Closed Bug 996982 Opened 10 years ago Closed 9 years ago

Intermittent browser_canvas-frontend-call-stack-01.js,browser_canvas-frontend-call-stack-02.js | application crashed [@ CreateLazyScriptsForCompartment] after "Assertion failure: fun->isInterpretedLazy(), at js\src\jscompartment.cpp:725"

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
Windows XP
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla40
Tracking Flags:
Tracking Status
firefox37 --- wontfix
firefox38 --- fixed
firefox39 --- fixed
firefox40 --- fixed
firefox-esr31 --- wontfix

People

(Reporter: RyanVM, Assigned: shu)

References

Details

(Keywords: assertion, crash, intermittent-failure)

Attachments

(2 files)

Fix Debugger script delazification logic to account for relazified clones.
3.22 KB, patch
bzbarsky
: review+
Details | Diff | Splinter Review
bug996982.patch
3.37 KB, patch
Sylvestre
: approval-mozilla-aurora+
Sylvestre
: approval-mozilla-beta+
Details | Diff | Splinter Review 
https://tbpl.mozilla.org/php/getParsedLog.php?id=37877690&tree=Mozilla-Inbound

Windows XP 32-bit mozilla-inbound debug test mochitest-devtools-chrome-1 on 2014-04-15 15:42:08 PDT for push c9fabef8ea0e
slave: t-xp32-ix-097

15:45:38     INFO -  TEST-INFO | chrome://mochitests/content/browser/browser/devtools/canvasdebugger/test/browser_canvas-frontend-call-stack-02.js | Tab added and finished loading: http://example.com/browser/browser/devtools/canvasdebugger/test/doc_simple-canvas-deep-stack.html
15:45:38     INFO -  ++DOCSHELL 0AD579C8 == 18 [pid = 272] [id = 39]
15:45:38     INFO -  ++DOMWINDOW == 36 (18DE6DE0) [pid = 272] [serial = 109] [outer = 00000000]
15:45:38     INFO -  ++DOMWINDOW == 37 (1150EB70) [pid = 272] [serial = 110] [outer = 18DE6DE0]
15:45:39     INFO -  ++DOMWINDOW == 38 (18FA3B00) [pid = 272] [serial = 111] [outer = 18DE6DE0]
15:45:39     INFO -  ++DOCSHELL 18F89608 == 19 [pid = 272] [id = 40]
15:45:39     INFO -  ++DOMWINDOW == 39 (191FCF28) [pid = 272] [serial = 112] [outer = 00000000]
15:45:39     INFO -  ++DOMWINDOW == 40 (150449E0) [pid = 272] [serial = 113] [outer = 191FCF28]
15:45:39     INFO -  TEST-INFO | chrome://mochitests/content/browser/browser/devtools/canvasdebugger/test/browser_canvas-frontend-call-stack-02.js | Waiting for event: 'navigate' on TabTarget:[object XULElement].
15:45:39     INFO -  [272] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80520012: file c:\builds\moz2_slave\m-in-w32-d-0000000000000000000\build\netwerk\base\src\nsFileStreams.cpp, line 203
15:45:39     INFO -  [272] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80520012: file c:\builds\moz2_slave\m-in-w32-d-0000000000000000000\build\netwerk\base\src\nsFileStreams.cpp, line 475
15:45:39     INFO -  [272] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80520012: file c:\builds\moz2_slave\m-in-w32-d-0000000000000000000\build\netwerk\base\src\nsFileStreams.cpp, line 203
15:45:39     INFO -  [272] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80520012: file c:\builds\moz2_slave\m-in-w32-d-0000000000000000000\build\netwerk\base\src\nsFileStreams.cpp, line 475
15:45:39     INFO -  [272] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80520012: file c:\builds\moz2_slave\m-in-w32-d-0000000000000000000\build\netwerk\base\src\nsFileStreams.cpp, line 203
15:45:39     INFO -  [272] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80520012: file c:\builds\moz2_slave\m-in-w32-d-0000000000000000000\build\netwerk\base\src\nsFileStreams.cpp, line 475
15:45:40     INFO -  ++DOMWINDOW == 41 (1139E340) [pid = 272] [serial = 114] [outer = 144CB9A0]
15:45:40     INFO -  TEST-INFO | chrome://mochitests/content/browser/browser/devtools/canvasdebugger/test/browser_canvas-frontend-call-stack-02.js | Waiting for event: 'CanvasDebugger:SnapshotRecordingFinished' on [object ChromeWindow].
15:45:40     INFO -  TEST-INFO | chrome://mochitests/content/browser/browser/devtools/canvasdebugger/test/browser_canvas-frontend-call-stack-02.js | Waiting for event: 'CanvasDebugger:CallListPopulated' on [object ChromeWindow].
15:45:40     INFO -  TEST-PASS | chrome://mochitests/content/browser/browser/devtools/canvasdebugger/test/browser_canvas-frontend-call-stack-02.js | There should be no stack container available yet for the draw call.
15:45:40     INFO -  TEST-INFO | chrome://mochitests/content/browser/browser/devtools/canvasdebugger/test/browser_canvas-frontend-call-stack-02.js | Waiting for event: 'CanvasDebugger:CallStackDisplayed' on [object ChromeWindow].
15:45:41     INFO -  TEST-PASS | chrome://mochitests/content/browser/browser/devtools/canvasdebugger/test/browser_canvas-frontend-call-stack-02.js | There should be a stack container available now for the draw call.
15:45:41     INFO -  TEST-PASS | chrome://mochitests/content/browser/browser/devtools/canvasdebugger/test/browser_canvas-frontend-call-stack-02.js | There should be 4 functions on the stack for the draw call.
15:45:41     INFO -  TEST-INFO | chrome://mochitests/content/browser/browser/devtools/canvasdebugger/test/browser_canvas-frontend-call-stack-02.js | Waiting for event: 'CanvasDebugger:SourceShownInJsDebugger' on [object ChromeWindow].
15:45:41     INFO -  ++DOCSHELL 10C47C20 == 20 [pid = 272] [id = 41]
15:45:41     INFO -  ++DOMWINDOW == 42 (145A0488) [pid = 272] [serial = 115] [outer = 00000000]
15:45:41     INFO -  ++DOMWINDOW == 43 (10B13600) [pid = 272] [serial = 116] [outer = 145A0488]
15:45:41     INFO -  [272] WARNING: Please do not use mouseenter/leave events in chrome. They are slower than mouseover/out!: '!nsContentUtils::IsChromeDoc(d)', file c:\builds\moz2_slave\m-in-w32-d-0000000000000000000\build\dom\events\EventListenerManager.cpp, line 363
15:45:41     INFO -  ++DOCSHELL 18FFAB38 == 21 [pid = 272] [id = 42]
15:45:41     INFO -  ++DOMWINDOW == 44 (1974D858) [pid = 272] [serial = 117] [outer = 00000000]
15:45:41     INFO -  ++DOMWINDOW == 45 (159A20A8) [pid = 272] [serial = 118] [outer = 1974D858]
15:45:41     INFO -  Assertion failure: fun->isInterpretedLazy(), at c:\builds\moz2_slave\m-in-w32-d-0000000000000000000\build\js\src\jscompartment.cpp:725
15:45:41     INFO -  nsStringStats
15:45:41     INFO -   => mAllocCount:         112756
15:45:41     INFO -   => mReallocCount:         5949
15:45:41     INFO -   => mFreeCount:           91751  --  LEAKED 21005 !!!
15:45:41     INFO -   => mShareCount:         204820
15:45:41     INFO -   => mAdoptCount:           6116
15:45:41     INFO -   => mAdoptFreeCount:       6113  --  LEAKED 3 !!!
15:45:41     INFO -   => Process ID: 272, Thread ID: 1980
15:45:42     INFO -  TEST-INFO | Main app process: exit status 80000003
15:45:42  WARNING -  TEST-UNEXPECTED-FAIL | chrome://mochitests/content/browser/browser/devtools/canvasdebugger/test/browser_canvas-frontend-call-stack-02.js | application terminated with exit code 2147483651
15:45:42     INFO -  INFO | runtests.py | Application ran for: 0:00:33.249000
15:45:42     INFO -  INFO | zombiecheck | Reading PID log: c:\docume~1\cltbld~1.t-x\locals~1\temp\tmpcp0levpidlog
15:45:49  WARNING -  PROCESS-CRASH | chrome://mochitests/content/browser/browser/devtools/canvasdebugger/test/browser_canvas-frontend-call-stack-02.js | application crashed [@ CreateLazyScriptsForCompartment]
15:45:49     INFO -  Crash dump filename: c:\docume~1\cltbld~1.t-x\locals~1\temp\tmp3xzdcn\minidumps\b8d05a68-8e8a-48a5-a40b-dfb07c86f283.dmp
15:45:49     INFO -  Operating system: Windows NT
15:45:49     INFO -                    5.1.2600 Service Pack 3
15:45:49     INFO -  CPU: x86
15:45:49     INFO -       GenuineIntel family 6 model 30 stepping 5
15:45:49     INFO -       8 CPUs
15:45:49     INFO -  Crash reason:  EXCEPTION_BREAKPOINT
15:45:49     INFO -  Crash address: 0xf6dabe
15:45:49     INFO -  Thread 0 (crashed)
15:45:49     INFO -   0  mozjs.dll!CreateLazyScriptsForCompartment [jscompartment.cpp:c9fabef8ea0e : 719 + 0x26]
15:45:49     INFO -      eip = 0x00f6dabe   esp = 0x00128a70   ebp = 0x00128b24   ebx = 0x17f08100
15:45:49     INFO -      esi = 0x10261440   edi = 0x1918ab08   eax = 0x00000000   ecx = 0x3b179524
15:45:49     INFO -      edx = 0x10361f48   efl = 0x00000212
15:45:49     INFO -      Found by: given as instruction pointer in context
15:45:49     INFO -   1  mozjs.dll!JSCompartment::ensureDelazifyScriptsForDebugMode(JSContext *) [jscompartment.cpp:c9fabef8ea0e : 757 + 0xf]
15:45:49     INFO -      eip = 0x00f6dd24   esp = 0x00128b2c   ebp = 0x00128b34
15:45:49     INFO -      Found by: call frame info
15:45:49     INFO -   2  mozjs.dll!js::Debugger::ScriptQuery::addCompartment(JSCompartment *) [Debugger.cpp:c9fabef8ea0e : 2577 + 0x9]
15:45:49     INFO -      eip = 0x01063dc3   esp = 0x00128b3c   ebp = 0x00128b6c
15:45:49     INFO -      Found by: call frame info
15:45:49     INFO -   3  mozjs.dll!js::Debugger::ScriptQuery::matchAllDebuggeeGlobals() [Debugger.cpp:c9fabef8ea0e : 2601 + 0x1c]
15:45:49     INFO -      eip = 0x01063f8d   esp = 0x00128b74   ebp = 0x00128b9c
15:45:49     INFO -      Found by: call frame info
15:45:49     INFO -   4  mozjs.dll!js::Debugger::findScripts(JSContext *,unsigned int,JS::Value *) [Debugger.cpp:c9fabef8ea0e : 2732 + 0x2e]
15:45:49     INFO -      eip = 0x0107f280   esp = 0x00128ba4   ebp = 0x00128d4c
15:45:49     INFO -      Found by: call frame info
15:45:49     INFO -   5  mozjs.dll!js::CallJSNative(JSContext *,bool (*)(JSContext *,unsigned int,JS::Value *),JS::CallArgs const &) [jscntxtinlines.h:c9fabef8ea0e : 239 + 0xe]
15:45:49     INFO -      eip = 0x010a8ee1   esp = 0x00128d54   ebp = 0x00128d74
15:45:49     INFO -      Found by: call frame info
15:45:49     INFO -   6  mozjs.dll!js::Invoke(JSContext *,JS::CallArgs,js::MaybeConstruct) [Interpreter.cpp:c9fabef8ea0e : 467 + 0x7]
15:45:49     INFO -      eip = 0x010b1bbe   esp = 0x00128d7c   ebp = 0x00128fa8
15:45:49     INFO -      Found by: call frame info
15:45:49     INFO -   7  mozjs.dll!Interpret [Interpreter.cpp:c9fabef8ea0e : 2621 + 0x26]
15:45:49     INFO -      eip = 0x010c728f   esp = 0x00128fb0   ebp = 0x001293b4
15:45:49     INFO -      Found by: call frame info
15:45:49     INFO -   8  mozjs.dll!js::RunScript(JSContext *,js::RunState &) [Interpreter.cpp:c9fabef8ea0e : 421 + 0x6]
15:45:49     INFO -      eip = 0x01099f43   esp = 0x001293bc   ebp = 0x001293dc
15:45:49     INFO -      Found by: call frame info
Shu-yo, is this something you might be able to help look into?
Flags: needinfo?(shu)
It was suggested on IRC that till and/or jandem might be interested in this too.
Yup, taking
Assignee: nobody → till
Flags: needinfo?(shu)
Maybe this is related to bug 996456.
Nope, nevermind, it's not.
Something seems to have made this go away.
Summary: Intermittent browser_canvas-frontend-call-stack-02.js | application crashed [@ CreateLazyScriptsForCompartment] after "Assertion failure: fun->isInterpretedLazy(), at js\src\jscompartment.cpp:725" → Intermittent browser_canvas-frontend-call-stack-01.js,browser_canvas-frontend-call-stack-02.js | application crashed [@ CreateLazyScriptsForCompartment] after "Assertion failure: fun->isInterpretedLazy(), at js\src\jscompartment.cpp:725"
Till, are we thinking that bug 1005306 might be related to this?
(In reply to Ryan VanderMeulen [:RyanVM UTC-4] from comment #19)
> Till, are we thinking that bug 1005306 might be related to this?

Yes, I'm pretty sure it is. And hopeful, but not 100% certain that the patch there will fix this whole class of crashes.
Depends on: 1005306
I still run into this once in a while. What's the status on the patches over in bug 1005306?
Flags: needinfo?(till)
Was April 2014 the time of our last OOMpocalypse?
Wish I knew how to write a test for this.
Attachment #8589290 - Flags: review?(bzbarsky)
Comment on attachment 8589290 [details] [diff] [review]
Fix Debugger script delazification logic to account for relazified clones.

>+    // Find all live all root lazy functions in the compartment: those which

s/all root/root/

r=me, but in the "create scripts" loop, can we not also skip functions which are lazy but whose lazyScriptOrNull()->maybeScript() is not null?  That is, if we have two lazy clones with the same LazyScript in lazyFunctions(), we may not need to delazify both of them; just one should be fine.  And we _certainly_ don't need to AddInnerLazyFunctionsFromScript for both of them; it's just wasted work.
Attachment #8589290 - Flags: review?(bzbarsky) → review+
(In reply to Not doing reviews right now from comment #101)
> Comment on attachment 8589290 [details] [diff] [review]
> Fix Debugger script delazification logic to account for relazified clones.
> 
> >+    // Find all live all root lazy functions in the compartment: those which
> 
> s/all root/root/
> 
> r=me, but in the "create scripts" loop, can we not also skip functions which
> are lazy but whose lazyScriptOrNull()->maybeScript() is not null?  That is,
> if we have two lazy clones with the same LazyScript in lazyFunctions(), we
> may not need to delazify both of them; just one should be fine.  And we
> _certainly_ don't need to AddInnerLazyFunctionsFromScript for both of them;
> it's just wasted work.

I think I'm not parsing the negatives correctly. How would adding lazy functions whose LazyScript have scripts result in less wasted work?
https://hg.mozilla.org/mozilla-central/rev/f5c918ce6ac5
Status: NEW → RESOLVED
Closed: 9 years ago
status-firefox40: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla40
Please nominate this for Aurora/Beta approval when you get a chance.
status-firefox37: --- → wontfix
status-firefox38: --- → affected
status-firefox39: --- → affected
status-firefox-esr31: --- → unaffected
Flags: needinfo?(till)
(In reply to Ryan VanderMeulen [:RyanVM UTC-4] from comment #114)
> Please nominate this for Aurora/Beta approval when you get a chance.
Assignee: till → shu
Flags: needinfo?(shu)
Attached patch bug996982.patch — — Splinter Review 
Approval Request Comment
[Feature/regressing bug #]: 934799
[User impact if declined]: Rare crashes when using debugger
[Describe test coverage new/current, TreeHerder]: On m-c.
[Risks and why]: Low, bug fix with no visible user behavior change.
[String/UUID change made/needed]: None.
Flags: needinfo?(shu)
Attachment #8591890 - Flags: approval-mozilla-beta?
Attachment #8591890 - Flags: approval-mozilla-aurora?
Comment on attachment 8591890 [details] [diff] [review]
bug996982.patch

Should be in 38 beta 5.
Attachment #8591890 - Flags: approval-mozilla-beta?
Attachment #8591890 - Flags: approval-mozilla-beta+
Attachment #8591890 - Flags: approval-mozilla-aurora?
Attachment #8591890 - Flags: approval-mozilla-aurora+
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: