Spike of 64-bit crashes in GC

RESOLVED FIXED in mozilla20

Status

()

Core
JavaScript Engine
--
blocker
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: Scoobidiver (away), Unassigned)

Tracking

(4 keywords)

20 Branch
mozilla20
x86_64
Windows 7
64bit, crash, regression, topcrash
Points:
---

Firefox Tracking Flags

(firefox19 unaffected)

Details

(crash signature)

(Reporter)

Description

5 years ago
There are about 1500 crashes per hour on 64-bit builds making it unusable.
The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=4fddb9923ef0&tochange=bc69705c162d

Here is one example of stack traces:
Frame 	Module 	Signature 	Source
0 	xul.dll 	js::gc::MarkCycleCollectorChildren 	js/src/gc/Marking.cpp:877
1 	xul.dll 	NoteJSChildTracerShim 	js/xpconnect/src/nsXPConnect.cpp:806
2 	xul.dll 	NoteJSChildTracerShim 	js/xpconnect/src/nsXPConnect.cpp:807
3 	xul.dll 	GCGraphBuilder::NoteChild 	xpcom/base/nsCycleCollector.cpp:1745
4 	xul.dll 	XPCWrappedNative::GetWrappedNativeOfJSObject 	js/xpconnect/src/XPCWrappedNative.cpp:1929
5 	xul.dll 	js::gc::MarkUnbarriered<JSScript> 	js/src/gc/Marking.cpp:143
6 	xul.dll 	DescribeGCThing 	js/xpconnect/src/nsXPConnect.cpp:801
7 	xul.dll 	fun_trace 	js/src/jsfun.cpp:530
8 	xul.dll 	js::gc::Mark<js::Shape> 	js/src/gc/Marking.cpp:151
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=js%3A%3Agc%3A%3AMarkCycleCollectorChildren%28JSTracer*%2C+js%3A%3AShape*%29
https://crash-stats.mozilla.com/report/list?signature=js%3A%3AGCMarker%3A%3AprocessMarkStackTop%28js%3A%3ASliceBudget%26%29
https://crash-stats.mozilla.com/report/list?signature=TraverseGCThing
https://crash-stats.mozilla.com/report/list?signature=JS%3A%3AHandle%3CJSObject*%3E%3A%3Aget%28%29
https://crash-stats.mozilla.com/report/list?signature=NoteGCThingXPCOMChildren
https://crash-stats.mozilla.com/report/list?signature=NoteGCThingJSChildren
https://crash-stats.mozilla.com/report/list?signature=UnmarkGrayChildren
https://crash-stats.mozilla.com/report/list?signature=js%3A%3Agc%3A%3AScanShape
https://crash-stats.mozilla.com/report/list?signature=js%3A%3Agc%3A%3AScanBaseShape
...
(Reporter)

Updated

5 years ago
Duplicate of this bug: 813611
(Reporter)

Updated

5 years ago
Duplicate of this bug: 813615
Bug 747066 is the only thing that stands out in that range.
(Reporter)

Updated

5 years ago
Severity: critical → blocker
Hardware: x86 → x86_64
Blocks: 747066
Duplicate of this bug: 813666
I backed out bug 747066 so we can see if that fixes the problem. Unfortunately, we have very little test coverage on Win64, so we're kind of flying blind.

Comment 6

5 years ago
(In reply to Bill McCloskey (:billm) from comment #5)
> I backed out bug 747066 so we can see if that fixes the problem.
> Unfortunately, we have very little test coverage on Win64, so we're kind of
> flying blind.


I use Win64. Put it out and tell me what you want me do.

Notice. Ordinary user here. Be clear and specific.
In my case

https://crash-stats.mozilla.com/report/index/bp-29e12b80-91c2-4280-a680-c1bf22121120

Good:
https://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-inbound-win64-pgo/1353344607/

Bad:
https://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-inbound-win64-pgo/1353355407/

Pushlog:
https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=a401cd8c40e4&tochange=cd8533b0fae7



Is it the same issue?

Comment 8

5 years ago
The first build (hourly) with version bump to 20 did not crash (done on 19 november buildID 20121119120559) , the official nightly build with version butmp to 20 (done on 20 november) crash



  Application Basics

        Name
        Firefox

        Version
        20.0a1

        User Agent
        Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:20.0) Gecko/20.0 Firefox/20.0

        Build Configuration

          about:buildconfig

about:buildconfig
Build Machine

w64-ix-slave106
Source

Built from http://hg.mozilla.org/mozilla-central/rev/669ac8371d19
Build platform
target
x86_64-pc-mingw32
Build tools
Compiler 	Version 	Compiler flags
e:/builds/moz2_slave/m-cen-w64/build/obj-firefox/_virtualenv/Scripts/python.exe -O e:/builds/moz2_slave/m-cen-w64/build/build/cl.py cl 	16.00.30319.01 	-TC -nologo -W3 -Gy -Fdgenerated.pdb -we4553 -DNDEBUG -DTRIMMED -Zi -UDEBUG -DNDEBUG -O1 -Oy-
e:/builds/moz2_slave/m-cen-w64/build/obj-firefox/_virtualenv/Scripts/python.exe -O e:/builds/moz2_slave/m-cen-w64/build/build/cl.py cl 	16.00.30319.01 	-TP -nologo -W3 -Gy -Fdgenerated.pdb -wd4345 -wd4351 -wd4800 -we4553 -GR- -DNDEBUG -DTRIMMED -Zi -UDEBUG -DNDEBUG -O1 -Oy-
Configure arguments

--target=x86_64-pc-mingw32 --host=x86_64-pc-mingw32 --enable-update-channel= --enable-update-packaging --enable-jemalloc --enable-signmar --enable-profiling --enable-js-diagnostics


browser.startup.homepage_override.buildID20121119120559browser.startup.homepage_override.mstone20.0a1

Comment 9

5 years ago
ok , the issue is on thoose two changeset

emorley@mozilla.com
Tue Nov 20 06:54:23 2012 -0800	a9d59073400b	Ed Morley — Merge last PGO-green changeset of mozilla-inbound to mozilla-central
← 58 hidden changesets [Expand]

philringnalda@gmail.com
Mon Nov 19 22:15:56 2012 -0800	bc69705c162d	Phil Ringnalda — Merge last PGO-green changeset of mozilla-inbound to mozilla-central
← 29 hidden changesets [Expand]

Comment 10

5 years ago
(In reply to Bill McCloskey (:billm) from comment #5)
> I backed out bug 747066 so we can see if that fixes the problem.
> Unfortunately, we have very little test coverage on Win64, so we're kind of
> flying blind.

Yeap is fixed now. 
Tested on this changeset.
http://hg.mozilla.org/mozilla-central/rev/4f19e7fd8bea
(Reporter)

Comment 11

5 years ago
Fixed by the backout of bug 747066.
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
(Reporter)

Updated

5 years ago
Target Milestone: --- → mozilla20
(Reporter)

Updated

5 years ago
Duplicate of this bug: 814047
(Reporter)

Updated

5 years ago
Duplicate of this bug: 814069

Comment 14

5 years ago
When do we expect a new build with the fix out?
As far as I know, the fix is in the latest nightly.

Comment 16

5 years ago
(In reply to Bill McCloskey (:billm) from comment #15)
> As far as I know, the fix is in the latest nightly.

Also, the 32bit builds should work fine, and those are also fully supported, while the 64bit ones are not.
Win64 Nightly builds are going to be disabled very soon, so you should probably switch to Win32 anyways.

https://groups.google.com/forum/?fromgroups#!topic/mozilla.dev.apps.firefox/jpX_z5zieD4

(if you object to this change, please discuss it in that thread and not here in this bug, which is only incidentally related)
(Reporter)

Updated

5 years ago
Duplicate of this bug: 813886
(Reporter)

Updated

5 years ago
status-firefox20: affected → ---
(Reporter)

Updated

5 years ago
Crash Signature: [@ js::gc::MarkCycleCollectorChildren(JSTracer* js::Shape*)] [@ js::GCMarker::processMarkStackTop(js::SliceBudget&)] [@ TraverseGCThing] [@ JS::Handle<JSObject*>::get()] [@ NoteGCThingXPCOMChildren] [@ NoteGCThingJSChildren] [@ UnmarkGrayChi&hellip; → [@ js::gc::MarkCycleCollectorChildren(JSTracer* js::Shape*)] [@ js::GCMarker::processMarkStackTop(js::SliceBudget&)] [@ TraverseGCThing] [@ JS::Handle<JSObject*>::get()] [@ NoteGCThingXPCOMChildren] [@ NoteGCThingJSChildren] [@ UnmarkGrayChi&hellip;
(Reporter)

Comment 19

5 years ago
(In reply to Andrew McCreight [:mccr8] from comment #17)
> Win64 Nightly builds are going to be disabled very soon, so you should
> probably switch to Win32 anyways.
Win64 builds are still built (see ftp://ftp.mozilla.org/pub/firefox/nightly/latest-mozilla-central/) and pollute recent crash stats.

Comment 20

5 years ago
Is this the place to bitch about such things?
It was only information, not bitching ;)
You need to log in before you can comment on or make changes to this bug.