1011075 - crash in FinalizeTypedArenas<JSObject> first appeared on 2014-05-14

Status: RESOLVED WORKSFORME

(Core :: JavaScript: GC, defect)

Description

[u279076]

This bug was filed from the Socorro interface and is 
report bp-bfb086cf-d064-490c-a92b-e1c052140514.
=============================================================
0 	mozjs.dll 	FinalizeTypedArenas<JSObject> 	js/src/jsgc.cpp
1 	mozjs.dll 	FinalizeArenas 	js/src/jsgc.cpp
2 	nss3.dll 	_PR_MD_WAIT_CV 	nsprpub/pr/src/md/windows/w95cv.c

=============================================================
More reports:
https://crash-stats.mozilla.com/report/list?signature=FinalizeTypedArenas%3CJSObject%3E#tab-reports

This is a new signature which first appeared with yesterday's builds. So far I'm only seeing reports with that build (ie. No other Firefox versions seem to be affected).

https://hg.mozilla.org/releases/mozilla-aurora/pushloghtml?fromchange=799d1ce4d82e&tochange=fcbb78e6392e

Comment 1

[Terrence Cole [:terrence]]

There's nothing obvious in the regression range, but it's a small enough range that maybe one of the authors there can spot the issue?

Comment 2

[u279076]

This has been rising significantly and is now the #2 topcrash for Firefox 31.

Comment 3

[u279076]

FYI, I've sent an email to all the engineers indicated in the pushlog from comment 0. Hopefully that yeilds some successful results.

Comment 4

[(Away)]

It's the AMD bug again :(

Cpu info facet Rank 	Cpu info 	Count 	%
1 	AuthenticAMD family 20 model 1 stepping 0 | 2 	60 	49.18 %
2 	AuthenticAMD family 20 model 2 stepping 0 | 2 	50 	40.98 %
3 	AuthenticAMD family 20 model 1 stepping 0 | 1 	12 	9.84 %

Comment 5

[Benjamin Smedberg]

Indeed. Don't need to track further.

Comment 6

[Sylvestre Ledru [:Sylvestre]]

OK, untracking.

Comment 7

[u279076]

Looks like it's back again with 31b2:
https://crash-analysis.mozilla.com/rkaiser/2014-06-22/2014-06-22.firefox.31.explosiveness.html

I think we should keep this tracked until after we release, just to be safe.

Comment 8

[u279076]

Is this signature related?
https://crash-stats.mozilla.com/report/list?signature=arena_dalloc%20|%20je_free%20|%20FinalizeTypedArenas%3CJSObject%3E

Comment 9

[Sylvestre Ledru [:Sylvestre]]

Anthony, I am then reopening this bug.

Comment 10

[(Away)]

I can't get into supersearch at the moment, but from a quick glance the 31b crashes are not AMD-related. It is likely a real code issue this time.

Comment 11

[(Away)]

Does the timing of this match up with GGC? The crash addresses are all over the place. There's a bit of variation in stacks but they usually share:

FinalizeTypedArenas<JSObject>
FinalizeArenas
SweepBackgroundThings

Comment 12

[Robert Kaiser]

Hmm, I don't see this signature too much with anything other than 31.0b2 or 31.ob3, the newer betas seem to not suffer from it.

Comment 13

[Sylvestre Ledru [:Sylvestre]]

Kairo, do you think we can mark this bug as fixed for 31 (at least)?

Comment 14

[Robert Kaiser]

(In reply to Sylvestre Ledru [:sylvestre] from comment #13)
> Kairo, do you think we can mark this bug as fixed for 31 (at least)?

No, fixed would imply that we actually applied a fix and I don't know of any. wontfix might be fine,t hough, given those are low volume now.

Comment 15

[Sylvestre Ledru [:Sylvestre]]

OK. Wontfix then. Thanks!

Comment 16

[Andrew McCreight [:mccr8]]

Bug 1232229 seems to be a newer bug for this signature.