Closed Bug 792873 Opened 12 years ago Closed 12 years ago

Intermittent crash in test_pointer-events.xhtml, test_value_storage.html, test_bug416317-1.html, test_bug416317-2.html, test_pathAnimInterpolation.xhtml, test_canvas.html [@ js::ion::AutoFlushCache::updateTop] [@ js::ion::AutoFlushCache::update]

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
ARM
Android
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla19
Tracking Flags:
Tracking Status
firefox18 --- fixed
firefox19 --- fixed

People

(Reporter: ttaubert, Assigned: mjrosenb)

References

Details

(Keywords: crash, intermittent-failure, regression, Whiteboard: [ion:p1])

Crash Data

Attachments

(1 file)

/home/mrosenberg/patches/assertSameCompartment-r0.patch
3.73 KB, patch
jandem
: review+
lsblakk
: approval-mozilla-aurora+
Details | Diff | Splinter Review 
https://tbpl.mozilla.org/php/getParsedLog.php?id=15381218&tree=Fx-Team#error0

 0  libxul.so!js::ion::AutoFlushCache::updateTop [Ion.cpp : 1696 + 0xa]
     r4 = 0x00000004    r5 = 0x4e64d62c    r6 = 0x44b07974    r7 = 0x5597f298
     r8 = 0x56aad000    r9 = 0x55bc4ad4   r10 = 0x44b079a0    fp = 0x51a41448
     sp = 0x44b07920    lr = 0x449be777    pc = 0x5564ce3e
    Found by: given as instruction pointer in context
 1  libxul.so!js::ion::Assembler::patchWrite_NearCall [Assembler-arm.cpp : 2279 + 0x0]
     r4 = 0x44b079c8    r5 = 0x4ec07800    r6 = 0x44b07974    r7 = 0x5597f298
     r8 = 0x56aad000    r9 = 0x55bc4ad4   r10 = 0x44b079a0    fp = 0x51a41448
     sp = 0x44b07930    pc = 0x556a41ab
    Found by: call frame info
 2  libxul.so!js::ion::InvalidateAll [Ion.cpp : 1520 + 0x4]
     r4 = 0x44b079c8    r5 = 0x4ec07800    r6 = 0x44b07974    r7 = 0x5597f298
     r8 = 0x56aad000    r9 = 0x55bc4ad4   r10 = 0x44b079a0    fp = 0x51a41448
     sp = 0x44b07938    pc = 0x556502b5
    Found by: call frame info
 3  libxul.so!JSCompartment::sweep [jsgcinlines.h : 245 + 0x0]
     r4 = 0x44b07c40    r5 = 0x50f391d0    r6 = 0x59c75600    r7 = 0x4ec07800
     r8 = 0x00000042    r9 = 0x44b07b80   r10 = 0x441d8cae    fp = 0x00000001
     sp = 0x44b079f8    pc = 0x5548baf9
    Found by: call frame info
 4  libxul.so!IncrementalCollectSlice [Statistics.h : 182 + 0x0]
     r4 = 0x50f39000    r5 = 0x59c754f0    r6 = 0x59c75600    r7 = 0x44b07c40
     r8 = 0x00000042    r9 = 0x44b07b80   r10 = 0x441d8cae    fp = 0x0004ca1e
     sp = 0x44b07b38    pc = 0x554b4a69
    Found by: call frame info
 5  libxul.so!GCCycle [jsgc.cpp : 4106 + 0x0]
     r4 = 0x50f39000    r5 = 0x006e5000    r6 = 0x01312d00    r7 = 0x00000000
     r8 = 0x00000000    r9 = 0x00000000   r10 = 0x50f391d0    fp = 0x00000000
     sp = 0x44b07ca0    pc = 0x554b5ebf
    Found by: call frame info
 6  libxul.so!js::GCSlice [jsgc.cpp : 4640 + 0x0]
     r4 = 0x50f39000    r5 = 0x50f391d0    r6 = 0x00000005    r7 = 0x00000000
     r8 = 0x00000000    r9 = 0x00000000   r10 = 0x00002710    fp = 0x00000000
     sp = 0x44b07cc8    pc = 0x554b714d
    Found by: call frame info
 7  libxul.so!js_HandleExecutionInterrupt [jscntxt.cpp : 1131 + 0x14]
     r4 = 0x570dd230    r5 = 0x50f39000    r6 = 0xffffff87    r7 = 0x57c1c940
     r8 = 0x555d7665    r9 = 0x57c6e880   r10 = 0x51100ae8    fp = 0x00000000
     sp = 0x44b07cf8    pc = 0x554866d7
Summary: Intermittent crash in js::ion::AutoFlushCache::updateTop [Ion.cpp : 1696 + 0xa] → IonMonkey: Intermittent crash in js::ion::AutoFlushCache::updateTop [Ion.cpp : 1696 + 0xa]
Whiteboard: [orange] → [orange][ion:p1:fx18]
Summary: IonMonkey: Intermittent crash in js::ion::AutoFlushCache::updateTop [Ion.cpp : 1696 + 0xa] → IonMonkey: Intermittent crash during test_pointer-events.xhtml in js::ion::AutoFlushCache::updateTop [Ion.cpp : 1696 + 0xa]
Keywords: crash
Depends on: 757838
Marty, does this callstack belie anything interesting about our invalidation scheme? It doesn't seem to happen that often.
Whiteboard: [orange][ion:p1:fx18] → [orange][ion:p1]
https://tbpl.mozilla.org/php/getParsedLog.php?id=16337128&tree=Mozilla-Aurora

It happens more often than you would think, but disproportionally on that last batch of 80 tegras that we got, and they are disproportionally run by Linux foopies, which screw up the stack, so the bulk of these went into bug 795206 (before we stopped starring Android failures).
(In reply to David Anderson [:dvander] from comment #6)
> Marty, does this callstack belie anything interesting about our invalidation
> scheme? It doesn't seem to happen that often.

This happens very frequently on m-c, inbound, and aurora. We just aren't posting links to every log anymore.
And, sorry, but we're back to pasting logs - I thought Orange Factor would take the place of them, but it apparently ignores a huge percentage of them, since rather than "6 failures on trunk in the last week" it should be more like "60 failures on trunk in the last 12 hours."

https://tbpl.mozilla.org/php/getParsedLog.php?id=16607399&tree=Mozilla-Inbound
https://tbpl.mozilla.org/php/getParsedLog.php?id=16607300&tree=Mozilla-Inbound
Summary: IonMonkey: Intermittent crash during test_pointer-events.xhtml in js::ion::AutoFlushCache::updateTop [Ion.cpp : 1696 + 0xa] → IonMonkey: Intermittent crash during test_pointer-events.xhtml, test_value_storage.html in js::ion::AutoFlushCache::updateTop [Ion.cpp : 1696 + 0xa] or js::ion::AutoFlushCache::update
https://tbpl.mozilla.org/php/getParsedLog.php?id=16609906&tree=Mozilla-Inbound
Summary: IonMonkey: Intermittent crash during test_pointer-events.xhtml, test_value_storage.html in js::ion::AutoFlushCache::updateTop [Ion.cpp : 1696 + 0xa] or js::ion::AutoFlushCache::update → IonMonkey: Intermittent crash during test_pointer-events.xhtml, test_value_storage.html, test_bug416317-1.html in js::ion::AutoFlushCache::updateTop [Ion.cpp : 1696 + 0xa] or js::ion::AutoFlushCache::update
Severity: normal → critical
Crash Signature: [@ js::ion::AutoFlushCache::updateTop(unsigned int, unsigned int)]
Dmandelin, can you have someone look at this? This is a very common ionmonkey crash on android.  It's not 100% reproducible, but it is quite common. Let us know if you need anything (machine etc) to help repro and fix it.
I've seen this crash in 2 out of 2 of my last try runs...
Summary: IonMonkey: Intermittent crash during test_pointer-events.xhtml, test_value_storage.html, test_bug416317-1.html in js::ion::AutoFlushCache::updateTop [Ion.cpp : 1696 + 0xa] or js::ion::AutoFlushCache::update → Intermittent IonMonkey crash during test_pointer-events.xhtml, test_value_storage.html, test_bug416317-1.html, test_pathAnimInterpolation.xhtml in [@ js::ion::AutoFlushCache::updateTop] or [@ js::ion::AutoFlushCache::update]
Summary: Intermittent IonMonkey crash during test_pointer-events.xhtml, test_value_storage.html, test_bug416317-1.html, test_pathAnimInterpolation.xhtml in [@ js::ion::AutoFlushCache::updateTop] or [@ js::ion::AutoFlushCache::update] → Intermittent IonMonkey crash during test_pointer-events.xhtml, test_value_storage.html, test_bug416317-1.html, test_bug416317-2.html, test_pathAnimInterpolation.xhtml in [@ js::ion::AutoFlushCache::updateTop] or [@ js::ion::AutoFlushCache::update]
https://tbpl.mozilla.org/php/getParsedLog.php?id=16713822&tree=Firefox
Summary: Intermittent IonMonkey crash during test_pointer-events.xhtml, test_value_storage.html, test_bug416317-1.html, test_bug416317-2.html, test_pathAnimInterpolation.xhtml in [@ js::ion::AutoFlushCache::updateTop] or [@ js::ion::AutoFlushCache::update] → Intermittent crash in test_pointer-events.xhtml, test_value_storage.html, test_bug416317-1.html, test_bug416317-2.html, test_pathAnimInterpolation.xhtml, test_canvas.html [@ js::ion::AutoFlushCache::updateTop] [@ js::ion::AutoFlushCache::update]
Blocks: 808411
(In reply to Clint Talbert ( :ctalbert ) from comment #60)
> Dmandelin, can you have someone look at this? This is a very common
> ionmonkey crash on android.  It's not 100% reproducible, but it is quite
> common. Let us know if you need anything (machine etc) to help repro and fix
> it.

(In reply to Phil Ringnalda (:philor) from comment #61)
> mjrosenb would love to be looking at it, but he needs someone to tell him
> how he can run mochitests on his device with a debugger running, he just
> keeps making the mistake of wanting to know how at the wrong time of day.

Not clear if anyone / who is looking at this (the assignee is blank and there hasn't been any activity in this bug, nor have I seen anyone asking about comment 61 in #ateam).

Dmandelin please can you clarify if someone (mjrosenb?) is working on this, and if not please may you find someone? This is our #1 toporange across all platforms (even though it only occurs on android).
Flags: needinfo?(dmandelin)
(In reply to Ed Morley [:edmorley UTC+0] from comment #284)
> (In reply to Clint Talbert ( :ctalbert ) from comment #60)
> > Dmandelin, can you have someone look at this? This is a very common
> > ionmonkey crash on android.  It's not 100% reproducible, but it is quite
> > common. Let us know if you need anything (machine etc) to help repro and fix
> > it.
> 
> (In reply to Phil Ringnalda (:philor) from comment #61)
> > mjrosenb would love to be looking at it, but he needs someone to tell him
> > how he can run mochitests on his device with a debugger running, he just
> > keeps making the mistake of wanting to know how at the wrong time of day.
> 
> Not clear if anyone / who is looking at this (the assignee is blank and
> there hasn't been any activity in this bug, nor have I seen anyone asking
> about comment 61 in #ateam).
> 
> Dmandelin please can you clarify if someone (mjrosenb?) is working on this,
> and if not please may you find someone? This is our #1 toporange across all
> platforms (even though it only occurs on android).

AFAIK no one is working on it. It's an IonMonkey bug. David Anderson handles all of those, so I'm forwarding your request to him.
Flags: needinfo?(dmandelin) → needinfo?(dvander)
(In reply to David Mandelin [:dmandelin] from comment #336)
> AFAIK no one is working on it. It's an IonMonkey bug. David Anderson handles
> all of those, so I'm forwarding your request to him.

Thank you :-)
dvander, ping for update on this #1 toporange.
Whole battery of fixes for how the AutoFlushCache interacts with the IonCompartment that it piggybacks off of
Attachment #679634 - Flags: review?(jdemooij)
Comment on attachment 679634 [details] [diff] [review]
/home/mrosenberg/patches/assertSameCompartment-r0.patch

Review of attachment 679634 [details] [diff] [review]:
-----------------------------------------------------------------

Good catch.

::: js/src/ion/Ion.cpp
@@ +1707,1 @@
>              AutoFlushCache afc ("InvalidateAll", c->ionCompartment());

Nit: s/wtf/ictx :) Also, passing c->ionCompartment() to AutoFlushCache is no longer necessary now right?
Attachment #679634 - Flags: review?(jdemooij) → review+
Assignee: general → mrosenberg
Status: NEW → ASSIGNED
Flags: needinfo?(dvander)
Looking good so far - please may this be backported to aurora too :-)
Comment on attachment 679634 [details] [diff] [review]
/home/mrosenberg/patches/assertSameCompartment-r0.patch

[Approval Request Comment]
Bug caused by (feature/regressing bug #): Landing IonMonkey
User impact if declined: perma-orange on tbpl for 18
Testing completed (on m-c, etc.): landed on m-i several hours ago
Risk to taking this patch (and alternatives if risky): Nothing that I know of.
String or UUID changes made by this patch:
Attachment #679634 - Flags: approval-mozilla-aurora?
Attachment #679634 - Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
https://hg.mozilla.org/mozilla-central/rev/8a726e298171
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla19
Whiteboard: [orange][ion:p1] → [ion:p1]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: