817475 - Unresponsive browser due to Infinite Jäeger Monkey compilation.

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Nicolas B. Pierron [:nbp]]

Attachment: Reset pendingNukeTypes, and get rid of the compilation loop.

The infinite loop is caused by pendingNukeTypes boolean value which is never reset at the end of nukeTypes (called form the destructor of AutoEnterTypeInference, which used in js::mjit::CanMethodJIT).

The loop it-self use the “restart” label in CanMethodJIT, which I will recommend to get rid of it such as we do not see any compilation loop again.

The recompilation loop has been introduced in Bug 706914, and the pendingNukeTypes boolean has been added as part of Bug 637674.

This hang appeared 2 times in a row during the start-up self-build optimized version of Firefox (c63d5cff18) running under gdb.

Comment 1

[(no longer active)]

Not sure what you CCed me here.  Anything I can help with in this bug?  :-)

Comment 2

[Nicolas B. Pierron [:nbp]]

(In reply to Ehsan Akhgari [:ehsan] from comment #1)
> Not sure what you CCed me here.  Anything I can help with in this bug?  :-)

Sorry I forgot to mention, I wanted to know if such issue appear in crash-stat or not, and so knowing if it was worth back-porting if it does not appear.

Comment 3

[(no longer active)]

(In reply to comment #2)
> (In reply to Ehsan Akhgari [:ehsan] from comment #1)
> > Not sure what you CCed me here.  Anything I can help with in this bug?  :-)
> 
> Sorry I forgot to mention, I wanted to know if such issue appear in crash-stat
> or not, and so knowing if it was worth back-porting if it does not appear.

Hmm, I'm not sure how I can help with that...

Comment 4

[Nicolas B. Pierron [:nbp]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/b651d7a7ca8a

Comment 5

[Lukas Blakk [:lsblakk] use ?needinfo]

Doesn't seem like there's a ton of user impact here that would necessitate tracking for 17 - minusing for now.  For Aurora/Beta you can go ahead and nominate for uplift if your fix is safe and low risk but again, without signs of significant user impact or this being a regression, we don't have to track this. Finally, this does not meet the ESR criteria so not tracking there either.

Comment 6

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/b651d7a7ca8a

Comment 7

[Nicolas B. Pierron [:nbp]]

Comment on attachment 687603 [details] [diff] [review]
Reset pendingNukeTypes, and get rid of the compilation loop.

Nominate this bug for approval since I noticed it again (on the same old version) while running firefox constantly under gdb.

[Approval Request Comment]
Bug caused by (feature/regressing bug #):
Bug 637674 & Bug 706914

User impact if declined: 
Low risks of hang, as it does not appear in the crash-stat, even if I can see approximately once every 2 days while running firefox constantly under gdb.

Testing completed (on m-c, etc.): 
Since 2012-12-03 11:08:53 PST.

Risk to taking this patch (and alternatives if risky):
Low.

String or UUID changes made by this patch: N/A

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/113a5e115abd
https://hg.mozilla.org/releases/mozilla-beta/rev/637fccc27f11