793109 - Stacks truncated near nsDocLoader::DoFireOnStateChange

Status: RESOLVED FIXED

(Toolkit :: Crash Reporting, defect)

Description

[Jesse Ruderman]

Now that bug 787302 is fixed, I'm getting better stacks, but they're still not getting all the way to main.

Comment 1

[Jesse Ruderman]

Attachment: truncated stack (bug 588237)

This is with minidump_stackwalk on a debug build from Tinderbox.

Comment 2

[Jesse Ruderman]

Attachment: full stack

This is with gdb on a local debug build (built with Clang).

Comment 3

[Rafael Ávila de Espíndola (:espindola) (not reading bugmail)]

The interesting bits are:

gdb:

#35 0x00000001029cb602 in nsDocShell::OnStateChange (this=0x11b09ed30, aProgress=0x11b09ed58, aRequest=0x10c13ca58, aStateFlags=131088, aStatus=0) at /Users/jruderman/trees/mozilla-central/docshell/base/nsDocShell.cpp:6240
#36 0x00000001029cb945 in non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, unsigned int) () at /Users/jruderman/trees/mozilla-central/docshell/base/nsDocShell.cpp:675
#37 0x0000000102a07ac9 in nsDocLoader::DoFireOnStateChange (this=0x11b09ed30, aProgress=0x11b09ed58, aRequest=0x10c13ca58, aStateFlags=@0x7fff5fbfc934, aStatus=0) at /Users/jruderman/trees/mozilla-central/uriloader/base/nsDocLoader.cpp:1351

minidump_stackwalk:

33  XUL!nsDocShell::OnStateChange [nsDocShell.cpp : 6240 + 0x11]
    rbx = 0xfffdffef   r12 = 0x04b89258   r13 = 0x054aace0   r14 = 0x054aad08
    r15 = 0x00000000   rip = 0x02037ca7   rsp = 0x5fbfca00   rbp = 0x5fbfcba0
    Found by: call frame info
34  XUL + 0x1037d3f
    rbx = 0x5fbfcc28   r12 = 0x054ab7b0   r13 = 0x5fbfcc28   r14 = 0x054d7fc8
    r15 = 0x00000000   rip = 0x02037d40   rsp = 0x5fbfcbb0   rbp = 0x5fbfcbb0
    Found by: call frame info
35  XUL!nsDocLoader::DoFireOnStateChange [nsDocLoader.cpp : 1351 + 0x23]
    rip = 0x02063b94   rsp = 0x5fbfcbc0
    Found by: stack scanning

So looks like there is some problem walking past thunks. Where can I get the minidump and sym filles to reproduce this locally?

Comment 4

[Rafael Ávila de Espíndola (:espindola) (not reading bugmail)]

Don't worry about the minidump, I think I found the bug.

Comment 5

[Rafael Ávila de Espíndola (:espindola) (not reading bugmail)]

This should be fixed in clang r164411. I wil keep this bug open while I figure out the best way to deploy the fix.

Comment 6

[Rafael Ávila de Espíndola (:espindola) (not reading bugmail)]

Attachment: update the clang build script

This patch updates the clang build script to 164411 and removes the two patches that had been backported. This patch also:

* Remove patches that were needed on centos5 but not 6 (gnu89 and old ld).
* Builds stage one /usr/bin/gcc
* Since this gcc doesn't miscompile clang, the stage1 can be built with optimizations.

Comment 7

[Rafael Ávila de Espíndola (:espindola) (not reading bugmail)]

Attachment: update the clang manifest.

These linux packages have been build on a centos6 vm.

Comment 8

[Rafael Ávila de Espíndola (:espindola) (not reading bugmail)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/9444fc718d81
https://hg.mozilla.org/integration/mozilla-inbound/rev/7c60e40e92ac

The diff-talos.py results with 10 runs:

dromaeo_css
MacOSX 10.6 (rev4)                | (3175.256,     18.5116419939)  -> (3229.599,     14.1389428569)  1.0171x better
MacOSX 10.8                       | (4846.688,     10.129060047)   -> (4878.546,     14.1839960362)  1.0066x better

tp5n_paint
MacOSX 10.8                       | (178.4888,     1.04638726491)  -> (176.9359,     0.427562567831) 1.0088x better

Comment 9

[Rafael Ávila de Espíndola (:espindola) (not reading bugmail)]

The binaries also got a bit smaller:

 size FirefoxOld.app/Contents/MacOS/XUL 
__TEXT	__DATA	__OBJC	others	dec	hex
35753984	4911104	0	35115008	75780096	4845000
Rafaels-MacBook-Pro:t espindola$ size FirefoxNew.app/Contents/MacOS/XUL 
__TEXT	__DATA	__OBJC	others	dec	hex
35725312	4911104	0	35115008	75751424	483e000

Comment 11

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/9444fc718d81
https://hg.mozilla.org/mozilla-central/rev/7c60e40e92ac

Comment 12

[Rafael Ávila de Espíndola (:espindola) (not reading bugmail)]

Jesse, as far as I know all the issues with bad stacks have been fixed. Please let me know if you notice something else.

Comment 13

[Jesse Ruderman]

Most stacks are beautiful now.  Thanks!

Comment 14

[Rafael Ávila de Espíndola (:espindola) (not reading bugmail)]

(In reply to Jesse Ruderman from comment #13)
> Most stacks are beautiful now.  Thanks!

Cool. BTW, bug 803184 might help with unwinding past functions in MethodJIT.cpp.