Closed Bug 985001 Opened 10 years ago Closed 6 years ago

@ js::jit::IonCannon(JSContext*, js::RunState& on Tomnod

Categories

(Core :: JavaScript Engine: JIT, defect, P3)

Product:
Core
Component:
JavaScript Engine: JIT
Version:
31 Branch
Type:
defect

Tracking

()

Status:
RESOLVED INCOMPLETE
Tracking Flags:
Tracking Status
firefox31 + wontfix
firefox32 + wontfix
firefox33 - wontfix
firefox34 - wontfix
firefox47 --- wontfix
firefox48 --- wontfix
firefox49 --- wontfix
firefox-esr45 --- wontfix
firefox50 --- wontfix
firefox51 --- wontfix
firefox52 --- wontfix

People

(Reporter: tdowner, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: crash, Whiteboard: [DUPEME][tbird crash])

Crash Data

Was using Tomnod, after some-time of looking at separate map tiles (http://www.tomnod.com/nod/challenge/malaysiaairsar2014/map/638584 is an example, looked at map tiles around that for about 20-25 minutes before the crash)

https://crash-stats.mozilla.com/report/index/d5b55e6c-207e-4ce3-ab50-fc23a2140318
Keywords: crash
Whiteboard: [DUPEME]
Opening this PDF with the build in PDF.JS viewer also produces a crash, which is linked against this bug from the crash report:

  http://people.inf.ethz.ch/markusp/teaching/263-2300-ETH-spring11/midterm/midterm_sln.pdf

This is using Firefox Nightly 2014-04-12 on OSX.
Affects not only Mac OS X. Confirmed on Linux.
OS: Mac OS X → All
Does not affect Aurora.
Version: 30 Branch → 31 Branch
The crash seems to happen between nightly 2014-03-26 and 2014-04-02.

Downloading the latest nightly, the crash cannot be reproduced anymore. Therefore, mark this bug as resolved/fixed.
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
Resolution: FIXED → WORKSFORME
I still see this crash about once a day with Beta 31 on OS X. This definitely seems like a regression in Firefox 31 because I never saw this particular stack trace until the day I upgraded Beta 30 to 31.

bp-988eaefc-54b9-4278-b742-fd8382140619	 6/18/14   9:26 PM
bp-0e3876e6-7f87-4d4c-8c6a-5d1382140618	 6/17/14  11:50 PM
bp-609568a0-280b-4f14-91b2-7e5bf2140618	 6/17/14   5:02 PM
bp-5233a038-e806-4785-ae8c-fb0d42140615	 6/15/14   1:35 AM
bp-b849398f-90e2-4747-b42c-9b65b2140614	 6/14/14   1:47 AM

The crash seems to be correlated with browsing pinterest.com or using the Pinterest "Pin It" add-on:

http://about.pinterest.com/en/goodies
Status: RESOLVED → REOPENED
status-firefox31: --- → affected
Hardware: x86_64 → All
Resolution: WORKSFORME → ---
I'm repro'ing this also the dat that I upgraded to Fx31
edwong/cpeterson, have you seen this on Windows? If so, can you please set MOZ_CRASHREPORTER_FULLDUMP in your environment before launching Firefox, and if you crash *don't submit the crash* (as the dump will be quite large).

This isn't showing up in the general topcrash list, but it does show as the #10 mac topcrash for 31. But it also shows up in Firefox 30.

I think your best bet on mac would be to run a debug build in a debugger and collect a full core on crash.
FWIW, this is the #10 Mac OS X crash in the last 7-days on Beta. This accounts of 0.11% of crashes on Beta in the last week, 0.13% of crashes in the last two weeks, and 0.14% of crashes in the last month. It looks like this is trending downward, if not stable. For this reason, I'm not sure its worth tracking but that doesn't mean it's not worth investigating. Particularly if we have people who can repro this and are willing to debug it.
(In reply to Benjamin Smedberg  [:bsmedberg] from comment #7)
> edwong/cpeterson, have you seen this on Windows? If so, can you please set
> MOZ_CRASHREPORTER_FULLDUMP in your environment before launching Firefox, and
> if you crash *don't submit the crash* (as the dump will be quite large).
> 
> This isn't showing up in the general topcrash list, but it does show as the
> #10 mac topcrash for 31. But it also shows up in Firefox 30.
> 
> I think your best bet on mac would be to run a debug build in a debugger and
> collect a full core on crash.

I don't have a Windows machine, but I will try to convince my girlfriend to use a debug build on OS X. She's the one using Pinterest. :)

I disabled javascript.options.baselinejit and javascript.options.ion on her Mac for the last two weeks and she had no crashes.
Too late for 31. I guess 32 and 33 are affected. Tracking.
status-firefox31: affected → wontfix
status-firefox32: --- → affected
status-firefox33: --- → affected
tracking-firefox32: --- → +
tracking-firefox33: --- → +
I see this all the time, something in my session history reproduces it semi-reliably. Anyone want to help debug it against my shist?

/be
I hit this crash twice this morning in Fennec, running on an ARMv6 Galaxy Q device. I was just loading a bug on bugzilla when it happened.

https://crash-stats.mozilla.com/report/index/d5fba357-53f7-451c-ac0f-a9a4c2140721
https://crash-stats.mozilla.com/report/index/0152e2a6-30b0-4a43-a613-d61d02140721
My wife's computer is running into this as well, https://crash-stats.mozilla.com/report/index/34ca5602-e202-4021-ae08-488772140731 (She does use pintrest but Facebook was the only thing open at the time of the crash).
Keywords: qawanted
We don't have specific steps to reproduce this crash but we have several varying scenarios on this bug. I'd like to get an engineer's perspective on what would be useful to debug this further before I dedicate QA resources.
Keywords: qawanted
FWIW I could reliably reproduce opening the PDF from comment 1 (at the time I wrote comment 2).
(In reply to Anthony Hughes, QA Mentor (:ashughes) from comment #14)
> We don't have specific steps to reproduce this crash but we have several
> varying scenarios on this bug. I'd like to get an engineer's perspective on
> what would be useful to debug this further before I dedicate QA resources.

Naveed - Can you please help with additional information for Anthony?
Flags: needinfo?(nihsanullah)
Jan please find an owner for this.
Flags: needinfo?(nihsanullah) → needinfo?(jdemooij)
(In reply to Naveed Ihsanullah [:naveed] from comment #17)
> Jan please find an owner for this.

Without STR there's not much we can do. Every release has had JIT crashes show up in crash stats..

Chris, is your girlfriend still seeing this? Apparently OS X + pinterest triggers it, we should look into that. I tried Ted's get-minidump-instructions tool (to get some JIT code around the instruction pointer), but it doesn't work here, probably because the crashes are on OS X..

Brendan, can you still reproduce the crashes?

Based on crash-stats URLs, I *am* able to reproduce a crash in EnterBaseline on another website. I'm investigating that one now; it could be the same issue.
Flags: needinfo?(jdemooij)
Flags: needinfo?(cpeterson)
Flags: needinfo?(brendan)
Jan, I haven't been able to reproduce the crash with a debug build, but I will try again.
Flags: needinfo?(cpeterson)
Assignee: nobody → jdemooij
As we don't have STR or any concrete next steps, I'm marking this as won't fix for 32. (Final beta build before RC happens Thu.) If we can't come up with any more useful information, it may be worth resolving this bug as invalid.
status-firefox32: affected → wontfix
status-firefox34: --- → affected
Something in my session state shifted, I'm not seeing this.

/be
Flags: needinfo?(brendan)
As Lawrence suggested, I am not going to track this bug for 33 or 34.
tracking-firefox33: + → -
tracking-firefox34: --- → -
some thunderbird userse also getting both signatures

 js::jit::IonCannon(JSContext*, js::RunState&) bp-d5b55e6c-207e-4ce3-ab50-fc23a2140318
  EnterBaseline bp-d6738939-695a-438a-86b7-a610c2140916
Whiteboard: [DUPEME] → [DUPEME][tbird crash]
I have a thunderbird user who somewhat easily reproduce this. Perhaps I can get him to cc: the bug report.  He reports
works 29.0b1
fails 30.0b1 bp-e412d9d7-6c10-4abb-bbac-ec3412140922

Do you want a more refined regression range?
Flags: needinfo?(jdemooij)
(In reply to Wayne Mery (:wsmwk) from comment #24)
> Do you want a more refined regression range?

If you can get a more refined regression range that would definitely help. We don't have a lot of information to go on. The crash report here are quite generic and we don't have STR (steps to reproduce) to try ourself.

Another thing that would help is "steps to reproduce". If he can give more information about when this triggers and when not?
Flags: needinfo?(jdemooij)
I've asked the user at https://support.mozilla.org/en-US/questions/1020360#answer-631956 

As for steps, we don't currently have anything more than it's a startup crash.
Reporter adds ... (the *first*) 30.0a2 fails from http://ftp.mozilla.org/pub/mozilla.org/thunderbird/nightly/2014/03/2014-03-18-05-44-44-comm-aurora/ 

This failing 30.0a2 is built on the *same* day as the last 30.0a1 which *works*.  30.0a2 was built from ...

mbanner@mozilla.com
Tue Mar 18 08:36:04 2014 +0000	166a3e8cac27	Mark Banner — Added tag AURORA_BASE_20140318 for changeset 465fb05fd061 a=auroramerge DONTBUILD CLOSED TREE

So reporter's added info roughly cuts in the regression range?
http://hg.mozilla.org/mozilla-central/pushloghtml?startdate=2014-03-18+03%3A02%3A00&enddate=2014-03-18+05%3A44%3A00
Looking at the regression range and the fact this is IonMonkey related, this could be any of the following:

> 	405082f9ce44	Terrence Cole — Bug 984684 - Do not fire barriers on shared atoms; r=bhackett
> 	6311a62c5901	Terrence Cole — Bug 957723 - Decommit unused portions of the nursery; r=jonco
> 	ce6a8fa5db7d	Brian Hackett — Bug 979480 - Don't store array buffer contents in elements, r=sfink.
> 	b239389ec1e6	Steve Fink — Bug 981809 - Postbarrier WeakMapPtr keys, r=terrence
> 	ed7130b21a68	Terrence Cole — Bug 957723 - Decommit unused portions of the nursery; r=jonco
> 	0ae9c4eef8d6	Jon Coppeard — Bug 959787 - Handlify some friend and debug APIs r=sfink r=bholley
> 	9f41c59d6a59	Jon Coppeard — Bug 959787 - Handlify JS_ExecuteScript, JS_EvaluateScript and other JS APIs r=sfink r=bz

(Most unlikely it could also be one of the following)
> 	32c15c55685d	Peter Van der Beken — Bug 983620 - Remove the unused aScope argument from WrapGlobalObject. r=bz.
> 	8aca83520a91	Peter Van der Beken — Bug 983619 - Add Window.getInterface/QueryInterface to WebIDL. r=bz.
> 	570a5c5c8e38	Peter Van der Beken — Bug 982114 - Deal with new DOM binding objects for Window in more places. r=bz.
> 	f61df670d962	Peter Van der Beken — Bug 982112 - Make accesscheck code deal with WebIDL bindings. r=bz.
I started seeing this crash again: once on 1/8 and then about 1–5 times per day between 1/18 and 1/25. No crashes since them. This is probably triggered by Pinterest pinning or leaving a Pinterest page open for a long time.
Crash Signature: [@ js::jit::IonCannon(JSContext*, js::RunState&) ] → [@ js::jit::IonCannon(JSContext*, js::RunState&) ] [@ js::jit::IonCannon ]
(In reply to Chris Peterson [:cpeterson] from comment #30)
> I started seeing this crash again: once on 1/8 and then about 1–5 times per
> day between 1/18 and 1/25. No crashes since them. This is probably triggered
> by Pinterest pinning or leaving a Pinterest page open for a long time.

crash IDs?

90% of crashes are Mac, send place is android.  

js::jit::IonCannon(JSContext*, js::RunState&) is on the rise per the graph for https://crash-stats.mozilla.com/signature/?date=%3E2015-09-01&signature=js%3A%3Ajit%3A%3AIonCannon%28JSContext*%2C+js%3A%3ARunState%26%29#graphs (In mid-october it was tripple sept 1's rate) ... until the signature refactor came in https://crash-stats.mozilla.com/signature/?date=%3E2015-09-01&signature=js%3A%3Ajit%3A%3AIonCannon&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=platform&_columns=reason&_columns=address&page=1#graphs where the rate is still higher

I had a look at all the bugs of comment 29. None have open regressions marked against them
Flags: needinfo?(cpeterson)
I started getting a crash here consistently on today's Nightly (2016-03-21) on Mac using Google Inbox.

https://crash-stats.mozilla.com/report/index/1e8e2fc0-953a-4983-8fd7-de2322160322
Crash volume for signature 'js::jit::IonCannon':
 - nightly (version 50): 0 crash from 2016-06-06.
 - aurora  (version 49): 4 crashes from 2016-06-07.
 - beta    (version 48): 19 crashes from 2016-06-06.
 - release (version 47): 139 crashes from 2016-05-31.
 - esr     (version 45): 391 crashes from 2016-04-07.

Crash volume on the last weeks:
             Week N-1   Week N-2   Week N-3   Week N-4   Week N-5   Week N-6   Week N-7
 - nightly          0          0          0          0          0          0          0
 - aurora           1          0          2          0          0          0          0
 - beta             3          2          0          0         11          2          0
 - release         17         27         18         24         27         16          3
 - esr             34         32         34         33         32         40         36

Affected platforms: Windows, Mac OS X, Linux
status-firefox47: --- → affected
status-firefox48: --- → affected
status-firefox49: --- → affected
status-firefox-esr45: --- → affected
(Still no STR, alas.)
Priority: -- → P3
Crash volume for signature 'js::jit::IonCannon':
 - nightly (version 52): 2 crashes from 2016-09-19.
 - aurora  (version 51): 26 crashes from 2016-09-19.
 - beta    (version 50): 12 crashes from 2016-09-20.
 - release (version 49): 94 crashes from 2016-09-05.
 - esr     (version 45): 431 crashes from 2016-07-25.

Crash volume on the last weeks (Week N is from 10-17 to 10-23):
            W. N-1  W. N-2  W. N-3  W. N-4
 - nightly       0       1       0       1
 - aurora       11       7       2       3
 - beta          5       3       2       1
 - release      19      26      25      11
 - esr          50      36      35      50

Affected platforms: Windows, Mac OS X, Linux

Crash rank on the last 7 days:
           Browser   Content     Plugin
 - nightly
 - aurora  #143      #395
 - beta    #2633     #3663
 - release #2186     #800
 - esr     #195
status-firefox50: --- → affected
status-firefox51: --- → affected
status-firefox52: --- → affected
Mass wontfix for bugs affecting firefox 52.
status-firefox52: affected → wontfix
Assignee: jdemooij → nobody
Whiteboard: [DUPEME][tbird crash] → [DUPEME][tbird crash][#jsapi:crashes-retriage]
Closing as there doesn't seem to be anything here still worth tracking separately.

The meta-bug for current JIT crash signatures is Bug 858032.
Blocks: SadJit
Status: REOPENED → RESOLVED
Closed: 10 years ago → 6 years ago
Resolution: --- → INCOMPLETE
Whiteboard: [DUPEME][tbird crash][#jsapi:crashes-retriage] → [DUPEME][tbird crash]
You need to log in before you can comment on or make changes to this bug.