Closed Bug 813619 Opened 12 years ago Closed 12 years ago

Spike of 64-bit crashes in GC

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Version:
20 Branch
Platform:
x86_64
Windows 7
Type:
defect
Priority:
Not set
Severity:
blocker

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla20
Tracking Flags:
Tracking Status
firefox19 --- unaffected

People

(Reporter: scoobidiver, Unassigned)

References

Details

(4 keywords)

Crash Data

There are about 1500 crashes per hour on 64-bit builds making it unusable.
The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=4fddb9923ef0&tochange=bc69705c162d

Here is one example of stack traces:
Frame 	Module 	Signature 	Source
0 	xul.dll 	js::gc::MarkCycleCollectorChildren 	js/src/gc/Marking.cpp:877
1 	xul.dll 	NoteJSChildTracerShim 	js/xpconnect/src/nsXPConnect.cpp:806
2 	xul.dll 	NoteJSChildTracerShim 	js/xpconnect/src/nsXPConnect.cpp:807
3 	xul.dll 	GCGraphBuilder::NoteChild 	xpcom/base/nsCycleCollector.cpp:1745
4 	xul.dll 	XPCWrappedNative::GetWrappedNativeOfJSObject 	js/xpconnect/src/XPCWrappedNative.cpp:1929
5 	xul.dll 	js::gc::MarkUnbarriered<JSScript> 	js/src/gc/Marking.cpp:143
6 	xul.dll 	DescribeGCThing 	js/xpconnect/src/nsXPConnect.cpp:801
7 	xul.dll 	fun_trace 	js/src/jsfun.cpp:530
8 	xul.dll 	js::gc::Mark<js::Shape> 	js/src/gc/Marking.cpp:151
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=js%3A%3Agc%3A%3AMarkCycleCollectorChildren%28JSTracer*%2C+js%3A%3AShape*%29
https://crash-stats.mozilla.com/report/list?signature=js%3A%3AGCMarker%3A%3AprocessMarkStackTop%28js%3A%3ASliceBudget%26%29
https://crash-stats.mozilla.com/report/list?signature=TraverseGCThing
https://crash-stats.mozilla.com/report/list?signature=JS%3A%3AHandle%3CJSObject*%3E%3A%3Aget%28%29
https://crash-stats.mozilla.com/report/list?signature=NoteGCThingXPCOMChildren
https://crash-stats.mozilla.com/report/list?signature=NoteGCThingJSChildren
https://crash-stats.mozilla.com/report/list?signature=UnmarkGrayChildren
https://crash-stats.mozilla.com/report/list?signature=js%3A%3Agc%3A%3AScanShape
https://crash-stats.mozilla.com/report/list?signature=js%3A%3Agc%3A%3AScanBaseShape
...
Bug 747066 is the only thing that stands out in that range.
Severity: critical → blocker
Hardware: x86 → x86_64
Blocks: 747066
I backed out bug 747066 so we can see if that fixes the problem. Unfortunately, we have very little test coverage on Win64, so we're kind of flying blind.
(In reply to Bill McCloskey (:billm) from comment #5)
> I backed out bug 747066 so we can see if that fixes the problem.
> Unfortunately, we have very little test coverage on Win64, so we're kind of
> flying blind.


I use Win64. Put it out and tell me what you want me do.

Notice. Ordinary user here. Be clear and specific.
The first build (hourly) with version bump to 20 did not crash (done on 19 november buildID 20121119120559) , the official nightly build with version butmp to 20 (done on 20 november) crash



  Application Basics

        Name
        Firefox

        Version
        20.0a1

        User Agent
        Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:20.0) Gecko/20.0 Firefox/20.0

        Build Configuration

          about:buildconfig

about:buildconfig
Build Machine

w64-ix-slave106
Source

Built from http://hg.mozilla.org/mozilla-central/rev/669ac8371d19
Build platform
target
x86_64-pc-mingw32
Build tools
Compiler 	Version 	Compiler flags
e:/builds/moz2_slave/m-cen-w64/build/obj-firefox/_virtualenv/Scripts/python.exe -O e:/builds/moz2_slave/m-cen-w64/build/build/cl.py cl 	16.00.30319.01 	-TC -nologo -W3 -Gy -Fdgenerated.pdb -we4553 -DNDEBUG -DTRIMMED -Zi -UDEBUG -DNDEBUG -O1 -Oy-
e:/builds/moz2_slave/m-cen-w64/build/obj-firefox/_virtualenv/Scripts/python.exe -O e:/builds/moz2_slave/m-cen-w64/build/build/cl.py cl 	16.00.30319.01 	-TP -nologo -W3 -Gy -Fdgenerated.pdb -wd4345 -wd4351 -wd4800 -we4553 -GR- -DNDEBUG -DTRIMMED -Zi -UDEBUG -DNDEBUG -O1 -Oy-
Configure arguments

--target=x86_64-pc-mingw32 --host=x86_64-pc-mingw32 --enable-update-channel= --enable-update-packaging --enable-jemalloc --enable-signmar --enable-profiling --enable-js-diagnostics


browser.startup.homepage_override.buildID20121119120559browser.startup.homepage_override.mstone20.0a1
ok , the issue is on thoose two changeset

emorley@mozilla.com
Tue Nov 20 06:54:23 2012 -0800	a9d59073400b	Ed Morley — Merge last PGO-green changeset of mozilla-inbound to mozilla-central
← 58 hidden changesets [Expand]

philringnalda@gmail.com
Mon Nov 19 22:15:56 2012 -0800	bc69705c162d	Phil Ringnalda — Merge last PGO-green changeset of mozilla-inbound to mozilla-central
← 29 hidden changesets [Expand]
(In reply to Bill McCloskey (:billm) from comment #5)
> I backed out bug 747066 so we can see if that fixes the problem.
> Unfortunately, we have very little test coverage on Win64, so we're kind of
> flying blind.

Yeap is fixed now. 
Tested on this changeset.
http://hg.mozilla.org/mozilla-central/rev/4f19e7fd8bea
Fixed by the backout of bug 747066.
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla20
When do we expect a new build with the fix out?
As far as I know, the fix is in the latest nightly.
(In reply to Bill McCloskey (:billm) from comment #15)
> As far as I know, the fix is in the latest nightly.

Also, the 32bit builds should work fine, and those are also fully supported, while the 64bit ones are not.
Win64 Nightly builds are going to be disabled very soon, so you should probably switch to Win32 anyways.

https://groups.google.com/forum/?fromgroups#!topic/mozilla.dev.apps.firefox/jpX_z5zieD4

(if you object to this change, please discuss it in that thread and not here in this bug, which is only incidentally related)
status-firefox20: affected → ---
Crash Signature: js::gc::ScanBaseShape] [@ GCGraphBuilder::NoteXPCOMChild(nsISupports*) | GCGraphBuilder::NoteXPCOMChild(nsISupports*) | NoteGCThingXPCOMChildren] [@ GCGraphBuilder::Traverse(PtrInfo*)] [@ js::ObjectImpl::markChildren(JSTracer*)] → js::gc::ScanBaseShape] [@ GCGraphBuilder::NoteXPCOMChild(nsISupports*) | GCGraphBuilder::NoteXPCOMChild(nsISupports*) | NoteGCThingXPCOMChildren] [@ GCGraphBuilder::Traverse(PtrInfo*)] [@ js::ObjectImpl::markChildren(JSTracer*)] [@ xul.dll@0x1726b80 |…
(In reply to Andrew McCreight [:mccr8] from comment #17)
> Win64 Nightly builds are going to be disabled very soon, so you should
> probably switch to Win32 anyways.
Win64 builds are still built (see ftp://ftp.mozilla.org/pub/firefox/nightly/latest-mozilla-central/) and pollute recent crash stats.
Is this the place to bitch about such things?
You need to log in before you can comment on or make changes to this bug.