Closed Bug 996982 Opened 11 years ago Closed 10 years ago

Intermittent browser_canvas-frontend-call-stack-01.js,browser_canvas-frontend-call-stack-02.js | application crashed [@ CreateLazyScriptsForCompartment] after "Assertion failure: fun->isInterpretedLazy(), at js\src\jscompartment.cpp:725"

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
Windows XP
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla40
Tracking Flags:
Tracking Status
firefox37 --- wontfix
firefox38 --- fixed
firefox39 --- fixed
firefox40 --- fixed
firefox-esr31 --- wontfix

People

(Reporter: RyanVM, Assigned: shu)

References

Details

(Keywords: assertion, crash, intermittent-failure)

Attachments

(2 files)

Fix Debugger script delazification logic to account for relazified clones.
3.22 KB, patch
bzbarsky
: review+
Details | Diff | Splinter Review
bug996982.patch
3.37 KB, patch
Sylvestre
: approval-mozilla-aurora+
Sylvestre
: approval-mozilla-beta+
Details | Diff | Splinter Review
https://tbpl.mozilla.org/php/getParsedLog.php?id=37877690&tree=Mozilla-Inbound Windows XP 32-bit mozilla-inbound debug test mochitest-devtools-chrome-1 on 2014-04-15 15:42:08 PDT for push c9fabef8ea0e slave: t-xp32-ix-097 15:45:38 INFO - TEST-INFO | chrome://mochitests/content/browser/browser/devtools/canvasdebugger/test/browser_canvas-frontend-call-stack-02.js | Tab added and finished loading: http://example.com/browser/browser/devtools/canvasdebugger/test/doc_simple-canvas-deep-stack.html 15:45:38 INFO - ++DOCSHELL 0AD579C8 == 18 [pid = 272] [id = 39] 15:45:38 INFO - ++DOMWINDOW == 36 (18DE6DE0) [pid = 272] [serial = 109] [outer = 00000000] 15:45:38 INFO - ++DOMWINDOW == 37 (1150EB70) [pid = 272] [serial = 110] [outer = 18DE6DE0] 15:45:39 INFO - ++DOMWINDOW == 38 (18FA3B00) [pid = 272] [serial = 111] [outer = 18DE6DE0] 15:45:39 INFO - ++DOCSHELL 18F89608 == 19 [pid = 272] [id = 40] 15:45:39 INFO - ++DOMWINDOW == 39 (191FCF28) [pid = 272] [serial = 112] [outer = 00000000] 15:45:39 INFO - ++DOMWINDOW == 40 (150449E0) [pid = 272] [serial = 113] [outer = 191FCF28] 15:45:39 INFO - TEST-INFO | chrome://mochitests/content/browser/browser/devtools/canvasdebugger/test/browser_canvas-frontend-call-stack-02.js | Waiting for event: 'navigate' on TabTarget:[object XULElement]. 15:45:39 INFO - [272] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80520012: file c:\builds\moz2_slave\m-in-w32-d-0000000000000000000\build\netwerk\base\src\nsFileStreams.cpp, line 203 15:45:39 INFO - [272] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80520012: file c:\builds\moz2_slave\m-in-w32-d-0000000000000000000\build\netwerk\base\src\nsFileStreams.cpp, line 475 15:45:39 INFO - [272] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80520012: file c:\builds\moz2_slave\m-in-w32-d-0000000000000000000\build\netwerk\base\src\nsFileStreams.cpp, line 203 15:45:39 INFO - [272] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80520012: file c:\builds\moz2_slave\m-in-w32-d-0000000000000000000\build\netwerk\base\src\nsFileStreams.cpp, line 475 15:45:39 INFO - [272] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80520012: file c:\builds\moz2_slave\m-in-w32-d-0000000000000000000\build\netwerk\base\src\nsFileStreams.cpp, line 203 15:45:39 INFO - [272] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80520012: file c:\builds\moz2_slave\m-in-w32-d-0000000000000000000\build\netwerk\base\src\nsFileStreams.cpp, line 475 15:45:40 INFO - ++DOMWINDOW == 41 (1139E340) [pid = 272] [serial = 114] [outer = 144CB9A0] 15:45:40 INFO - TEST-INFO | chrome://mochitests/content/browser/browser/devtools/canvasdebugger/test/browser_canvas-frontend-call-stack-02.js | Waiting for event: 'CanvasDebugger:SnapshotRecordingFinished' on [object ChromeWindow]. 15:45:40 INFO - TEST-INFO | chrome://mochitests/content/browser/browser/devtools/canvasdebugger/test/browser_canvas-frontend-call-stack-02.js | Waiting for event: 'CanvasDebugger:CallListPopulated' on [object ChromeWindow]. 15:45:40 INFO - TEST-PASS | chrome://mochitests/content/browser/browser/devtools/canvasdebugger/test/browser_canvas-frontend-call-stack-02.js | There should be no stack container available yet for the draw call. 15:45:40 INFO - TEST-INFO | chrome://mochitests/content/browser/browser/devtools/canvasdebugger/test/browser_canvas-frontend-call-stack-02.js | Waiting for event: 'CanvasDebugger:CallStackDisplayed' on [object ChromeWindow]. 15:45:41 INFO - TEST-PASS | chrome://mochitests/content/browser/browser/devtools/canvasdebugger/test/browser_canvas-frontend-call-stack-02.js | There should be a stack container available now for the draw call. 15:45:41 INFO - TEST-PASS | chrome://mochitests/content/browser/browser/devtools/canvasdebugger/test/browser_canvas-frontend-call-stack-02.js | There should be 4 functions on the stack for the draw call. 15:45:41 INFO - TEST-INFO | chrome://mochitests/content/browser/browser/devtools/canvasdebugger/test/browser_canvas-frontend-call-stack-02.js | Waiting for event: 'CanvasDebugger:SourceShownInJsDebugger' on [object ChromeWindow]. 15:45:41 INFO - ++DOCSHELL 10C47C20 == 20 [pid = 272] [id = 41] 15:45:41 INFO - ++DOMWINDOW == 42 (145A0488) [pid = 272] [serial = 115] [outer = 00000000] 15:45:41 INFO - ++DOMWINDOW == 43 (10B13600) [pid = 272] [serial = 116] [outer = 145A0488] 15:45:41 INFO - [272] WARNING: Please do not use mouseenter/leave events in chrome. They are slower than mouseover/out!: '!nsContentUtils::IsChromeDoc(d)', file c:\builds\moz2_slave\m-in-w32-d-0000000000000000000\build\dom\events\EventListenerManager.cpp, line 363 15:45:41 INFO - ++DOCSHELL 18FFAB38 == 21 [pid = 272] [id = 42] 15:45:41 INFO - ++DOMWINDOW == 44 (1974D858) [pid = 272] [serial = 117] [outer = 00000000] 15:45:41 INFO - ++DOMWINDOW == 45 (159A20A8) [pid = 272] [serial = 118] [outer = 1974D858] 15:45:41 INFO - Assertion failure: fun->isInterpretedLazy(), at c:\builds\moz2_slave\m-in-w32-d-0000000000000000000\build\js\src\jscompartment.cpp:725 15:45:41 INFO - nsStringStats 15:45:41 INFO - => mAllocCount: 112756 15:45:41 INFO - => mReallocCount: 5949 15:45:41 INFO - => mFreeCount: 91751 -- LEAKED 21005 !!! 15:45:41 INFO - => mShareCount: 204820 15:45:41 INFO - => mAdoptCount: 6116 15:45:41 INFO - => mAdoptFreeCount: 6113 -- LEAKED 3 !!! 15:45:41 INFO - => Process ID: 272, Thread ID: 1980 15:45:42 INFO - TEST-INFO | Main app process: exit status 80000003 15:45:42 WARNING - TEST-UNEXPECTED-FAIL | chrome://mochitests/content/browser/browser/devtools/canvasdebugger/test/browser_canvas-frontend-call-stack-02.js | application terminated with exit code 2147483651 15:45:42 INFO - INFO | runtests.py | Application ran for: 0:00:33.249000 15:45:42 INFO - INFO | zombiecheck | Reading PID log: c:\docume~1\cltbld~1.t-x\locals~1\temp\tmpcp0levpidlog 15:45:49 WARNING - PROCESS-CRASH | chrome://mochitests/content/browser/browser/devtools/canvasdebugger/test/browser_canvas-frontend-call-stack-02.js | application crashed [@ CreateLazyScriptsForCompartment] 15:45:49 INFO - Crash dump filename: c:\docume~1\cltbld~1.t-x\locals~1\temp\tmp3xzdcn\minidumps\b8d05a68-8e8a-48a5-a40b-dfb07c86f283.dmp 15:45:49 INFO - Operating system: Windows NT 15:45:49 INFO - 5.1.2600 Service Pack 3 15:45:49 INFO - CPU: x86 15:45:49 INFO - GenuineIntel family 6 model 30 stepping 5 15:45:49 INFO - 8 CPUs 15:45:49 INFO - Crash reason: EXCEPTION_BREAKPOINT 15:45:49 INFO - Crash address: 0xf6dabe 15:45:49 INFO - Thread 0 (crashed) 15:45:49 INFO - 0 mozjs.dll!CreateLazyScriptsForCompartment [jscompartment.cpp:c9fabef8ea0e : 719 + 0x26] 15:45:49 INFO - eip = 0x00f6dabe esp = 0x00128a70 ebp = 0x00128b24 ebx = 0x17f08100 15:45:49 INFO - esi = 0x10261440 edi = 0x1918ab08 eax = 0x00000000 ecx = 0x3b179524 15:45:49 INFO - edx = 0x10361f48 efl = 0x00000212 15:45:49 INFO - Found by: given as instruction pointer in context 15:45:49 INFO - 1 mozjs.dll!JSCompartment::ensureDelazifyScriptsForDebugMode(JSContext *) [jscompartment.cpp:c9fabef8ea0e : 757 + 0xf] 15:45:49 INFO - eip = 0x00f6dd24 esp = 0x00128b2c ebp = 0x00128b34 15:45:49 INFO - Found by: call frame info 15:45:49 INFO - 2 mozjs.dll!js::Debugger::ScriptQuery::addCompartment(JSCompartment *) [Debugger.cpp:c9fabef8ea0e : 2577 + 0x9] 15:45:49 INFO - eip = 0x01063dc3 esp = 0x00128b3c ebp = 0x00128b6c 15:45:49 INFO - Found by: call frame info 15:45:49 INFO - 3 mozjs.dll!js::Debugger::ScriptQuery::matchAllDebuggeeGlobals() [Debugger.cpp:c9fabef8ea0e : 2601 + 0x1c] 15:45:49 INFO - eip = 0x01063f8d esp = 0x00128b74 ebp = 0x00128b9c 15:45:49 INFO - Found by: call frame info 15:45:49 INFO - 4 mozjs.dll!js::Debugger::findScripts(JSContext *,unsigned int,JS::Value *) [Debugger.cpp:c9fabef8ea0e : 2732 + 0x2e] 15:45:49 INFO - eip = 0x0107f280 esp = 0x00128ba4 ebp = 0x00128d4c 15:45:49 INFO - Found by: call frame info 15:45:49 INFO - 5 mozjs.dll!js::CallJSNative(JSContext *,bool (*)(JSContext *,unsigned int,JS::Value *),JS::CallArgs const &) [jscntxtinlines.h:c9fabef8ea0e : 239 + 0xe] 15:45:49 INFO - eip = 0x010a8ee1 esp = 0x00128d54 ebp = 0x00128d74 15:45:49 INFO - Found by: call frame info 15:45:49 INFO - 6 mozjs.dll!js::Invoke(JSContext *,JS::CallArgs,js::MaybeConstruct) [Interpreter.cpp:c9fabef8ea0e : 467 + 0x7] 15:45:49 INFO - eip = 0x010b1bbe esp = 0x00128d7c ebp = 0x00128fa8 15:45:49 INFO - Found by: call frame info 15:45:49 INFO - 7 mozjs.dll!Interpret [Interpreter.cpp:c9fabef8ea0e : 2621 + 0x26] 15:45:49 INFO - eip = 0x010c728f esp = 0x00128fb0 ebp = 0x001293b4 15:45:49 INFO - Found by: call frame info 15:45:49 INFO - 8 mozjs.dll!js::RunScript(JSContext *,js::RunState &) [Interpreter.cpp:c9fabef8ea0e : 421 + 0x6] 15:45:49 INFO - eip = 0x01099f43 esp = 0x001293bc ebp = 0x001293dc 15:45:49 INFO - Found by: call frame info
Shu-yo, is this something you might be able to help look into?
Flags: needinfo?(shu)
It was suggested on IRC that till and/or jandem might be interested in this too.
Yup, taking
Assignee: nobody → till
Flags: needinfo?(shu)
Maybe this is related to bug 996456.
Nope, nevermind, it's not.
Something seems to have made this go away.
Summary: Intermittent browser_canvas-frontend-call-stack-02.js | application crashed [@ CreateLazyScriptsForCompartment] after "Assertion failure: fun->isInterpretedLazy(), at js\src\jscompartment.cpp:725" → Intermittent browser_canvas-frontend-call-stack-01.js,browser_canvas-frontend-call-stack-02.js | application crashed [@ CreateLazyScriptsForCompartment] after "Assertion failure: fun->isInterpretedLazy(), at js\src\jscompartment.cpp:725"
Till, are we thinking that bug 1005306 might be related to this?
(In reply to Ryan VanderMeulen [:RyanVM UTC-4] from comment #19) > Till, are we thinking that bug 1005306 might be related to this? Yes, I'm pretty sure it is. And hopeful, but not 100% certain that the patch there will fix this whole class of crashes.
Depends on: 1005306
I still run into this once in a while. What's the status on the patches over in bug 1005306?
Flags: needinfo?(till)
Was April 2014 the time of our last OOMpocalypse?
Wish I knew how to write a test for this.
Attachment #8589290 - Flags: review?(bzbarsky)
Comment on attachment 8589290 [details] [diff] [review] Fix Debugger script delazification logic to account for relazified clones. >+ // Find all live all root lazy functions in the compartment: those which s/all root/root/ r=me, but in the "create scripts" loop, can we not also skip functions which are lazy but whose lazyScriptOrNull()->maybeScript() is not null? That is, if we have two lazy clones with the same LazyScript in lazyFunctions(), we may not need to delazify both of them; just one should be fine. And we _certainly_ don't need to AddInnerLazyFunctionsFromScript for both of them; it's just wasted work.
Attachment #8589290 - Flags: review?(bzbarsky) → review+
(In reply to Not doing reviews right now from comment #101) > Comment on attachment 8589290 [details] [diff] [review] > Fix Debugger script delazification logic to account for relazified clones. > > >+ // Find all live all root lazy functions in the compartment: those which > > s/all root/root/ > > r=me, but in the "create scripts" loop, can we not also skip functions which > are lazy but whose lazyScriptOrNull()->maybeScript() is not null? That is, > if we have two lazy clones with the same LazyScript in lazyFunctions(), we > may not need to delazify both of them; just one should be fine. And we > _certainly_ don't need to AddInnerLazyFunctionsFromScript for both of them; > it's just wasted work. I think I'm not parsing the negatives correctly. How would adding lazy functions whose LazyScript have scripts result in less wasted work?
https://hg.mozilla.org/mozilla-central/rev/f5c918ce6ac5
Status: NEW → RESOLVED
Closed: 10 years ago
status-firefox40: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla40
Please nominate this for Aurora/Beta approval when you get a chance.
status-firefox37: --- → wontfix
status-firefox38: --- → affected
status-firefox39: --- → affected
status-firefox-esr31: --- → unaffected
Flags: needinfo?(till)
(In reply to Ryan VanderMeulen [:RyanVM UTC-4] from comment #114) > Please nominate this for Aurora/Beta approval when you get a chance.
Assignee: till → shu
Flags: needinfo?(shu)
Attached patch bug996982.patch — — Splinter Review
Approval Request Comment [Feature/regressing bug #]: 934799 [User impact if declined]: Rare crashes when using debugger [Describe test coverage new/current, TreeHerder]: On m-c. [Risks and why]: Low, bug fix with no visible user behavior change. [String/UUID change made/needed]: None.
Flags: needinfo?(shu)
Attachment #8591890 - Flags: approval-mozilla-beta?
Attachment #8591890 - Flags: approval-mozilla-aurora?
Comment on attachment 8591890 [details] [diff] [review] bug996982.patch Should be in 38 beta 5.
Attachment #8591890 - Flags: approval-mozilla-beta?
Attachment #8591890 - Flags: approval-mozilla-beta+
Attachment #8591890 - Flags: approval-mozilla-aurora?
Attachment #8591890 - Flags: approval-mozilla-aurora+
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: