Closed Bug 1584054 Opened 5 years ago Closed 3 years ago

Intermittent /css/css-flexbox/display_flex_exist.html | application crashed [@ 0x36ecad0a9bae]

Categories

(Core :: JavaScript Engine: JIT, defect, P5)

defect

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: intermittent-bug-filer, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: crash, intermittent-failure, regression)

Crash Data

Attachments

(1 file)

Filed by: aciure [at] mozilla.com
Parsed log: https://treeherder.mozilla.org/logviewer.html#?job_id=268492308&repo=autoland
Full log: https://queue.taskcluster.net/v1/task/az9UwQRASyeYiEuCqFT0xQ/runs/0/artifacts/public/logs/live_backing.log

[edit: replacing irrelevant log snippet with relevant log snippet]

[task 2019-09-26T02:29:30.681Z] 02:29:30     INFO - TEST-START | /css/css-flexbox/display_flex_exist.html
[task 2019-09-26T02:29:31.153Z] 02:29:31     INFO - mozcrash .
[task 2019-09-26T02:29:31.153Z] 02:29:31     INFO - mozcrash Downloading symbols from: https://queue.taskcluster.net/v1/task/KmWd6zPKTa-o0_g4rtsUzA/artifacts/public/build/target.crashreporter-symbols.zip
[task 2019-09-26T02:29:31.215Z] 02:29:31     INFO - PID 19305 | A content process crashed and MOZ_CRASHREPORTER_SHUTDOWN is set, shutting down
[task 2019-09-26T02:29:31.493Z] 02:29:31     INFO - PID 19305 | 1569464971482	Marionette	INFO	Stopped listening on port 58690
[task 2019-09-26T02:29:36.283Z] 02:29:36     INFO - mozcrash Copy/paste: /builds/worker/workspace/build/linux64-minidump_stackwalk /tmp/tmp1Afn1u.mozrunner/minidumps/629adb5f-cfca-3f05-4921-a05852469443.dmp /tmp/tmpu7Dq1g
[task 2019-09-26T02:29:44.474Z] 02:29:44     INFO - mozcrash Saved minidump as /builds/worker/workspace/build/blobber_upload_dir/629adb5f-cfca-3f05-4921-a05852469443.dmp
[task 2019-09-26T02:29:44.475Z] 02:29:44     INFO - mozcrash Saved app info as /builds/worker/workspace/build/blobber_upload_dir/629adb5f-cfca-3f05-4921-a05852469443.extra
[task 2019-09-26T02:29:44.558Z] 02:29:44     INFO - PROCESS-CRASH | /css/css-flexbox/display_flex_exist.html | application crashed [@ 0x36ecad0a9bae]
[task 2019-09-26T02:29:44.558Z] 02:29:44     INFO - Crash dump filename: /tmp/tmp1Afn1u.mozrunner/minidumps/629adb5f-cfca-3f05-4921-a05852469443.dmp
[task 2019-09-26T02:29:44.558Z] 02:29:44     INFO - Operating system: Linux
[task 2019-09-26T02:29:44.558Z] 02:29:44     INFO -                   0.0.0 Linux 4.4.0-1014-aws #14taskcluster1-Ubuntu SMP Tue Apr 3 10:27:00 UTC 2018 x86_64
[task 2019-09-26T02:29:44.559Z] 02:29:44     INFO - CPU: amd64
[task 2019-09-26T02:29:44.559Z] 02:29:44     INFO -      family 6 model 62 stepping 4
[task 2019-09-26T02:29:44.559Z] 02:29:44     INFO -      4 CPUs
[task 2019-09-26T02:29:44.559Z] 02:29:44     INFO - 
[task 2019-09-26T02:29:44.559Z] 02:29:44     INFO - GPU: UNKNOWN
[task 2019-09-26T02:29:44.560Z] 02:29:44     INFO - 
[task 2019-09-26T02:29:44.560Z] 02:29:44     INFO - Crash reason:  SIGSEGV /SEGV_ACCERR
[task 2019-09-26T02:29:44.560Z] 02:29:44     INFO - Crash address: 0x36ecad0a9bae
[task 2019-09-26T02:29:44.560Z] 02:29:44     INFO - Process uptime: not available
[task 2019-09-26T02:29:44.560Z] 02:29:44     INFO - 
[task 2019-09-26T02:29:44.560Z] 02:29:44     INFO - Thread 0 (crashed)
[...]
[task 2019-09-26T02:29:44.567Z] 02:29:44     INFO -  6  libxul.so!js::jit::EnterBaselineInterpreterAtBranch(JSContext*, js::InterpreterFrame*, unsigned char*) [BaselineJIT.cpp:8b8ce4612836d14a658c8c86763cd53a81c54372 : 184 + 0xe8]
[task 2019-09-26T02:29:44.567Z] 02:29:44     INFO -     rbp = 0x00007ffd39569eb0   rsp = 0x00007ffd39569cd0
[task 2019-09-26T02:29:44.568Z] 02:29:44     INFO -     rip = 0x00007fc3cfac838f
[task 2019-09-26T02:29:44.568Z] 02:29:44     INFO -     Found by: previous frame's frame pointer
Attached file snippet of crash log (deleted) —
Component: CSS Parsing and Computation → JavaScript Engine

The crash is in jitted code inside of EnterBaselineInterpreterAtBranch. (There aren't any symbolicated functions listed within that in the backtrace -- just hex addresses, presumably for JS code).

--> Reclassified as JS

Blocks: SadJit
Component: JavaScript Engine → JavaScript Engine: JIT
Priority: -- → P5

Marking this as Resolved > Worksforme since there are no crashes for this signature in the past 6 months.

Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: