Closed Bug 813619 Opened 13 years ago Closed 13 years ago

Spike of 64-bit crashes in GC

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Version:
20 Branch
Platform:
x86_64
Windows 7
Type:
defect
Priority:
Not set
Severity:
blocker

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla20
Tracking Flags:
Tracking Status
firefox19 --- unaffected

People

(Reporter: scoobidiver, Unassigned)

References

Details

(4 keywords)

Crash Data

There are about 1500 crashes per hour on 64-bit builds making it unusable. The regression range is: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=4fddb9923ef0&tochange=bc69705c162d Here is one example of stack traces: Frame Module Signature Source 0 xul.dll js::gc::MarkCycleCollectorChildren js/src/gc/Marking.cpp:877 1 xul.dll NoteJSChildTracerShim js/xpconnect/src/nsXPConnect.cpp:806 2 xul.dll NoteJSChildTracerShim js/xpconnect/src/nsXPConnect.cpp:807 3 xul.dll GCGraphBuilder::NoteChild xpcom/base/nsCycleCollector.cpp:1745 4 xul.dll XPCWrappedNative::GetWrappedNativeOfJSObject js/xpconnect/src/XPCWrappedNative.cpp:1929 5 xul.dll js::gc::MarkUnbarriered<JSScript> js/src/gc/Marking.cpp:143 6 xul.dll DescribeGCThing js/xpconnect/src/nsXPConnect.cpp:801 7 xul.dll fun_trace js/src/jsfun.cpp:530 8 xul.dll js::gc::Mark<js::Shape> js/src/gc/Marking.cpp:151 ... More reports at: https://crash-stats.mozilla.com/report/list?signature=js%3A%3Agc%3A%3AMarkCycleCollectorChildren%28JSTracer*%2C+js%3A%3AShape*%29 https://crash-stats.mozilla.com/report/list?signature=js%3A%3AGCMarker%3A%3AprocessMarkStackTop%28js%3A%3ASliceBudget%26%29 https://crash-stats.mozilla.com/report/list?signature=TraverseGCThing https://crash-stats.mozilla.com/report/list?signature=JS%3A%3AHandle%3CJSObject*%3E%3A%3Aget%28%29 https://crash-stats.mozilla.com/report/list?signature=NoteGCThingXPCOMChildren https://crash-stats.mozilla.com/report/list?signature=NoteGCThingJSChildren https://crash-stats.mozilla.com/report/list?signature=UnmarkGrayChildren https://crash-stats.mozilla.com/report/list?signature=js%3A%3Agc%3A%3AScanShape https://crash-stats.mozilla.com/report/list?signature=js%3A%3Agc%3A%3AScanBaseShape ...
Bug 747066 is the only thing that stands out in that range.
Severity: critical → blocker
Hardware: x86 → x86_64
I backed out bug 747066 so we can see if that fixes the problem. Unfortunately, we have very little test coverage on Win64, so we're kind of flying blind.
(In reply to Bill McCloskey (:billm) from comment #5) > I backed out bug 747066 so we can see if that fixes the problem. > Unfortunately, we have very little test coverage on Win64, so we're kind of > flying blind. I use Win64. Put it out and tell me what you want me do. Notice. Ordinary user here. Be clear and specific.
The first build (hourly) with version bump to 20 did not crash (done on 19 november buildID 20121119120559) , the official nightly build with version butmp to 20 (done on 20 november) crash Application Basics Name Firefox Version 20.0a1 User Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:20.0) Gecko/20.0 Firefox/20.0 Build Configuration about:buildconfig about:buildconfig Build Machine w64-ix-slave106 Source Built from http://hg.mozilla.org/mozilla-central/rev/669ac8371d19 Build platform target x86_64-pc-mingw32 Build tools Compiler Version Compiler flags e:/builds/moz2_slave/m-cen-w64/build/obj-firefox/_virtualenv/Scripts/python.exe -O e:/builds/moz2_slave/m-cen-w64/build/build/cl.py cl 16.00.30319.01 -TC -nologo -W3 -Gy -Fdgenerated.pdb -we4553 -DNDEBUG -DTRIMMED -Zi -UDEBUG -DNDEBUG -O1 -Oy- e:/builds/moz2_slave/m-cen-w64/build/obj-firefox/_virtualenv/Scripts/python.exe -O e:/builds/moz2_slave/m-cen-w64/build/build/cl.py cl 16.00.30319.01 -TP -nologo -W3 -Gy -Fdgenerated.pdb -wd4345 -wd4351 -wd4800 -we4553 -GR- -DNDEBUG -DTRIMMED -Zi -UDEBUG -DNDEBUG -O1 -Oy- Configure arguments --target=x86_64-pc-mingw32 --host=x86_64-pc-mingw32 --enable-update-channel= --enable-update-packaging --enable-jemalloc --enable-signmar --enable-profiling --enable-js-diagnostics browser.startup.homepage_override.buildID20121119120559browser.startup.homepage_override.mstone20.0a1
ok , the issue is on thoose two changeset emorley@mozilla.com Tue Nov 20 06:54:23 2012 -0800 a9d59073400b Ed Morley — Merge last PGO-green changeset of mozilla-inbound to mozilla-central ← 58 hidden changesets [Expand] philringnalda@gmail.com Mon Nov 19 22:15:56 2012 -0800 bc69705c162d Phil Ringnalda — Merge last PGO-green changeset of mozilla-inbound to mozilla-central ← 29 hidden changesets [Expand]
(In reply to Bill McCloskey (:billm) from comment #5) > I backed out bug 747066 so we can see if that fixes the problem. > Unfortunately, we have very little test coverage on Win64, so we're kind of > flying blind. Yeap is fixed now. Tested on this changeset. http://hg.mozilla.org/mozilla-central/rev/4f19e7fd8bea
Fixed by the backout of bug 747066.
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla20
When do we expect a new build with the fix out?
As far as I know, the fix is in the latest nightly.
(In reply to Bill McCloskey (:billm) from comment #15) > As far as I know, the fix is in the latest nightly. Also, the 32bit builds should work fine, and those are also fully supported, while the 64bit ones are not.
Win64 Nightly builds are going to be disabled very soon, so you should probably switch to Win32 anyways. https://groups.google.com/forum/?fromgroups#!topic/mozilla.dev.apps.firefox/jpX_z5zieD4 (if you object to this change, please discuss it in that thread and not here in this bug, which is only incidentally related)
status-firefox20: affected → ---
Crash Signature: js::gc::ScanBaseShape] [@ GCGraphBuilder::NoteXPCOMChild(nsISupports*) | GCGraphBuilder::NoteXPCOMChild(nsISupports*) | NoteGCThingXPCOMChildren] [@ GCGraphBuilder::Traverse(PtrInfo*)] [@ js::ObjectImpl::markChildren(JSTracer*)] → js::gc::ScanBaseShape] [@ GCGraphBuilder::NoteXPCOMChild(nsISupports*) | GCGraphBuilder::NoteXPCOMChild(nsISupports*) | NoteGCThingXPCOMChildren] [@ GCGraphBuilder::Traverse(PtrInfo*)] [@ js::ObjectImpl::markChildren(JSTracer*)] [@ xul.dll@0x1726b80 |…
(In reply to Andrew McCreight [:mccr8] from comment #17) > Win64 Nightly builds are going to be disabled very soon, so you should > probably switch to Win32 anyways. Win64 builds are still built (see ftp://ftp.mozilla.org/pub/firefox/nightly/latest-mozilla-central/) and pollute recent crash stats.
Is this the place to bitch about such things?
You need to log in before you can comment on or make changes to this bug.