991833 - Recent spike in crashes with js::jit::DoGetPropFallback

Status: NEW

(Core :: JavaScript Engine: JIT, defect, P3)

Description

[u279076]

I've seen a recent spike in the following crash in Firefox Nightly 31.0a1 starting on 2014-03-29. Nearly every comment mentions SoundCloud. It is currently the #5 topcrash for Firefox 31, accounting for 2.21% of the browser crashes.

This bug was filed from the Socorro interface and is 
report bp-8ff6d5c0-9c61-4f6f-bd71-057b32140403.
=============================================================
0 		@0x1adb8a38 	
1 	mozjs.dll 	js::jit::DoGetPropFallback 	js/src/jit/BaselineIC.cpp
2 		@0x163b54a9 	
3 		@0x262bb691 	
4 		@0x18d9d678 	
5 		@0x163b08f4 	
6 	mozjs.dll 	EnterBaseline 	js/src/jit/BaselineJIT.cpp
7 	mozjs.dll 	js::RunScript(JSContext *,js::RunState &) 	js/src/vm/Interpreter.cpp
8 	mozjs.dll 	js::Invoke(JSContext *,JS::CallArgs,js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
9 	mozjs.dll 	js_fun_apply(JSContext *,unsigned int,JS::Value *) 	js/src/jsfun.cpp
10 	nss3.dll 	PR_AttachThread 	nsprpub/pr/src/threads/combined/pruthr.c
11 	mozjs.dll 	js::PropDesc::initialize(JSContext *,JS::Value const &,bool) 	js/src/jsobj.cpp

More reports:
https://crash-stats.mozilla.com/report/list?signature=js%3A%3Ajit%3A%3ADoGetPropFallback&product=Firefox&query_type=contains&range_unit=weeks&process_type=any&version=Firefox%3A31.0a1&hang_type=any&date=2014-04-03+18%3A00%3A00&range_value=1

Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=6fa163ff81a3&tochange=4f3443da36a1

Not sure if it's related but this correlates to the build we turned on GGC via bug 619558.

Comment 1

[u279076]

(In reply to Anthony Hughes, QA Mentor (:ashughes) from comment #0)
> Not sure if it's related but this correlates to the build we turned on GGC
> via bug 619558.

Terrence, can you please look into this?

Comment 2

[Paul Silaghi, QA [:pauly]]

(In reply to Anthony Hughes, QA Mentor (:ashughes) from comment #0)
> I've seen a recent spike in the following crash in Firefox Nightly 31.0a1
> starting on 2014-03-29. Nearly every comment mentions SoundCloud.
I got some other crash signatures on soundcloud - https://bugzilla.mozilla.org/show_bug.cgi?id=991752#c4

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I hit this on Mac too:

bp-fb29a7ea-e1bd-41a9-955f-22a982140409

I was using the mouse wheel to zoom out on Google Maps when this happened.

Comment 4

[Terrence Cole [:terrence]]

The crash spike here has reduced to a trickle. It does not, however, line up with any GGC related fixes or with the other GGC crashes under bug 994589: I think this is likely not related to GGC.

Comment 5

[Sylvestre Ledru [:Sylvestre]]

AFAIK, this is no longer a top crasher. Untrack it!

Comment 6

[Robert Kaiser]

(In reply to Sylvestre Ledru [:sylvestre] from comment #5)
> AFAIK, this is no longer a top crasher. Untrack it!

That's the argument that got us to do a point release for bug 970483. We should not do this lightly.

Comment 7

[Sylvestre Ledru [:Sylvestre]]

OK. :)

Comment 8

[Sylvestre Ledru [:Sylvestre]]

No update on this for a month and beta 8 is going to be released today. Untracking.

Comment 9

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'js::jit::DoGetPropFallback':
 - nightly (version 50): 4 crashes from 2016-06-06.
 - aurora  (version 49): 15 crashes from 2016-06-07.
 - beta    (version 48): 195 crashes from 2016-06-06.
 - release (version 47): 399 crashes from 2016-05-31.
 - esr     (version 45): 3 crashes from 2016-04-07.

Crash volume on the last weeks:
             Week N-1   Week N-2   Week N-3   Week N-4   Week N-5   Week N-6   Week N-7
 - nightly          0          2          0          0          1          1          0
 - aurora           1          3          3          4          1          2          0
 - beta            42         29         27         53         17         11          2
 - release         44         53         54         67         62         56         29
 - esr              1          0          2          0          0          0          0

Affected platforms: Windows, Mac OS X, Linux

Comment 10

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'js::jit::DoGetPropFallback':
 - nightly (version 51): 2 crashes from 2016-08-01.
 - aurora  (version 50): 1 crash from 2016-08-01.
 - beta    (version 49): 151 crashes from 2016-08-02.
 - release (version 48): 244 crashes from 2016-07-25.
 - esr     (version 45): 15 crashes from 2016-05-02.

Crash volume on the last weeks (Week N is from 08-22 to 08-28):
            W. N-1  W. N-2  W. N-3
 - nightly       2       0       0
 - aurora        0       0       0
 - beta         43      71      31
 - release      82      82      57
 - esr           2       1       5

Affected platforms: Windows, Mac OS X

Crash rank on the last 7 days:
           Browser   Content     Plugin
 - nightly
 - aurora  #1354
 - beta    #1053     #795
 - release #421      #745
 - esr     #2384

Comment 11

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'js::jit::DoGetPropFallback':
 - nightly (version 52): 1 crash from 2016-09-19.
 - aurora  (version 51): 3 crashes from 2016-09-19.
 - beta    (version 50): 13 crashes from 2016-09-20.
 - release (version 49): 244 crashes from 2016-09-05.
 - esr     (version 45): 21 crashes from 2016-06-01.

Crash volume on the last weeks (Week N is from 10-03 to 10-09):
            W. N-1  W. N-2
 - nightly       1       0
 - aurora        3       0
 - beta         10       3
 - release     181      63
 - esr           2       1

Affected platforms: Windows, Mac OS X, Linux

Crash rank on the last 7 days:
           Browser   Content     Plugin
 - nightly #1005
 - aurora  #1516     #475
 - beta    #1402     #1362
 - release #419      #203
 - esr     #2689

Comment 12

[Julien Cristau [:jcristau]]

Mass wontfix for bugs affecting firefox 52.

Comment 13

[BugBot [:suhaib / :marco/ :calixte]]

Since the crash volume is low (less than 15 per week), the severity is downgraded to S3. Feel free to change it back if you think the bug is still critical.

For more information, please visit auto_nag documentation.