824869 - Infinite loop in JS GC

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

Reproduced running https://wiki.mozilla.org/B2G/Memory_acceptance_criteria#MW0:_Every_app_is_successfully_launched_into_the_foreground .

  C-c C-c
Program received signal SIGINT, Interrupt.
findFreeEntry (this=0x47975760, fop=0xbeceb648) at ./../../dist/include/js/HashTable.h:518
(gdb) bt
#0  findFreeEntry (this=0x47975760, fop=0xbeceb648) at ./../../dist/include/js/HashTable.h:518
#1  changeTableSize (this=0x47975760, fop=0xbeceb648) at ./../../dist/include/js/HashTable.h:553
#2  checkUnderloaded (this=0x47975760, fop=0xbeceb648) at ./../../dist/include/js/HashTable.h:609
#3  remove (this=0x47975760, fop=0xbeceb648) at ./../../dist/include/js/HashTable.h:833
#4  remove (this=0x47975760, fop=0xbeceb648) at ./../../dist/include/js/HashTable.h:1284
#5  remove (this=0x47975760, fop=0xbeceb648) at ./../../dist/include/js/HashTable.h:1417
#6  removeChild (this=0x47975760, fop=0xbeceb648) at /home/cjones/mozilla/new-b2g/gecko/js/src/jspropertytree.cpp:117
...
(gdb) c
Continuing.
  C-c C-c
Program received signal SIGINT, Interrupt.
findFreeEntry (this=0x47975760, fop=0xbeceb648) at ./../../dist/include/js/HashTable.h:518
(gdb) bt
#0  findFreeEntry (this=0x47975760, fop=0xbeceb648) at ./../../dist/include/js/HashTable.h:518
#1  changeTableSize (this=0x47975760, fop=0xbeceb648) at ./../../dist/include/js/HashTable.h:553
#2  checkUnderloaded (this=0x47975760, fop=0xbeceb648) at ./../../dist/include/js/HashTable.h:609
#3  remove (this=0x47975760, fop=0xbeceb648) at ./../../dist/include/js/HashTable.h:833
#4  remove (this=0x47975760, fop=0xbeceb648) at ./../../dist/include/js/HashTable.h:1284
#5  remove (this=0x47975760, fop=0xbeceb648) at ./../../dist/include/js/HashTable.h:1417
#6  removeChild (this=0x47975760, fop=0xbeceb648) at /home/cjones/mozilla/new-b2g/gecko/js/src/jspropertytree.cpp:117
...

Probably some kind of heap corruption.  Too bad it happened the day-after-Christmas-US-and-middle-of-the-night-Europe :/.

Comment 1

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

Only workaround is to pull battery.

Comment 2

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Does this happen every time you run a particular benchmark? Also, which frame is being slow? Is it findFreeEntry itself? After you ^C, can you try finishing each of the frames?

Comment 3

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

I've only seen it this once.  I'm afraid I dumped this pretty quickly out of gdb because I was frustrated that I knew I wouldn't find anyone in time :/.  Sorry, should have got full backtrace.

I ^C'd about 5 times in the space of 10 seconds, and every time it was the same functions on the stack with the same pointers.  This was under a GC triggered by a memory-pressure event.

Comment 4

[Johnny Stenback (:jst)]

Not blocking unless we get evidence of this starts showing up more, or we get more data that points to this being more serious than it seems at first glance.

Comment 5

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

I don't think keeping this bug open is helping anyone.  A bit of a stretch but this could plausibly have been a symptom of bug 822398.