Closed Bug 1352627 Opened 9 years ago Closed 8 years ago

Permaorange crash on Windows cgc from bug 1331092 when Gecko 55 merges to aurora on 2017-04-17

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Version:
55 Branch
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1351467
Tracking Flags:
Tracking Status
firefox-esr45 --- unaffected
firefox52 --- unaffected
firefox-esr52 --- unaffected
firefox53 --- unaffected
firefox54 --- unaffected
firefox55 + fix-optional

People

(Reporter: philor, Unassigned)

References

Details

(Keywords: regression)

It's not exactly a useful crash, https://treeherder.mozilla.org/logviewer.html#?job_id=87878038&repo=try from https://treeherder.mozilla.org/#/jobs?repo=try&revision=f48d18a36c3d67fd537923eea9edcbb737c68af6&selectedJob=87878038, but it's pretty easy to reproduce: https://bug1351467.bmoattachments.org/attachment.cgi?id=8852871 is enough to get rid of the NIGHTLY_BUILD define, and prior to the landing of bug 1331092 that produced the different bustage of bug 1351467 on Windows SM(cgc) (so I don't expect you to get back to green, unless that gets fixed first), but now it's just useless crashing. [Tracking Requested - why for this release]: merge permaorange, closed tree, sadness.
Flags: needinfo?(arai.unmht)
I suspect it's something related to bug 1350762 (that touched jsapi-tests). pushed try run on it, without bug 1331092. https://treeherder.mozilla.org/#/jobs?repo=try&revision=1c3af0e2f4627ebb072f6e922eadc2ee2486cd50
so apparently it's from Part 2, that adds the basic implementation of async generator. I guess it's from the change in the size of the global object and the GC timing. (that discovered bug 1350762 also)
(In reply to Tooru Fujisawa [:arai] from comment #4) > I guess it's from the change in the size of the global object and the GC > timing. > (that discovered bug 1350762 also) actually, bug 1350762's case was from additional self-hosted JS function, not global object :P
(In reply to Tooru Fujisawa [:arai] from comment #7) > Part 0-1 + AsyncIteration.js : > https://treeherder.mozilla.org/#/jobs?repo=try&revision=f1b51c8b8e079fcea05bfede8c61fc2fe60b5558 it crashes. so it should be a similar issue as bug bug 1350762, that was caused by the different GC timing because of the additional self-hosted JS function.
Flags: needinfo?(arai.unmht)
Tracking 55+ per Comment 0.
tracking-firefox55: ? → +
:arai, is this something you can take care of or help find someone to take? thanks.
Flags: needinfo?(arai.unmht)
I can work on this at this weekend.
Flags: needinfo?(arai.unmht)
Note that this seems to have a rather strange status now that there is no more mozilla-aurora, since this seems to only affect !NIGHTLY_BUILD && async-generators-enabled, and although I can't see how they are disabled or a bug about enabling them, my 55-as-beta try pushes both don't show this crash and do show failures which seem to say they are disabled. If that's actually the case, rather than tracking-55 this should just be blocking a bug about enabling them on release builds.
I suspect it's simply the issue of the jsapi-test itself (not sure which one tho), just like bug 1350762. having an extra self-hosted function can change the GC timing, and in some case that reveals rooting issue or something in unrelated place than the patch itself. on beta, several more configurations are different, and it can change GC timing even more, and the issue may be hidden again. async generator itself is enabled only on non-release (so, nightly and aurora, previously), it will be enabled in bug 1352312. but the self-hosted function is there even if it's disabled. so I think the reason that it's not reproducible on beta is in different place.
Flags: needinfo?(arai.unmht)
> If that's actually the case, rather than tracking-55 this should just be blocking a bug about enabling them on release builds. Let's do that, I'll set this as a blocker of 1352312 and we don't need to track releases, since it's not leaving nightly until it's ready.
Blocks: 1352312
No longer blocks: 1331092
status-firefox55: affected → fix-optional
the issue doesn't happen on latest m-c https://treeherder.mozilla.org/#/jobs?repo=try&revision=c97e73e215653e1027bda998e503226d687f234a I'll investigate on older changeset
unfortunately I cannot investigate while tree is closed :P the result so far is that enabling only selfTest.cpp, testGCAllocator.cpp...testHashTable.cpp, and tests.cpp in js/src/jsapi-tests/moz.build still causes the crash. I'll configure bisecting after the tree gets opened.
> I'll configure *continue
apparently it's testGCGrayMarking.cpp, just like bug 1350762. I guess there's some more places that needs rooting. https://treeherder.mozilla.org/#/jobs?repo=try&revision=5ae48bd0e58a3911dc44f35560db1122c8a6fb8b
Flags: needinfo?(arai.unmht)
looks like there's several places that unrooted object lives across AllocPlainObject() that calls JS_NewPlainObject that can GC. (and maybe some more rooting issue) I'm not sure just rooting everything in the test is the right thing to do, since looks like it's testing GC itself. jonco, can you take a look?
Flags: needinfo?(jcoppeard)
Arai, thanks for looking into this. This is most likely a dupe of bug 1351467. I'll push a try build to see if this works with the patch in that bug.
The CGC builds are now green on try: https://treeherder.mozilla.org/#/jobs?repo=try&revision=d1150faae85f723247542b045569abc3f80a5432&group_state=expanded&selectedJob=93743511
Status: NEW → RESOLVED
Closed: 8 years ago
Flags: needinfo?(jcoppeard)
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.