Bug 858032 (SadJit)

[meta] crashes in EnterBaseline / EnterJit

NEW
Unassigned

Status

()

defect
--
critical
6 years ago
10 months ago

People

(Reporter: kairo, Unassigned)

Tracking

(Depends on 3 bugs, {crash, meta, topcrash-win})

23 Branch
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox47 wontfix, firefox48 wontfix, firefox49 wontfix, firefox-esr45 wontfix, firefox50 wontfix, firefox51 wontfix, firefox52 wontfix, firefox-esr52 wontfix, firefox53 wontfix, firefox54 wontfix, firefox55 wontfix, firefox56 wontfix, firefox57 wontfix, firefox58 wontfix, firefox61 affected, firefox62 affected, firefox63 affected)

Details

(Whiteboard: [file separate bugs for specific reproducible cases][unactionable], ShutDownKill, crash signature)

Reporter

Description

6 years ago
This bug was filed from the Socorro interface and is 
report bp-374cf0cd-fdfc-4118-bf30-9629d2130404 .
============================================================= 


This is probably the generic signature we're now seeing for crashes in JITed code now with the new Baseline Compiler where we have seen EnterMethodJIT before when we were still in JägerMonkey.

So this bug is a catch-all for those issues at this time, and not actionable per se (still better to start clean here than to add it on the old EnterMethodJIT one).


Do we have better mechanisms to debug those crashes with BC than we had with JM?
All of these seem to be bug 858022 so far.
Depends on: 858022
Reporter

Comment 2

6 years ago
FYI, bug 595351 was the meta on EnterMethodJIT.

Oh, and for specific reproducible crashes with EnterBaseline (or specific cases you could find with debugging on minidumps), please file separate bugs blocking this one.


(In reply to Jan de Mooij [:jandem] from comment #1)
> All of these seem to be bug 858022 so far.

Ah, good. I just felt we should have a generic one for those signatures in any case, just like we had for EnterMethodJIT. I'm happy about any specific cases we find and can eliminate, of course. :)
Summary: crashes in EnterBaseline → [meta] crashes in EnterBaseline
Whiteboard: [file separate bugs for specific reproducible cases]

Updated

6 years ago
Blocks: 843596
Keywords: meta, regression
Whiteboard: [file separate bugs for specific reproducible cases] → [native-crash][startupcrash][file separate bugs for specific reproducible cases]
Version: Trunk → 23 Branch
Depends on: 858083
Reporter

Comment 3

6 years ago
Scoobidiver, this is a meta bug tracking the EnterBaseline issue, as I described in comment #0. Let's put flags on being startup, native, or whatever on the bugs filed on specific issues, e.g. bug 858083 which is the [native-crash] we mainly are seeing now or bug 858022 which is the x86 one making up most of the Firefox crashes there atm.

Also, this is not a regression, you can see it either as new feature crashing (in terms of Baseline being a new compiler we added) or as a shift of signatures (in terms of some crashes we've seen in JM's EnterMethodJIT now being shifted to EnterBaseline with the BC landing).
Alias: SadBaseline
Keywords: regression
Whiteboard: [native-crash][startupcrash][file separate bugs for specific reproducible cases] → [file separate bugs for specific reproducible cases]

Updated

6 years ago
Depends on: SadJägerMonkey

Updated

6 years ago
Depends on: 858923

Updated

6 years ago
Blocks: BaselineCompiler
No longer blocks: 843596

Updated

6 years ago
Depends on: 858566
Reporter

Updated

6 years ago
No longer depends on: 858566

Updated

6 years ago
No longer depends on: 858923

Updated

6 years ago
Depends on: 861503

Updated

6 years ago
Depends on: 863685

Updated

6 years ago
Keywords: topcrash

Updated

6 years ago
Depends on: 890243
It's #3 browser crasher in 23.0b3, #5 in 24.0a2, and #6 in 25.a1.
Reporter

Comment 5

6 years ago
Yes, as this is a signature that gobbles up all crashes in the Baseline JIT, this being a topcrash across channels is expected. I think it's a bit lower than EnterMethodJIT and JeagerShot signatures were in combined volume, though, so the Baseline JIT Compiler might have fixed some crashes that we had with the JägerMonkey JIT. But that's mostly speculation, given the complexity of that area (also in terms of related signatures).

Updated

6 years ago
Crash Signature: [@ EnterBaseline] → [@ EnterBaseline] [@ @0x0 | EnterBaseline]
Reporter

Comment 6

6 years ago
I'm adding unactionable here as this bug directly is not directly actionable, tracking a generic signature. There's things we can do to get more info about those crashes, and if we find reproducible steps for this signature, we should file separate bugs and go for fixes there.
Whiteboard: [file separate bugs for specific reproducible cases] → [file separate bugs for specific reproducible cases][unactionable]
Keywords: topcrashtopcrash-win

Comment 7

6 years ago
Nightly crashes consistently when adding attachments in Yahoo! Mail, see bug 935491 please.
Reporter

Updated

6 years ago
Depends on: 935491
Depends on: 982398
Assignee: general → nobody
Duplicate of this bug: 1041489
Noting that this is still a topcrash in Firefox 34 and is the #2 topcrash for Firefox 34.0b4 and b5.

Updated

4 years ago
Depends on: 1117412
Duplicate of this bug: 1147286

Updated

4 years ago
Depends on: 1192673

Comment 12

4 years ago
¡Hola Kairo!

This moved 9^ to become top crash #3 https://crash-stats.mozilla.com/topcrasher/products/Firefox/versions/42.0b in the past week

Is it worth updating the Version on this bug?

¡Gracias!
Alex
Flags: needinfo?(kairo)
Reporter

Comment 13

4 years ago
As mentioned in the summary, this is a meta bug. All kinds of crashes in JITed code get registered with this signature, and there are quite a few so it gets into topcrash ranks. There is nothing we can do without concrete testcases though, and those should go into separate bugs. When looking at stats, just ignore this signature.
Flags: needinfo?(kairo)
Blocks: shutdownkill
Whiteboard: [file separate bugs for specific reproducible cases][unactionable] → [file separate bugs for specific reproducible cases][unactionable], ShutDownKill
Duplicate of this bug: 1168272
Duplicate of this bug: 861503
Depends on: 957006
From the crash signature [@ EnterBaseline ] , the affected versions are:
- Nightly: 47.0a1, 46.0a1	
- Firefox: 44.0
- Aurora: 46.0a2, 45.0a2, 44.0a2
- Beta: 45.0b2, 45.0b1, 44.0b99, 44.0b9, 44.0b8, 44.0b7, 44.0b6, 44.0b4, 44.0b2, 44.0b11, 44.0b1

From the crash signature [@ @0x0 | EnterBaseline ] , the affected versions are:
- Nightly: 46.0a1	
- Firefox: 44.0
- Aurora: 46.0a2, 45.0a2, 44.0a2
- Beta: 45.0b1, 44.0b8, 44.0b4, 44.0b2, 44.0b11, 44.0b1,
Depends on: 1247312
Crash volume for signature 'EnterBaseline':
 - nightly (version 50): 64 crashes from 2016-06-06.
 - aurora  (version 49): 89 crashes from 2016-06-07.
 - beta    (version 48): 110 crashes from 2016-06-06.
 - release (version 47): 3032 crashes from 2016-05-31.
 - esr     (version 45): 531 crashes from 2016-04-07.

Crash volume on the last weeks:
             Week N-1   Week N-2   Week N-3   Week N-4   Week N-5   Week N-6   Week N-7
 - nightly         19         13          6          9          3          4          3
 - aurora          25         14         13         16          9          5          0
 - beta            23         14         18         12         21          9          8
 - release        469        500        469        427        465        393        122
 - esr             43         51         50         43         54         52         50

Affected platforms: Windows, Mac OS X, Linux
Crash volume for signature 'EnterBaseline':
 - nightly (version 51): 42 crashes from 2016-08-01.
 - aurora  (version 50): 58 crashes from 2016-08-01.
 - beta    (version 49): 113 crashes from 2016-08-02.
 - release (version 48): 331 crashes from 2016-07-25.
 - esr     (version 45): 670 crashes from 2016-05-02.

Crash volume on the last weeks (Week N is from 08-22 to 08-28):
            W. N-1  W. N-2  W. N-3
 - nightly      14      15       6
 - aurora       21      16       8
 - beta         37      35      20
 - release     106      80      39
 - esr          60      48      45

Affected platforms: Windows, Mac OS X, Linux

Crash rank on the last 7 days:
           Browser   Content     Plugin
 - nightly #104      #170
 - aurora  #54       #73
 - beta    #411      #1570
 - release #176      #107
 - esr     #155
Crash volume for signature 'EnterBaseline':
 - nightly (version 52): 18 crashes from 2016-09-19.
 - aurora  (version 51): 14 crashes from 2016-09-19.
 - beta    (version 50): 47 crashes from 2016-09-20.
 - release (version 49): 351 crashes from 2016-09-05.
 - esr     (version 45): 933 crashes from 2016-06-01.

Crash volume on the last weeks (Week N is from 10-03 to 10-09):
            W. N-1  W. N-2
 - nightly      11       7
 - aurora       14       0
 - beta         35      12
 - release     266      80
 - esr         101      96

Affected platforms: Windows, Mac OS X, Linux

Crash rank on the last 7 days:
           Browser   Content     Plugin
 - nightly #80
 - aurora  #138      #176
 - beta    #405      #1115
 - release #244      #219
 - esr     #117
Crash volume for signature 'EnterBaseline':
 - nightly (version 53): 76 crashes from 2016-11-14.
 - aurora  (version 52): 98 crashes from 2016-11-14.
 - beta    (version 51): 328 crashes from 2016-11-14.
 - release (version 50): 2177 crashes from 2016-11-01.
 - esr     (version 45): 2593 crashes from 2016-07-06.

Crash volume on the last weeks (Week N is from 01-02 to 01-08):
            W. N-1  W. N-2  W. N-3  W. N-4  W. N-5  W. N-6  W. N-7
 - nightly      23      10       6       6      13       9       4
 - aurora       23      18      18      13       6      12       0
 - beta         43      42      61      37      52      48      28
 - release     338     320     393     360     329     260      88
 - esr         132     162     186     197     137     134     150

Affected platforms: Windows, Mac OS X, Linux

Crash rank on the last 7 days:
           Browser   Content   Plugin
 - nightly #61       #254
 - aurora  #76       #164
 - beta    #262      #877
 - release #213      #227
 - esr     #119
Crash volume for signature 'EnterBaseline':
 - nightly (version 54): 14 crashes from 2017-01-23.
 - aurora  (version 53): 3 crashes from 2017-01-23.
 - beta    (version 52): 17 crashes from 2017-01-23.
 - release (version 51): 146 crashes from 2017-01-16.
 - esr     (version 45): 3114 crashes from 2016-08-03.

Crash volume on the last weeks (Week N is from 01-30 to 02-05):
            W. N-1  W. N-2  W. N-3  W. N-4  W. N-5  W. N-6  W. N-7
 - nightly      10
 - aurora        2
 - beta         13
 - release      73       0
 - esr         186     210     172     173     132     162     186

Affected platforms: Windows, Mac OS X, Linux

Crash rank on the last 7 days:
           Browser   Content   Plugin
 - nightly #43
 - aurora  #323      #93
 - beta    #561      #864
 - release #273      #178
 - esr     #107
Duplicate of this bug: 1343419

Comment 24

2 years ago
I replaced the RAM on my computer and the error is gone.
Too late for firefox 52, mass-wontfix.
Depends on: 1425132
Crash Signature: [@ EnterBaseline] [@ @0x0 | EnterBaseline] → [@ EnterBaseline] [@ @0x0 | EnterBaseline] [@ js::jit::MaybeEnterJit]
Crash Signature: [@ EnterBaseline] [@ @0x0 | EnterBaseline] [@ js::jit::MaybeEnterJit] → [@ EnterBaseline] [@ @0x0 | EnterBaseline] [@ js::jit::MaybeEnterJit] [@ @0x0 | js::jit::MaybeEnterJit ]
Crash Signature: [@ EnterBaseline] [@ @0x0 | EnterBaseline] [@ js::jit::MaybeEnterJit] [@ @0x0 | js::jit::MaybeEnterJit ] → [@ EnterBaseline] [@ @0x0 | EnterBaseline] [@ js::jit::MaybeEnterJit] [@ @0x0 | js::jit::MaybeEnterJit ] [@ static js::jit::EnterJitStatus EnterJit]
Duplicate of this bug: 1425132
Alias: SadBaseline → SadJit
Summary: [meta] crashes in EnterBaseline → [meta] crashes in EnterJit
Summary: [meta] crashes in EnterJit → [meta] crashes in EnterBaseline / EnterJit
Adding EnterBaselineMethod back to signatures so that historical crash rate graph is less misleading.
Crash Signature: [@ EnterBaseline] [@ @0x0 | EnterBaseline] [@ js::jit::MaybeEnterJit] [@ @0x0 | js::jit::MaybeEnterJit ] [@ static js::jit::EnterJitStatus EnterJit] → [@ EnterBaseline] [@ @0x0 | EnterBaseline] [@ EnterBaselineMethod] [@ js::jit::MaybeEnterJit] [@ @0x0 | js::jit::MaybeEnterJit ] [@ static js::jit::EnterJitStatus EnterJit]
Crash Signature: [@ EnterBaseline] [@ @0x0 | EnterBaseline] [@ EnterBaselineMethod] [@ js::jit::MaybeEnterJit] [@ @0x0 | js::jit::MaybeEnterJit ] [@ static js::jit::EnterJitStatus EnterJit] → [@ EnterJit] [@ EnterBaseline] [@ @0x0 | EnterBaseline] [@ EnterBaselineMethod] [@ js::jit::MaybeEnterJit] [@ @0x0 | js::jit::MaybeEnterJit ] [@ static js::jit::EnterJitStatus EnterJit]
Crash Signature: [@ EnterJit] [@ EnterBaseline] [@ @0x0 | EnterBaseline] [@ EnterBaselineMethod] [@ js::jit::MaybeEnterJit] [@ @0x0 | js::jit::MaybeEnterJit ] [@ static js::jit::EnterJitStatus EnterJit] → [@ EnterJit] [@ EnterBaseline] [@ @0x0 | EnterBaseline] [@ js::jit::EnterBaselineMethod] [@ js::jit::EnterBaselineAtBranch] [@ js::jit::MaybeEnterJit] [@ @0x0 | js::jit::MaybeEnterJit ] [@ static js::jit::EnterJitStatus EnterJit]
Crash Signature: [@ EnterJit] [@ EnterBaseline] [@ @0x0 | EnterBaseline] [@ js::jit::EnterBaselineMethod] [@ js::jit::EnterBaselineAtBranch] [@ js::jit::MaybeEnterJit] [@ @0x0 | js::jit::MaybeEnterJit ] [@ static js::jit::EnterJitStatus EnterJit] → [@ EnterJit] [@ EnterBaseline] [@ @0x0 | EnterBaseline] [@ js::jit::EnterBaselineMethod] [@ js::jit::EnterBaselineAtBranch] [@ js::jit::MaybeEnterJit] [@ @0x0 | js::jit::MaybeEnterJit ] [@ static js::jit::EnterJitStatus EnterJit] [@ static js::jit…
See Also: → 1454959
Depends on: 985001
Bug 1034706 has lots of detailed (but perhaps slightly outdated) analysis.
Depends on: 1034706
In general, the majority of crashes on these signatures are due to bad hardware. This is either due to known-bad CPUs (See Bug 1281759), or failing RAM.
See Also: → 1461427
Depends on: 1461480
Depends on: 1461724
Duplicate of this bug: 1454959
Duplicate of this bug: 1414545
See Also: → 1402087
Depends on: seqrec
You need to log in before you can comment on or make changes to this bug.