    r7 = 0x5597f298
     r8 = 0x56aad000    r9 = 0x55bc4ad4   r10 = 0x44b079a0    fp = 0x51a41448
     sp = 0x44b07938    pc = 0x556502b5
    Found by: call frame info
 3  libxul.so!JSCompartment::sweep [jsgcinlines.h : 245 + 0x0]
     r4 = 0x44b07c40    r5 = 0x50f391d0    r6 = 0x59c75600    r7 = 0x4ec07800
     r8 = 0x00000042    r9 = 0x44b07b80   r10 = 0x441d8cae    fp = 0x00000001
     sp = 0x44b079f8    pc = 0x5548baf9
    Found by: call frame info
 4  libxul.so!IncrementalCollectSlice [Statistics.h : 182 + 0x0]
     r4 = 0x50f39000    r5 = 0x59c754f0    r6 = 0x59c75600    r7 = 0x44b07c40
     r8 = 0x00000042    r9 = 0x44b07b80   r10 = 0x441d8cae    fp = 0x0004ca1e
     sp = 0x44b07b38    pc = 0x554b4a69
    Found by: call frame info
 5  libxul.so!GCCycle [jsgc.cpp : 4106 + 0x0]
     r4 = 0x50f39000    r5 = 0x006e5000    r6 = 0x01312d00    r7 = 0x00000000
     r8 = 0x00000000    r9 = 0x00000000   r10 = 0x50f391d0    fp = 0x00000000
     sp = 0x44b07ca0    pc = 0x554b5ebf
    Found by: call frame info
 6  libxul.so!js::GCSlice [jsgc.cpp : 4640 + 0x0]
     r4 = 0x50f39000    r5 = 0x50f391d0    r6 = 0x00000005    r7 = 0x00000000
     r8 = 0x00000000    r9 = 0x00000000   r10 = 0x00002710    fp = 0x00000000
     sp = 0x44b07cc8    pc = 0x554b714d
    Found by: call frame info
 7  libxul.so!js_HandleExecutionInterrupt [jscntxt.cpp : 1131 + 0x14]
     r4 = 0x570dd230    r5 = 0x50f39000    r6 = 0xffffff87    r7 = 0x57c1c940
     r8 = 0x555d7665    r9 = 0x57c6e880   r10 = 0x51100ae8    fp = 0x00000000
     sp = 0x44b07cf8    pc = 0x554866d7
Summary: Intermittent crash in js::ion::AutoFlushCache::updateTop [Ion.cpp : 1696 + 0xa] → IonMonkey: Intermittent crash in js::ion::AutoFlushCache::updateTop [Ion.cpp : 1696 + 0xa]
Whiteboard: [orange] → [orange][ion:p1:fx18]
Summary: IonMonkey: Intermittent crash in js::ion::AutoFlushCache::updateTop [Ion.cpp : 1696 + 0xa] → IonMonkey: Intermittent crash during test_pointer-events.xhtml in js::ion::AutoFlushCache::updateTop [Ion.cpp : 1696 + 0xa]
Keywords: crash
Depends on: 757838
Marty, does this callstack belie anything interesting about our invalidation scheme? It doesn't seem to happen that often.
Whiteboard: [orange][ion:p1:fx18] → [orange][ion:p1]
https://tbpl.mozilla.org/php/getParsedLog.php?id=16337128&tree=Mozilla-Aurora

It happens more often than you would think, but disproportionally on that last batch of 80 tegras that we got, and they are disproportionally run by Linux foopies, which screw up the stack, so the bulk of these went into bug 795206 (before we stopped starring Android failures).
(In reply to David Anderson [:dvander] from comment #6)
> Marty, does this callstack belie anything interesting about our invalidation
> scheme? It doesn't seem to happen that often.

This happens very frequently on m-c, inbound, and aurora. We just aren't posting links to every log anymore.
And, sorry, but we're back to pasting logs - I thought Orange Factor would take the place of them, but it apparently ignores a huge percentage of them, since rather than "6 failures on trunk in the last week" it should be more like "60 failures on trunk in the last 12 hours."

https://tbpl.mozilla.org/php/getParsedLog.php?id=16607399&tree=Mozilla-Inbound
https://tbpl.mozilla.org/php/getParsedLog.php?id=16607300&tree=Mozilla-Inbound
Summary: IonMonkey: Intermittent crash during test_pointer-events.xhtml in js::ion::AutoFlushCache::updateTop [Ion.cpp : 1696 + 0xa] → IonMonkey: Intermittent crash during test_pointer-events.xhtml, test_value_storage.html in js::ion::AutoFlushCache::updateTop [Ion.cpp : 1696 + 0xa] or js::ion::AutoFlushCache::update
https://tbpl.mozilla.org/php/getParsedLog.php?id=16609906&tree=Mozilla-Inbound
Summary: IonMonkey: Intermittent crash during test_pointer-events.xhtml, test_value_storage.html in js::ion::AutoFlushCache::updateTop [Ion.cpp : 1696 + 0xa] or js::ion::AutoFlushCache::update → IonMonkey: Intermittent crash during test_pointer-events.xhtml, test_value_storage.html, test_bug416317-1.html in js::ion::AutoFlushCache::updateTop [Ion.cpp : 1696 + 0xa] or js::ion::AutoFlushCache::update
Severity: normal → critical
Crash Signature: [@ js::ion::AutoFlushCache::updateTop(unsigned int, unsigned int)]

Comment 60

7 years ago
Dmandelin, can you have someone look at this? This is a very common ionmonkey crash on android.  It's not 100% reproducible, but it is quite common. Let us know if you need anything (machine etc) to help repro and fix it.
I've seen this crash in 2 out of 2 of my last try runs...
Summary: IonMonkey: Intermittent crash during test_pointer-events.xhtml, test_value_storage.html, test_bug416317-1.html in js::ion::AutoFlushCache::updateTop [Ion.cpp : 1696 + 0xa] or js::ion::AutoFlushCache::update → Intermittent IonMonkey crash during test_pointer-events.xhtml, test_value_storage.html, test_bug416317-1.html, test_pathAnimInterpolation.xhtml in [@ js::ion::AutoFlushCache::updateTop] or [@ js::ion::AutoFlushCache::update]
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Summary: Intermittent IonMonkey crash during test_pointer-events.xhtml, test_value_storage.html, test_bug416317-1.html, test_pathAnimInterpolation.xhtml in [@ js::ion::AutoFlushCache::updateTop] or [@ js::ion::AutoFlushCache::update] → Intermittent IonMonkey crash during test_pointer-events.xhtml, test_value_storage.html, test_bug416317-1.html, test_bug416317-2.html, test_pathAnimInterpolation.xhtml in [@ js::ion::AutoFlushCache::updateTop] or [@ js::ion::AutoFlushCache::update]
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
https://tbpl.mozilla.org/php/getParsedLog.php?id=16713822&tree=Firefox
Summary: Intermittent IonMonkey crash during test_pointer-events.xhtml, test_value_storage.html, test_bug416317-1.html, test_bug416317-2.html, test_pathAnimInterpolation.xhtml in [@ js::ion::AutoFlushCache::updateTop] or [@ js::ion::AutoFlushCache::update] → Intermittent crash in test_pointer-events.xhtml, test_value_storage.html, test_bug416317-1.html, test_bug416317-2.html, test_pathAnimInterpolation.xhtml, test_canvas.html [@ js::ion::AutoFlushCache::updateTop] [@ js::ion::AutoFlushCache::update]
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Duplicate of this bug: 808164
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Blocks: 808411
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
(In reply to Clint Talbert ( :ctalbert ) from comment #60)
> Dmandelin, can you have someone look at this? This is a very common
> ionmonkey crash on android.  It's not 100% reproducible, but it is quite
> common. Let us know if you need anything (machine etc) to help repro and fix
> it.

(In reply to Phil Ringnalda (:philor) from comment #61)
> mjrosenb would love to be looking at it, but he needs someone to tell him
> how he can run mochitests on his device with a debugger running, he just
> keeps making the mistake of wanting to know how at the wrong time of day.

Not clear if anyone / who is looking at this (the assignee is blank and there hasn't been any activity in this bug, nor have I seen anyone asking about comment 61 in #ateam).

Dmandelin please can you clarify if someone (mjrosenb?) is working on this, and if not please may you find someone? This is our #1 toporange across all platforms (even though it only occurs on android).
Flags: needinfo?(dmandelin)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
(In reply to Ed Morley [:edmorley UTC+0] from comment #284)
> (In reply to Clint Talbert ( :ctalbert ) from comment #60)
> > Dmandelin, can you have someone look at this? This is a very common
> > ionmonkey crash on android.  It's not 100% reproducible, but it is quite
> > common. Let us know if you need anything (machine etc) to help repro and fix
> > it.
> 
> (In reply to Phil Ringnalda (:philor) from comment #61)
> > mjrosenb would love to be looking at it, but he needs someone to tell him
> > how he can run mochitests on his device with a debugger running, he just
> > keeps making the mistake of wanting to know how at the wrong time of day.
> 
> Not clear if anyone / who is looking at this (the assignee is blank and
> there hasn't been any activity in this bug, nor have I seen anyone asking
> about comment 61 in #ateam).
> 
> Dmandelin please can you clarify if someone (mjrosenb?) is working on this,
> and if not please may you find someone? This is our #1 toporange across all
> platforms (even though it only occurs on android).

AFAIK no one is working on it. It's an IonMonkey bug. David Anderson handles all of those, so I'm forwarding your request to him.
Flags: needinfo?(dmandelin) → needinfo?(dvander)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)
Comment hidden (Legacy TBPL/Treeherder Robot)