New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 715936 link

Starred by 10 users

Issue metadata

Status: Fixed
Owner:
Closed: Apr 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Android , Windows , Mac
Pri: 1
Type: Bug



Sign in to add a comment

load:tools:drive causing DevtoolsTargetCrashException on system health

Project Member Reported by perezju@chromium.org, Apr 27 2017

Issue description

This story has been failing on most configurations, e.g.

                       config             story  latest_build                status
0        mac-pro-10.11 memory  load:tools:drive           887  333-333-------------
1           mac-retina memory  load:tools:drive           589  33-3333-------------
2                win-7 memory  load:tools:drive           641  33-333--------------
3            mac-10.11 memory  load:tools:drive           618  33-333--------------
4                win-8 memory  load:tools:drive           674  33--333-------------
5            win-7-x64 memory  load:tools:drive           658  33--333-------------
6     win-7-nvidia-gpu memory  load:tools:drive           667  33--333-------------
7      win-7-intel-gpu memory  load:tools:drive           687  33--333-------------
8        win-7-ati-gpu memory  load:tools:drive           651  33--333-------------
9               win-10 memory  load:tools:drive           725  33--333-------------
10  mac-mini-8gb-10.12 memory  load:tools:drive          1509  3-333---------------
11       mac-air-10.11 memory  load:tools:drive           771  3-333---------------
12     win-10-high-dpi memory  load:tools:drive           534  3--333--------------
13           mac-10.12 memory  load:tools:drive           413  3--333--------------
14               linux memory  load:tools:drive           606  333-----------------
15         win-zenbook memory  load:tools:drive           531  3-33-----------?~~~~
16    android-nexus7v2 memory  load:tools:drive          5063  -----333------------
17       mac-pro-10.11 common  load:tools:drive           887  111-111-------------
18          mac-retina common  load:tools:drive           589  11-1111--------?----
19           mac-10.11 common  load:tools:drive           618  11-111--------------

Example build:
https://luci-milo.appspot.com/buildbot/chromium.perf/Mac%20Retina%20Perf/585

Snip from example log:
Stacktrace:
   magic1=bbbbbbbb magic2=bbbbbbbb ptr1=0x377e33602351 ptr2=0x0 ptr3=0x0 ptr4=0x0 ptr5=0x0 ptr6=0x0 ptr7=0x0 ptr8=0x0


==== JS stack trace =========================================

Security context: 0x3319065c2b21 <String[24]: https://drive.google.com>
    2: G [https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.DAxKPHidPdg.O/m=core/am=TO4YKg/rt=j/d=1/rs=AFB8gswQOSH9oxbwlAe3NOTydE5apawiCA:243] [bytecode=0x142ee479c879 offset=97](this=0x38153de07c31 <Object map = 0x3e8467bbb2a9>#0#,a=0x156b48aa4e21 <lbb map = 0x3e8467be42e1>#1#,b=0x377e33602351 <the_hole>,c=0,d=-1,e=0x377e33602201 <null>)
    4: new constructor(aka lbb) [https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.DAxKPHidPdg.O/m=core/am=TO4YKg/rt=j/d=1/rs=AFB8gswQOSH9oxbwlAe3NOTydE5apawiCA:2676] [bytecode=0xca4109e24c1 offset=27](this=0x156b48aa4e21 <lbb map = 0x3e8467be42e1>#1#,a=0x377e33602351 <the_hole>)
    7: L [https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.DAxKPHidPdg.O/m=core/am=TO4YKg/rt=j/d=1/rs=AFB8gswQOSH9oxbwlAe3NOTydE5apawiCA:245] [bytecode=0x142ee47fb3f1 offset=68](this=0x38153de07c31 <Object map = 0x3e8467bbb2a9>#0#,a=0x156b48a9abe9 <JSObject>#2#,b=0x39e9075fa969 <JSFunction lbb (sfi = 0x3492ea0e61)>#3#,c=5,d=0x377e33602311 <undefined>)
    8: arguments adaptor frame: 3->4
   10: pO [https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.DAxKPHidPdg.O/m=core/am=TO4YKg/rt=j/d=1/rs=AFB8gswQOSH9oxbwlAe3NOTydE5apawiCA:2679] [bytecode=0xca4109e22a9 offset=27](this=0x36d233e0169 <JSGlobal Object>#4#,a=0x156b48aa4d01 <Hbb map = 0x3e8467be45f9>#5#)
   12: rO [https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.DAxKPHidPdg.O/m=core/am=TO4YKg/rt=j/d=1/rs=AFB8gswQOSH9oxbwlAe3NOTydE5apawiCA:2684] [bytecode=0xca4109e2091 offset=17](this=0x36d233e0169 <JSGlobal Object>#4#,a=0x156b48aa4d01 <Hbb map = 0x3e8467be45f9>#5#)
   14: U [https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.DAxKPHidPdg.O/m=core/am=TO4YKg/rt=j/d=1/rs=AFB8gswQOSH9oxbwlAe3NOTydE5apawiCA:2684] [bytecode=0x24bc46795649 offset=7](this=0x156b48aa4d01 <Hbb map = 0x3e8467be45f9>#5#,a=15)
   16: Bc [https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.DAxKPHidPdg.O/m=core/am=TO4YKg/rt=j/d=1/rs=AFB8gswQOSH9oxbwlAe3NOTydE5apawiCA:2696] [bytecode=0xca4109df3a9 offset=464](this=0x156b48a9a7e1 <tO map = 0x38a904087111>#6#)
   18: fpa [https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.DAxKPHidPdg.O/m=core/am=TO4YKg/rt=j/d=1/rs=AFB8gswQOSH9oxbwlAe3NOTydE5apawiCA:2706] [bytecode=0xbd95db04be9 offset=239](this=0x3305d7ec6539 <vO map = 0x2c9a9492db21>#7#,a=0x156b48a9a7e1 <tO map = 0x38a904087111>#6#,b=0x156b48a9bda9 <Number 1.20425e+12>)
   20: /* anonymous */ [https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.DAxKPHidPdg.O/m=core/am=TO4YKg/rt=j/d=1/rs=AFB8gswQOSH9oxbwlAe3NOTydE5apawiCA:7] [bytecode=0x3eee6f070609 offset=49](this=0x3305d7ec6539 <vO map = 0x2c9a9492db21>#7#)
   22: dLa [https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.DAxKPHidPdg.O/m=core/am=TO4YKg/rt=j/d=1/rs=AFB8gswQOSH9oxbwlAe3NOTydE5apawiCA:1738] [bytecode=0xbd95db1cf81 offset=41](this=0x36d233e0169 <JSGlobal Object>#4#,a=0x29480d325ce9 <String[2]: re>,b=0x156b48a9bf11 <JSFunction (sfi = 0x3eee6f070299)>#8#,c=0x3305d7ec6539 <vO map = 0x2c9a9492db21>#7#)
   24: c [https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.DAxKPHidPdg.O/m=core/am=TO4YKg/rt=j/d=1/rs=AFB8gswQOSH9oxbwlAe3NOTydE5apawiCA:75] [bytecode=0x142ee47eeec1 offset=53](this=0x36d233e0169 <JSGlobal Object>#4#)
https://luci-logdog.appspot.com/v/?s=chrome%2Fbb%2Fchromium.perf%2FMac_Retina_Perf%2F585%2F%2B%2Frecipes%2Fsteps%2Fsystem_health.memory_desktop_on_Intel_GPU_on_Mac_on_Mac-10.11%2F0%2Fstdout

Example build on linux:
https://luci-milo.appspot.com/buildbot/chromium.perf/Linux%20Perf/606

Shows a similar error:
https://luci-logdog.appspot.com/v/?s=chrome%2Fbb%2Fchromium.perf%2FLinux_Perf%2F606%2F%2B%2Frecipes%2Fsteps%2Fsystem_health.common_desktop_on__102b__GPU_on_Linux%2F0%2Fstdout
 
Cc: bmeu...@chromium.org peria@chromium.org
From https://luci-logdog.appspot.com/v/?s=chrome%2Fbb%2Fchromium.perf%2FMac_Retina_Perf%2F585%2F%2B%2Frecipes%2Fsteps%2Fsystem_health.memory_desktop_on_Intel_GPU_on_Mac_on_Mac-10.11%2F0%2Fstdout

I see the JS stack trace below
I find a bit surprising that https://codereview.chromium.org/2820433005 could cause a crash within v8.

+bmeurer, +peria could this be one of your changes in v8?

-----

==== JS stack trace =========================================

Security context: 0x3c3649c2b21 <String[24]: https://drive.google.com>
    2: G [https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.DAxKPHidPdg.O/m=core/am=TO4YKg/rt=j/d=1/rs=AFB8gswQOSH9oxbwlAe3NOTydE5apawiCA:243] [bytecode=0xf0b45f23ff1 offset=97](this=0x98c4d9d0a41 <Object map = 0x2ea7249bf7c1>#0#,a=0x295c5325b081 <lbb map = 0x2220de55e351>#1#,b=0x2f81f3a82351 <the_hole>,c=0,d=-1,e=0x2f81f3a82201 <null>)
    4: new constructor(aka lbb) [https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.DAxKPHidPdg.O/m=core/am=TO4YKg/rt=j/d=1/rs=AFB8gswQOSH9oxbwlAe3NOTydE5apawiCA:2676] [bytecode=0x30a535f4cfb9 offset=27](this=0x295c5325b081 <lbb map = 0x2220de55e351>#1#,a=0x2f81f3a82351 <the_hole>)
    7: L [https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.DAxKPHidPdg.O/m=core/am=TO4YKg/rt=j/d=1/rs=AFB8gswQOSH9oxbwlAe3NOTydE5apawiCA:245] [bytecode=0x54496585a11 offset=68](this=0x98c4d9d0a41 <Object map = 0x2ea7249bf7c1>#0#,a=0x295c53250e49 <JSObject>#2#,b=0x9dfed465e1 <JSFunction lbb (sfi = 0x39f3cf0a85d1)>#3#,c=5,d=0x2f81f3a82311 <undefined>)
    8: arguments adaptor frame: 3->4
   10: pO [https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.DAxKPHidPdg.O/m=core/am=TO4YKg/rt=j/d=1/rs=AFB8gswQOSH9oxbwlAe3NOTydE5apawiCA:2679] [bytecode=0x30a535f4cda1 offset=27](this=0x1d16c54e01c1 <JSGlobal Object>#4#,a=0x295c5325af61 <Hbb map = 0x2220de55e5b9>#5#)
   12: rO [https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.DAxKPHidPdg.O/m=core/am=TO4YKg/rt=j/d=1/rs=AFB8gswQOSH9oxbwlAe3NOTydE5apawiCA:2684] [bytecode=0x30a535f4cb89 offset=17](this=0x1d16c54e01c1 <JSGlobal Object>#4#,a=0x295c5325af61 <Hbb map = 0x2220de55e5b9>#5#)
   14: U [https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.DAxKPHidPdg.O/m=core/am=TO4YKg/rt=j/d=1/rs=AFB8gswQOSH9oxbwlAe3NOTydE5apawiCA:2684] [bytecode=0x8d1604830f1 offset=7](this=0x295c5325af61 <Hbb map = 0x2220de55e5b9>#5#,a=15)
   16: Bc [https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.DAxKPHidPdg.O/m=core/am=TO4YKg/rt=j/d=1/rs=AFB8gswQOSH9oxbwlAe3NOTydE5apawiCA:2696] [bytecode=0x30a535f49ea1 offset=464](this=0x295c53250a41 <tO map = 0x12cb15f2c9>#6#)
   18: fpa [https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.DAxKPHidPdg.O/m=core/am=TO4YKg/rt=j/d=1/rs=AFB8gswQOSH9oxbwlAe3NOTydE5apawiCA:2706] [bytecode=0x7cf0c7f9ad1 offset=239](this=0x3da5b53fb4c1 <vO map = 0x233bc9c90a61>#7#,a=0x295c53250a41 <tO map = 0x12cb15f2c9>#6#,b=0x295c53252009 <Number 1.20425e+12>)
   20: /* anonymous */ [https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.DAxKPHidPdg.O/m=core/am=TO4YKg/rt=j/d=1/rs=AFB8gswQOSH9oxbwlAe3NOTydE5apawiCA:7] [bytecode=0x2f5bff8f7d81 offset=49](this=0x3da5b53fb4c1 <vO map = 0x233bc9c90a61>#7#)
   22: dLa [https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.DAxKPHidPdg.O/m=core/am=TO4YKg/rt=j/d=1/rs=AFB8gswQOSH9oxbwlAe3NOTydE5apawiCA:1738] [bytecode=0x1d16c54be531 offset=41](this=0x1d16c54e01c1 <JSGlobal Object>#4#,a=0xf80ca9a5ce9 <String[2]: re>,b=0x295c53252171 <JSFunction (sfi = 0x2f5bff8f7a11)>#8#,c=0x3da5b53fb4c1 <vO map = 0x233bc9c90a61>#7#)
   24: c [https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.DAxKPHidPdg.O/m=core/am=TO4YKg/rt=j/d=1/rs=AFB8gswQOSH9oxbwlAe3NOTydE5apawiCA:75] [bytecode=0xf0b45f76659 offset=53](this=0x1d16c54e01c1 <JSGlobal Object>#4#)

-----

Cc: hablich@chromium.org
Looks like we leak the_hole to JavaScript. Could be related to my change. You could revert it speculatively. How do you repro this locally?
Project Member

Comment 4 by bugdroid1@chromium.org, Apr 27 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/3721c3608a5aef73b1762e6906257c9d9f8e0d36

commit 3721c3608a5aef73b1762e6906257c9d9f8e0d36
Author: perezju <perezju@chromium.org>
Date: Thu Apr 27 11:53:13 2017

[tools/perf] Disable load:tools:drive system health story

Story shows a high failure rate on many different perf bots.

TBR=nednguyen@google.com
BUG= 715936 

Review-Url: https://codereview.chromium.org/2848573002
Cr-Commit-Position: refs/heads/master@{#467640}

[modify] https://crrev.com/3721c3608a5aef73b1762e6906257c9d9f8e0d36/tools/perf/page_sets/system_health/loading_stories.py

Comment 5 Deleted

try:

$ tools/perf/run_benchmark.py system_health.memory_desktop --story-filter load:tools:drive --browser [some_browser]

Try "--browser list" to show available browsers, from the configs failing this should repro on a browser for any platform.
Cc: simonhatch@chromium.org perezju@chromium.org
 Issue 715561  has been merged into this issue.
Components: Blink>JavaScript>Compiler
Labels: -Pri-2 Arch-All Pri-1
Owner: bmeu...@chromium.org
Status: Started (was: Untriaged)
Yep, it's my CL (https://codereview.chromium.org/2836913004). Revert in-flight.
Project Member

Comment 9 by bugdroid1@chromium.org, Apr 28 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/53d31d0623bd88ce9a0041a767f36eafd3f1de8b

commit 53d31d0623bd88ce9a0041a767f36eafd3f1de8b
Author: bmeurer <bmeurer@chromium.org>
Date: Fri Apr 28 05:40:46 2017

Revert of [turbofan] General consolidation of element access. (patchset #1 id:1 of https://codereview.chromium.org/2836913004/ )

Reason for revert:
Breaks load:tools:drive story

Original issue's description:
> [turbofan] General consolidation of element access.
>
> Avoid TransitionElementsKind when storing to objects which only differ
> in holeyness of their elements kind. Instead go for polymorphic
> CheckMaps, which can often by optimized and avoid the mutation of the
> array map.
>
> This generalizes the approach https://codereview.chromium.org/2836943003
> which covered only element loads.
>
> R=yangguo@chromium.org
> BUG=v8:5267
>
> Review-Url: https://codereview.chromium.org/2836913004
> Cr-Commit-Position: refs/heads/master@{#44828}
> Committed: https://chromium.googlesource.com/v8/v8/+/ed573cee5c1d1e42158829dc0b92fb697234e121

TBR=yangguo@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=v8:5267, chromium:715936 

Review-Url: https://codereview.chromium.org/2852623002
Cr-Commit-Position: refs/heads/master@{#44958}

[modify] https://crrev.com/53d31d0623bd88ce9a0041a767f36eafd3f1de8b/src/compiler/access-info.cc
[modify] https://crrev.com/53d31d0623bd88ce9a0041a767f36eafd3f1de8b/src/compiler/access-info.h

Status: Fixed (was: Started)
Issue 715687 has been merged into this issue.
Project Member

Comment 12 by bugdroid1@chromium.org, Apr 28 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/17cb970f145b4eb3df0c95ced62d38dbf521ca6d

commit 17cb970f145b4eb3df0c95ced62d38dbf521ca6d
Author: primiano <primiano@chromium.org>
Date: Fri Apr 28 11:16:33 2017

Revert of [tools/perf] Disable load:tools:drive system health story (patchset #1 id:1 of https://codereview.chromium.org/2848573002/ )

Reason for re-enabling the story:
The V8 CL that was causing the crash has been reverted in https://crrev.com/2852623002

Original issue's description:
> [tools/perf] Disable load:tools:drive system health story
>
> Story shows a high failure rate on many different perf bots.
>
> TBR=nednguyen@google.com
> BUG= 715936 
>
> Review-Url: https://codereview.chromium.org/2848573002
> Cr-Commit-Position: refs/heads/master@{#467640}
> Committed: https://chromium.googlesource.com/chromium/src/+/3721c3608a5aef73b1762e6906257c9d9f8e0d36

BUG= 715936 

Review-Url: https://codereview.chromium.org/2851703003
Cr-Commit-Position: refs/heads/master@{#467958}

[modify] https://crrev.com/17cb970f145b4eb3df0c95ced62d38dbf521ca6d/tools/perf/page_sets/system_health/loading_stories.py

Issue 718857 has been merged into this issue.

Sign in to add a comment