load:tools:drive causing DevtoolsTargetCrashException on system health |
|||||
Issue description
This story has been failing on most configurations, e.g.
config story latest_build status
0 mac-pro-10.11 memory load:tools:drive 887 333-333-------------
1 mac-retina memory load:tools:drive 589 33-3333-------------
2 win-7 memory load:tools:drive 641 33-333--------------
3 mac-10.11 memory load:tools:drive 618 33-333--------------
4 win-8 memory load:tools:drive 674 33--333-------------
5 win-7-x64 memory load:tools:drive 658 33--333-------------
6 win-7-nvidia-gpu memory load:tools:drive 667 33--333-------------
7 win-7-intel-gpu memory load:tools:drive 687 33--333-------------
8 win-7-ati-gpu memory load:tools:drive 651 33--333-------------
9 win-10 memory load:tools:drive 725 33--333-------------
10 mac-mini-8gb-10.12 memory load:tools:drive 1509 3-333---------------
11 mac-air-10.11 memory load:tools:drive 771 3-333---------------
12 win-10-high-dpi memory load:tools:drive 534 3--333--------------
13 mac-10.12 memory load:tools:drive 413 3--333--------------
14 linux memory load:tools:drive 606 333-----------------
15 win-zenbook memory load:tools:drive 531 3-33-----------?~~~~
16 android-nexus7v2 memory load:tools:drive 5063 -----333------------
17 mac-pro-10.11 common load:tools:drive 887 111-111-------------
18 mac-retina common load:tools:drive 589 11-1111--------?----
19 mac-10.11 common load:tools:drive 618 11-111--------------
Example build:
https://luci-milo.appspot.com/buildbot/chromium.perf/Mac%20Retina%20Perf/585
Snip from example log:
Stacktrace:
magic1=bbbbbbbb magic2=bbbbbbbb ptr1=0x377e33602351 ptr2=0x0 ptr3=0x0 ptr4=0x0 ptr5=0x0 ptr6=0x0 ptr7=0x0 ptr8=0x0
==== JS stack trace =========================================
Security context: 0x3319065c2b21 <String[24]: https://drive.google.com>
2: G [https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.DAxKPHidPdg.O/m=core/am=TO4YKg/rt=j/d=1/rs=AFB8gswQOSH9oxbwlAe3NOTydE5apawiCA:243] [bytecode=0x142ee479c879 offset=97](this=0x38153de07c31 <Object map = 0x3e8467bbb2a9>#0#,a=0x156b48aa4e21 <lbb map = 0x3e8467be42e1>#1#,b=0x377e33602351 <the_hole>,c=0,d=-1,e=0x377e33602201 <null>)
4: new constructor(aka lbb) [https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.DAxKPHidPdg.O/m=core/am=TO4YKg/rt=j/d=1/rs=AFB8gswQOSH9oxbwlAe3NOTydE5apawiCA:2676] [bytecode=0xca4109e24c1 offset=27](this=0x156b48aa4e21 <lbb map = 0x3e8467be42e1>#1#,a=0x377e33602351 <the_hole>)
7: L [https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.DAxKPHidPdg.O/m=core/am=TO4YKg/rt=j/d=1/rs=AFB8gswQOSH9oxbwlAe3NOTydE5apawiCA:245] [bytecode=0x142ee47fb3f1 offset=68](this=0x38153de07c31 <Object map = 0x3e8467bbb2a9>#0#,a=0x156b48a9abe9 <JSObject>#2#,b=0x39e9075fa969 <JSFunction lbb (sfi = 0x3492ea0e61)>#3#,c=5,d=0x377e33602311 <undefined>)
8: arguments adaptor frame: 3->4
10: pO [https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.DAxKPHidPdg.O/m=core/am=TO4YKg/rt=j/d=1/rs=AFB8gswQOSH9oxbwlAe3NOTydE5apawiCA:2679] [bytecode=0xca4109e22a9 offset=27](this=0x36d233e0169 <JSGlobal Object>#4#,a=0x156b48aa4d01 <Hbb map = 0x3e8467be45f9>#5#)
12: rO [https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.DAxKPHidPdg.O/m=core/am=TO4YKg/rt=j/d=1/rs=AFB8gswQOSH9oxbwlAe3NOTydE5apawiCA:2684] [bytecode=0xca4109e2091 offset=17](this=0x36d233e0169 <JSGlobal Object>#4#,a=0x156b48aa4d01 <Hbb map = 0x3e8467be45f9>#5#)
14: U [https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.DAxKPHidPdg.O/m=core/am=TO4YKg/rt=j/d=1/rs=AFB8gswQOSH9oxbwlAe3NOTydE5apawiCA:2684] [bytecode=0x24bc46795649 offset=7](this=0x156b48aa4d01 <Hbb map = 0x3e8467be45f9>#5#,a=15)
16: Bc [https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.DAxKPHidPdg.O/m=core/am=TO4YKg/rt=j/d=1/rs=AFB8gswQOSH9oxbwlAe3NOTydE5apawiCA:2696] [bytecode=0xca4109df3a9 offset=464](this=0x156b48a9a7e1 <tO map = 0x38a904087111>#6#)
18: fpa [https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.DAxKPHidPdg.O/m=core/am=TO4YKg/rt=j/d=1/rs=AFB8gswQOSH9oxbwlAe3NOTydE5apawiCA:2706] [bytecode=0xbd95db04be9 offset=239](this=0x3305d7ec6539 <vO map = 0x2c9a9492db21>#7#,a=0x156b48a9a7e1 <tO map = 0x38a904087111>#6#,b=0x156b48a9bda9 <Number 1.20425e+12>)
20: /* anonymous */ [https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.DAxKPHidPdg.O/m=core/am=TO4YKg/rt=j/d=1/rs=AFB8gswQOSH9oxbwlAe3NOTydE5apawiCA:7] [bytecode=0x3eee6f070609 offset=49](this=0x3305d7ec6539 <vO map = 0x2c9a9492db21>#7#)
22: dLa [https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.DAxKPHidPdg.O/m=core/am=TO4YKg/rt=j/d=1/rs=AFB8gswQOSH9oxbwlAe3NOTydE5apawiCA:1738] [bytecode=0xbd95db1cf81 offset=41](this=0x36d233e0169 <JSGlobal Object>#4#,a=0x29480d325ce9 <String[2]: re>,b=0x156b48a9bf11 <JSFunction (sfi = 0x3eee6f070299)>#8#,c=0x3305d7ec6539 <vO map = 0x2c9a9492db21>#7#)
24: c [https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.DAxKPHidPdg.O/m=core/am=TO4YKg/rt=j/d=1/rs=AFB8gswQOSH9oxbwlAe3NOTydE5apawiCA:75] [bytecode=0x142ee47eeec1 offset=53](this=0x36d233e0169 <JSGlobal Object>#4#)
https://luci-logdog.appspot.com/v/?s=chrome%2Fbb%2Fchromium.perf%2FMac_Retina_Perf%2F585%2F%2B%2Frecipes%2Fsteps%2Fsystem_health.memory_desktop_on_Intel_GPU_on_Mac_on_Mac-10.11%2F0%2Fstdout
Example build on linux:
https://luci-milo.appspot.com/buildbot/chromium.perf/Linux%20Perf/606
Shows a similar error:
https://luci-logdog.appspot.com/v/?s=chrome%2Fbb%2Fchromium.perf%2FLinux_Perf%2F606%2F%2B%2Frecipes%2Fsteps%2Fsystem_health.common_desktop_on__102b__GPU_on_Linux%2F0%2Fstdout
,
Apr 27 2017
From https://luci-logdog.appspot.com/v/?s=chrome%2Fbb%2Fchromium.perf%2FMac_Retina_Perf%2F585%2F%2B%2Frecipes%2Fsteps%2Fsystem_health.memory_desktop_on_Intel_GPU_on_Mac_on_Mac-10.11%2F0%2Fstdout I see the JS stack trace below I find a bit surprising that https://codereview.chromium.org/2820433005 could cause a crash within v8. +bmeurer, +peria could this be one of your changes in v8? ----- ==== JS stack trace ========================================= Security context: 0x3c3649c2b21 <String[24]: https://drive.google.com> 2: G [https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.DAxKPHidPdg.O/m=core/am=TO4YKg/rt=j/d=1/rs=AFB8gswQOSH9oxbwlAe3NOTydE5apawiCA:243] [bytecode=0xf0b45f23ff1 offset=97](this=0x98c4d9d0a41 <Object map = 0x2ea7249bf7c1>#0#,a=0x295c5325b081 <lbb map = 0x2220de55e351>#1#,b=0x2f81f3a82351 <the_hole>,c=0,d=-1,e=0x2f81f3a82201 <null>) 4: new constructor(aka lbb) [https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.DAxKPHidPdg.O/m=core/am=TO4YKg/rt=j/d=1/rs=AFB8gswQOSH9oxbwlAe3NOTydE5apawiCA:2676] [bytecode=0x30a535f4cfb9 offset=27](this=0x295c5325b081 <lbb map = 0x2220de55e351>#1#,a=0x2f81f3a82351 <the_hole>) 7: L [https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.DAxKPHidPdg.O/m=core/am=TO4YKg/rt=j/d=1/rs=AFB8gswQOSH9oxbwlAe3NOTydE5apawiCA:245] [bytecode=0x54496585a11 offset=68](this=0x98c4d9d0a41 <Object map = 0x2ea7249bf7c1>#0#,a=0x295c53250e49 <JSObject>#2#,b=0x9dfed465e1 <JSFunction lbb (sfi = 0x39f3cf0a85d1)>#3#,c=5,d=0x2f81f3a82311 <undefined>) 8: arguments adaptor frame: 3->4 10: pO [https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.DAxKPHidPdg.O/m=core/am=TO4YKg/rt=j/d=1/rs=AFB8gswQOSH9oxbwlAe3NOTydE5apawiCA:2679] [bytecode=0x30a535f4cda1 offset=27](this=0x1d16c54e01c1 <JSGlobal Object>#4#,a=0x295c5325af61 <Hbb map = 0x2220de55e5b9>#5#) 12: rO [https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.DAxKPHidPdg.O/m=core/am=TO4YKg/rt=j/d=1/rs=AFB8gswQOSH9oxbwlAe3NOTydE5apawiCA:2684] [bytecode=0x30a535f4cb89 offset=17](this=0x1d16c54e01c1 <JSGlobal Object>#4#,a=0x295c5325af61 <Hbb map = 0x2220de55e5b9>#5#) 14: U [https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.DAxKPHidPdg.O/m=core/am=TO4YKg/rt=j/d=1/rs=AFB8gswQOSH9oxbwlAe3NOTydE5apawiCA:2684] [bytecode=0x8d1604830f1 offset=7](this=0x295c5325af61 <Hbb map = 0x2220de55e5b9>#5#,a=15) 16: Bc [https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.DAxKPHidPdg.O/m=core/am=TO4YKg/rt=j/d=1/rs=AFB8gswQOSH9oxbwlAe3NOTydE5apawiCA:2696] [bytecode=0x30a535f49ea1 offset=464](this=0x295c53250a41 <tO map = 0x12cb15f2c9>#6#) 18: fpa [https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.DAxKPHidPdg.O/m=core/am=TO4YKg/rt=j/d=1/rs=AFB8gswQOSH9oxbwlAe3NOTydE5apawiCA:2706] [bytecode=0x7cf0c7f9ad1 offset=239](this=0x3da5b53fb4c1 <vO map = 0x233bc9c90a61>#7#,a=0x295c53250a41 <tO map = 0x12cb15f2c9>#6#,b=0x295c53252009 <Number 1.20425e+12>) 20: /* anonymous */ [https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.DAxKPHidPdg.O/m=core/am=TO4YKg/rt=j/d=1/rs=AFB8gswQOSH9oxbwlAe3NOTydE5apawiCA:7] [bytecode=0x2f5bff8f7d81 offset=49](this=0x3da5b53fb4c1 <vO map = 0x233bc9c90a61>#7#) 22: dLa [https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.DAxKPHidPdg.O/m=core/am=TO4YKg/rt=j/d=1/rs=AFB8gswQOSH9oxbwlAe3NOTydE5apawiCA:1738] [bytecode=0x1d16c54be531 offset=41](this=0x1d16c54e01c1 <JSGlobal Object>#4#,a=0xf80ca9a5ce9 <String[2]: re>,b=0x295c53252171 <JSFunction (sfi = 0x2f5bff8f7a11)>#8#,c=0x3da5b53fb4c1 <vO map = 0x233bc9c90a61>#7#) 24: c [https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.DAxKPHidPdg.O/m=core/am=TO4YKg/rt=j/d=1/rs=AFB8gswQOSH9oxbwlAe3NOTydE5apawiCA:75] [bytecode=0xf0b45f76659 offset=53](this=0x1d16c54e01c1 <JSGlobal Object>#4#) -----
,
Apr 27 2017
Looks like we leak the_hole to JavaScript. Could be related to my change. You could revert it speculatively. How do you repro this locally?
,
Apr 27 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/3721c3608a5aef73b1762e6906257c9d9f8e0d36 commit 3721c3608a5aef73b1762e6906257c9d9f8e0d36 Author: perezju <perezju@chromium.org> Date: Thu Apr 27 11:53:13 2017 [tools/perf] Disable load:tools:drive system health story Story shows a high failure rate on many different perf bots. TBR=nednguyen@google.com BUG= 715936 Review-Url: https://codereview.chromium.org/2848573002 Cr-Commit-Position: refs/heads/master@{#467640} [modify] https://crrev.com/3721c3608a5aef73b1762e6906257c9d9f8e0d36/tools/perf/page_sets/system_health/loading_stories.py
,
Apr 27 2017
try: $ tools/perf/run_benchmark.py system_health.memory_desktop --story-filter load:tools:drive --browser [some_browser] Try "--browser list" to show available browsers, from the configs failing this should repro on a browser for any platform.
,
Apr 27 2017
,
Apr 28 2017
Yep, it's my CL (https://codereview.chromium.org/2836913004). Revert in-flight.
,
Apr 28 2017
The following revision refers to this bug: https://chromium.googlesource.com/v8/v8.git/+/53d31d0623bd88ce9a0041a767f36eafd3f1de8b commit 53d31d0623bd88ce9a0041a767f36eafd3f1de8b Author: bmeurer <bmeurer@chromium.org> Date: Fri Apr 28 05:40:46 2017 Revert of [turbofan] General consolidation of element access. (patchset #1 id:1 of https://codereview.chromium.org/2836913004/ ) Reason for revert: Breaks load:tools:drive story Original issue's description: > [turbofan] General consolidation of element access. > > Avoid TransitionElementsKind when storing to objects which only differ > in holeyness of their elements kind. Instead go for polymorphic > CheckMaps, which can often by optimized and avoid the mutation of the > array map. > > This generalizes the approach https://codereview.chromium.org/2836943003 > which covered only element loads. > > R=yangguo@chromium.org > BUG=v8:5267 > > Review-Url: https://codereview.chromium.org/2836913004 > Cr-Commit-Position: refs/heads/master@{#44828} > Committed: https://chromium.googlesource.com/v8/v8/+/ed573cee5c1d1e42158829dc0b92fb697234e121 TBR=yangguo@chromium.org # Not skipping CQ checks because original CL landed more than 1 days ago. BUG=v8:5267, chromium:715936 Review-Url: https://codereview.chromium.org/2852623002 Cr-Commit-Position: refs/heads/master@{#44958} [modify] https://crrev.com/53d31d0623bd88ce9a0041a767f36eafd3f1de8b/src/compiler/access-info.cc [modify] https://crrev.com/53d31d0623bd88ce9a0041a767f36eafd3f1de8b/src/compiler/access-info.h
,
Apr 28 2017
,
Apr 28 2017
Issue 715687 has been merged into this issue.
,
Apr 28 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/17cb970f145b4eb3df0c95ced62d38dbf521ca6d commit 17cb970f145b4eb3df0c95ced62d38dbf521ca6d Author: primiano <primiano@chromium.org> Date: Fri Apr 28 11:16:33 2017 Revert of [tools/perf] Disable load:tools:drive system health story (patchset #1 id:1 of https://codereview.chromium.org/2848573002/ ) Reason for re-enabling the story: The V8 CL that was causing the crash has been reverted in https://crrev.com/2852623002 Original issue's description: > [tools/perf] Disable load:tools:drive system health story > > Story shows a high failure rate on many different perf bots. > > TBR=nednguyen@google.com > BUG= 715936 > > Review-Url: https://codereview.chromium.org/2848573002 > Cr-Commit-Position: refs/heads/master@{#467640} > Committed: https://chromium.googlesource.com/chromium/src/+/3721c3608a5aef73b1762e6906257c9d9f8e0d36 BUG= 715936 Review-Url: https://codereview.chromium.org/2851703003 Cr-Commit-Position: refs/heads/master@{#467958} [modify] https://crrev.com/17cb970f145b4eb3df0c95ced62d38dbf521ca6d/tools/perf/page_sets/system_health/loading_stories.py
,
May 8 2017
Issue 718857 has been merged into this issue. |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by perezju@chromium.org
, Apr 27 2017