V8 crash in v8::internal::RuntimeCallStats::Leave |
|||||||||||||||||
Issue descriptionLots of crashes there. Also WebKit/LayoutTests/inspector/tracing/timeline-js/timeline-runtime-stats.html flakes because of that. ERR: Received signal 11 <unknown> 000000000000\n ERR: #0 0x0000014bc637 ERR: base::debug::(anonymous namespace)::StackDumpSignalHandler()\n ERR: #1 0x7f610eebe330 ERR: <unknown>\n ERR: #2 0x00000097dd68 ERR: v8::internal::RuntimeCallStats::Leave()\n ERR: #3 0x000000a4cc1d ERR: v8::internal::(anonymous namespace)::Invoke()\n ERR: #4 0x000000a4c885 ERR: v8::internal::Execution::Call()\n ERR: #5 0x00000070ba88 ERR: v8::Script::Run()\n ERR: #6 0x0000025047ae ERR: blink::V8ScriptRunner::runCompiledScript()\n Dump of assembler code for function _ZN2v88internal16RuntimeCallStats5LeaveEPS1_PNS0_16RuntimeCallTimerE: 0x000000000097dd40 <+0>: push %r14 0x000000000097dd42 <+2>: push %rbx 0x000000000097dd43 <+3>: push %rax 0x000000000097dd44 <+4>: mov %rsi,%r14 0x000000000097dd47 <+7>: mov %rdi,%rbx 0x000000000097dd4a <+10>: mov 0x7ae8(%rbx),%rax 0x000000000097dd51 <+17>: add $0x7ae8,%rbx 0x000000000097dd58 <+24>: cmp %r14,%rax 0x000000000097dd5b <+27>: je 0x97dd7e <_ZN2v88internal16RuntimeCallStats5LeaveEPS1_PNS0_16RuntimeCallTimerE+62> 0x000000000097dd5d <+29>: nopl (%rax) 0x000000000097dd60 <+32>: mov (%rbx),%rbx 0x000000000097dd63 <+35>: test %rbx,%rbx 0x000000000097dd66 <+38>: je 0x97ddc7 <_ZN2v88internal16RuntimeCallStats5LeaveEPS1_PNS0_16RuntimeCallTimerE+135> 0x000000000097dd68 <+40>: mov 0x8(%rbx),%rax 0x000000000097dd6c <+44>: add $0x8,%rbx 0x000000000097dd70 <+48>: cmp %r14,%rax 0x000000000097dd73 <+51>: jne 0x97dd60 <_ZN2v88internal16RuntimeCallStats5LeaveEPS1_PNS0_16RuntimeCallTimerE+32> 0x000000000097dd75 <+53>: cmpq $0x0,0x10(%r14) 0x000000000097dd7a <+58>: jne 0x97dd85 <_ZN2v88internal16RuntimeCallStats5LeaveEPS1_PNS0_16RuntimeCallTimerE+69> 0x000000000097dd7c <+60>: jmp 0x97ddbd <_ZN2v88internal16RuntimeCallStats5LeaveEPS1_PNS0_16RuntimeCallTimerE+125> 0x000000000097dd7e <+62>: cmpq $0x0,0x10(%r14) 0x000000000097dd83 <+67>: je 0x97ddbd <_ZN2v88internal16RuntimeCallStats5LeaveEPS1_PNS0_16RuntimeCallTimerE+125> 0x000000000097dd85 <+69>: callq 0x21331a0 <_ZN2v84base9TimeTicks3NowEv> 0x000000000097dd8a <+74>: sub 0x10(%r14),%rax 0x000000000097dd8e <+78>: movq $0x0,0x10(%r14) 0x000000000097dd96 <+86>: mov (%r14),%rcx 0x000000000097dd99 <+89>: incq 0x8(%rcx) Looks like the the counter value at +40 is neither 0 nor valid pointer.
,
Nov 30 2016
Users experienced this crash on the following builds: Mac Canary 57.0.2937.0 - 1.52 CPM, 1 reports, 1 clients (signature v8::internal::RuntimeCallStats::Leave) If this update was incorrect, please add "Fracas-Wrong" label to prevent future updates. - Go/Fracas
,
Jan 15 2017
Users experienced this crash on the following builds: Win Canary 57.0.2981.0 - 0.54 CPM, 3 reports, 2 clients (signature v8::internal::RuntimeCallStats::Leave) If this update was incorrect, please add "Fracas-Wrong" label to prevent future updates. - Go/Fracas
,
Jan 19 2017
Users experienced this crash on the following builds: Linux Dev 57.0.2984.0 - 1.61 CPM, 1 reports, 1 clients (signature v8::internal::RuntimeCallStats::Leave) If this update was incorrect, please add "Fracas-Wrong" label to prevent future updates. - Go/Fracas
,
Jan 21 2017
Users experienced this crash on the following builds: Mac Beta 56.0.2924.67 - 0.08 CPM, 1 reports, 1 clients (signature v8::internal::RuntimeCallStats::Leave) If this update was incorrect, please add "Fracas-Wrong" label to prevent future updates. - Go/Fracas
,
Jan 23 2017
Users experienced this crash on the following builds: Mac Canary 58.0.2989.0 - 0.50 CPM, 1 reports, 1 clients (signature v8::internal::RuntimeCallStats::Leave) If this update was incorrect, please add "Fracas-Wrong" label to prevent future updates. - Go/Fracas
,
Jan 27 2017
Users experienced this crash on the following builds: Android Dev 57.0.2987.9 - 0.58 CPM, 2 reports, 2 clients (signature v8::internal::RuntimeCallStats::Leave) If this update was incorrect, please add "Fracas-Wrong" label to prevent future updates. - Go/Fracas
,
Mar 4 2017
Users experienced this crash on the following builds: Mac Canary 59.0.3030.0 - 1.23 CPM, 1 reports, 1 clients (signature v8::internal::RuntimeCallStats::Leave) If this update was incorrect, please add "Fracas-Wrong" label to prevent future updates. - Go/Fracas
,
May 16 2017
Users experienced this crash on the following builds: Mac Canary 60.0.3100.0 - 0.21 CPM, 1 reports, 1 clients (signature v8::internal::RuntimeCallStats::Leave) If this update was incorrect, please add "Fracas-Wrong" label to prevent future updates. - Go/Fracas
,
May 27 2017
Users experienced this crash on the following builds: Mac Canary 61.0.3113.0 - 0.89 CPM, 1 reports, 1 clients (signature v8::internal::RuntimeCallStats::Leave) If this update was incorrect, please add "Fracas-Wrong" label to prevent future updates. - Go/Fracas
,
Aug 15 2017
This is currently top#9 renderer crash on latest Chrome Beta i.e., 61.0.3163.39 with 6 crashes from 2 clients though,hence not marking the bug as blocker for now as the crash is present for longtime. Please find details here : https://goto.google.com/pqxfm
,
Aug 25 2017
The following revision refers to this bug: https://chromium.googlesource.com/v8/v8.git/+/9b15760286252172fde6aa69b180bf484c7b8a82 commit 9b15760286252172fde6aa69b180bf484c7b8a82 Author: Alexei Filippov <alph@chromium.org> Date: Fri Aug 25 18:06:36 2017 [runtime-call-stats] Fix a long standing crash in RuntimeCallStats::Leave There must be a matching Leave for each Enter. Otherwise it ends up with a dead stack-allocated object in the timer chain. Drive-by: There was also a bug in RuntimeCallTimerScope::RuntimeCallTimerScope(HeapObject* ...) did create a local object instead of calling an overloaded constructor. BUG= chromium:669329 Change-Id: I9aa1c574a854af8beab3d8097efab3a726ad1c8d Reviewed-on: https://chromium-review.googlesource.com/634511 Commit-Queue: Alexei Filippov <alph@chromium.org> Reviewed-by: Camillo Bruni <cbruni@chromium.org> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> Cr-Commit-Position: refs/heads/master@{#47613} [modify] https://crrev.com/9b15760286252172fde6aa69b180bf484c7b8a82/src/counters-inl.h [modify] https://crrev.com/9b15760286252172fde6aa69b180bf484c7b8a82/src/counters.cc [modify] https://crrev.com/9b15760286252172fde6aa69b180bf484c7b8a82/src/counters.h [modify] https://crrev.com/9b15760286252172fde6aa69b180bf484c7b8a82/src/interpreter/interpreter.cc
,
Aug 27 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/6c90e5bcd7448108a241823372d7b57e217da9fd commit 6c90e5bcd7448108a241823372d7b57e217da9fd Author: Alexei Filippov <alph@chromium.org> Date: Sun Aug 27 03:05:06 2017 Mark inspector/tracing/timeline-js/timeline-runtime-stats.html as crasing TBR=cbruni@chromium.org NOTRY=true NOTREECHECKS=true BUG= 669329 Change-Id: I2990e4d399197c95ba26e900ba6b1fcf4ef56532 Reviewed-on: https://chromium-review.googlesource.com/635957 Reviewed-by: Alexei Filippov <alph@chromium.org> Commit-Queue: Alexei Filippov <alph@chromium.org> Cr-Commit-Position: refs/heads/master@{#497673} [modify] https://crrev.com/6c90e5bcd7448108a241823372d7b57e217da9fd/third_party/WebKit/LayoutTests/TestExpectations
,
Aug 28 2017
The following revision refers to this bug: https://chromium.googlesource.com/v8/v8.git/+/d1768823265baf3be4b4b1c875e29da896096a03 commit d1768823265baf3be4b4b1c875e29da896096a03 Author: Alexei Filippov <alph@chromium.org> Date: Mon Aug 28 05:53:02 2017 Revert "[runtime-call-stats] Fix a long standing crash in RuntimeCallStats::Leave" This reverts commit 9b15760286252172fde6aa69b180bf484c7b8a82. Reason for revert: Seems to be the cause of 100% crashes of runtime-call-stats layout_test on Windows. https://build.chromium.org/p/chromium.webkit/builders/WebKit%20Win7/builds/54947 Original change's description: > [runtime-call-stats] Fix a long standing crash in RuntimeCallStats::Leave > > There must be a matching Leave for each Enter. Otherwise it ends up > with a dead stack-allocated object in the timer chain. > > Drive-by: There was also a bug in > RuntimeCallTimerScope::RuntimeCallTimerScope(HeapObject* ...) did create a > local object instead of calling an overloaded constructor. > > BUG= chromium:669329 > > Change-Id: I9aa1c574a854af8beab3d8097efab3a726ad1c8d > Reviewed-on: https://chromium-review.googlesource.com/634511 > Commit-Queue: Alexei Filippov <alph@chromium.org> > Reviewed-by: Camillo Bruni <cbruni@chromium.org> > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> > Cr-Commit-Position: refs/heads/master@{#47613} TBR=rmcilroy@chromium.org,alph@chromium.org,cbruni@chromium.org,rmcilroy@google.com # Not skipping CQ checks because original CL landed > 1 day ago. Bug: chromium:669329 Change-Id: I57b4fcd2e7bf92a68824d2ac5f40cc74deee0b25 Reviewed-on: https://chromium-review.googlesource.com/636762 Reviewed-by: Alexei Filippov <alph@chromium.org> Commit-Queue: Alexei Filippov <alph@chromium.org> Cr-Commit-Position: refs/heads/master@{#47631} [modify] https://crrev.com/d1768823265baf3be4b4b1c875e29da896096a03/src/counters-inl.h [modify] https://crrev.com/d1768823265baf3be4b4b1c875e29da896096a03/src/counters.cc [modify] https://crrev.com/d1768823265baf3be4b4b1c875e29da896096a03/src/counters.h [modify] https://crrev.com/d1768823265baf3be4b4b1c875e29da896096a03/src/interpreter/interpreter.cc
,
Aug 28 2017
Issue 669809 has been merged into this issue.
,
Aug 29 2017
The following revision refers to this bug: https://chromium.googlesource.com/v8/v8.git/+/ed7155c678a647e0a97f915b150c5c65a417de4d commit ed7155c678a647e0a97f915b150c5c65a417de4d Author: Alexei Filippov <alph@chromium.org> Date: Tue Aug 29 07:50:24 2017 [runtime-call-stats] Fix a long standing crash in RuntimeCallStats::Leave Make sure there is a matching Leave for each Enter. Otherwise it ends up with a dead stack-allocated object in the timer chain. The patch incorporates the following fixes: - RuntimeCallTimerScope::RuntimeCallTimerScope(HeapObject* ...) did create a local object instead of calling an overloaded constructor. - InterpreterCompilationJob::ExecuteJobImpl made an implicit call to a default copy constructor of TimerScope which led to a single Enter was made per two Leaves. - InterpreterCompilationJob::FinalizeJobImpl was calling RuntimeCallTimerScope from a background thread, which caused timer scopes become unbalanced. - RuntimeCallTimerScope constructors were put into counters-inl.h which is not included into most usages of RCS. That led to a suboptimal performance. - Added thread check into Enter and Leave BUG= chromium:669329 Change-Id: Ib5cff0e02e0b6c8b56a03ca3a5ebc37d93fcde55 Reviewed-on: https://chromium-review.googlesource.com/637307 Reviewed-by: Camillo Bruni <cbruni@chromium.org> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> Commit-Queue: Alexei Filippov <alph@chromium.org> Cr-Commit-Position: refs/heads/master@{#47666} [modify] https://crrev.com/ed7155c678a647e0a97f915b150c5c65a417de4d/src/counters-inl.h [modify] https://crrev.com/ed7155c678a647e0a97f915b150c5c65a417de4d/src/counters.cc [modify] https://crrev.com/ed7155c678a647e0a97f915b150c5c65a417de4d/src/counters.h [modify] https://crrev.com/ed7155c678a647e0a97f915b150c5c65a417de4d/src/interpreter/interpreter.cc
,
Aug 31 2017
The following revision refers to this bug: https://chromium.googlesource.com/v8/v8.git/+/e7fa71dc583588b22b00c45e5429834bb232dd23 commit e7fa71dc583588b22b00c45e5429834bb232dd23 Author: Alexei Filippov <alph@chromium.org> Date: Thu Aug 31 15:36:28 2017 [runtime-call-stats] Make sure GCTracer::Scope makes paired Enter/Leave calls Ensure that RuntimeCallStats::Enter is paired with Leave when FLAG_runtime_stats changes in flight. BUG= chromium:669329 Change-Id: I4da7edf88990fdebd7d05325a09cfca0702cfe5a Reviewed-on: https://chromium-review.googlesource.com/643472 Reviewed-by: Camillo Bruni <cbruni@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Alexei Filippov <alph@chromium.org> Cr-Commit-Position: refs/heads/master@{#47749} [modify] https://crrev.com/e7fa71dc583588b22b00c45e5429834bb232dd23/src/heap/gc-tracer.cc [modify] https://crrev.com/e7fa71dc583588b22b00c45e5429834bb232dd23/src/heap/gc-tracer.h
,
Sep 1 2017
Requesting to merge the last commit https://chromium.googlesource.com/v8/v8.git/+/e7fa71dc583588b22b00c45e5429834bb232dd23
,
Sep 1 2017
,
Sep 5 2017
Please set the status to fixed if it is fixed.
,
Sep 5 2017
,
Sep 11 2017
This issue has been approved for a merge. Please merge the fix to any appropriate branches as soon as possible! If all merges have been completed, please remove any remaining Merge-Approved labels from this issue. Thanks for your time! To disable nags, add the Disable-Nags label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Sep 11 2017
The following revision refers to this bug: https://chromium.googlesource.com/v8/v8.git/+/3956c6450ab3db166a7953267cbe26c29e316721 commit 3956c6450ab3db166a7953267cbe26c29e316721 Author: Alexei Filippov <alph@chromium.org> Date: Mon Sep 11 18:46:40 2017 Merged: [runtime-call-stats] Make sure GCTracer::Scope makes paired Enter/Leave calls Revision: e7fa71dc583588b22b00c45e5429834bb232dd23 BUG= chromium:669329 LOG=N NOTRY=true NOPRESUBMIT=true NOTREECHECKS=true R=cbruni@chromium.org Change-Id: I813d8d1c7078ed455aa4fd51c42dee912f90526c Reviewed-on: https://chromium-review.googlesource.com/657679 Reviewed-by: Camillo Bruni <cbruni@chromium.org> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/branch-heads/6.2@{#13} Cr-Branched-From: efa2ac4129d30c7c72e84c16af3d20b44829f990-refs/heads/6.2.414@{#1} Cr-Branched-From: a861ebb762a60bf5cc2a274faee3620abfb06311-refs/heads/master@{#47693} [modify] https://crrev.com/3956c6450ab3db166a7953267cbe26c29e316721/src/heap/gc-tracer.cc [modify] https://crrev.com/3956c6450ab3db166a7953267cbe26c29e316721/src/heap/gc-tracer.h
,
Sep 18 2017
This issue has been approved for a merge. Please merge the fix to any appropriate branches as soon as possible! If all merges have been completed, please remove any remaining Merge-Approved labels from this issue. Thanks for your time! To disable nags, add the Disable-Nags label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Sep 18 2017
|
|||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||
Comment 1 by alph@chromium.org
, Nov 29 2016