New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 767144 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Sep 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Windows
Pri: 1
Type: Bug



Sign in to add a comment

WebGLConformanceIntegrationTest.WebglConformance_deqp_functional_gles3_clipping flaky on GPU FYI and ANGLE bots, suspecting V8

Project Member Reported by jmad...@chromium.org, Sep 20 2017

Issue description

Only seen this on Windows so far, on both NVIDIA or AMD:

https://build.chromium.org/p/tryserver.chromium.angle/builders/win_angle_rel_ng/builds/6868
https://build.chromium.org/p/chromium.gpu.fyi/builders/Win7%20Release%20%28AMD%20R7%20240%29/builds/1462

Unsure exactly when this started. I think it's a V8 regression, from some info in the logs:

#
# Fatal error in ../../v8\src/heap/spaces-inl.h, line 372
# Debug check failed: top() >= top_on_previous_step_.
#
Backtrace:
	base::debug::StackTrace::StackTrace [0x66450EE7+55]
	base::debug::StackTrace::StackTrace [0x6644B68A+10]
	V8_Fatal [0x6702EC11+81]
	media::WebMediaCapabilitiesClientImpl::DecodingInfo [0x6702E5B6+1108]
	v8::internal::PagedSpace::AllocateRaw [0x65EFF8BB+43]
	v8::internal::Heap::AllocateRaw [0x65EFF7F9+505]
	v8::internal::Heap::AllocateFillerObject [0x65F2D910+32]
	v8::internal::Factory::NewFillerObject [0x65F045E2+34]
	v8::internal::Runtime::ThrowIteratorError [0x661006E9+969]
	v8::internal::Runtime_AllocateInTargetSpace [0x660FAD97+215]
Backtrace:
	(No symbol) [0x00000000]
	v8::base::OS::Abort [0x6702F0FD+13]
	v8::internal::PagedSpace::AllocateRaw [0x65EFF8BB+43]
	v8::internal::Heap::AllocateRaw [0x65EFF7F9+505]
	v8::internal::Heap::AllocateFillerObject [0x65F2D910+32]
	v8::internal::Factory::NewFillerObject [0x65F045E2+34]
	v8::internal::Runtime::ThrowIteratorError [0x661006E9+969]
	v8::internal::Runtime_AllocateInTargetSpace [0x660FAD97+215]
	(No symbol) [0x0C986C0A]
	(No symbol) [0x05EBE39E]
	(No symbol) [0x0C9F2FFB]
	(No symbol) [0x0C9F2FFB]
	(No symbol) [0x0C9F2FFB]
	(No symbol) [0x0C9F2FFB]
	(No symbol) [0x0C9F2FFB]
	(No symbol) [0x0C9F2FFB]
	(No symbol) [0x0C9F2FFB]
	(No symbol) [0x0C9F2FFB]
	v8::internal::StackGuard::InitThread [0x65EF8AB5+869]
	WTF::HashTableHelper<blink::Member<blink::XMLHttpRequest>,WTF::IdentityExtractor,WTF::HashTraits<blink::Member<blink::XMLHttpRequest> > >::IsEmptyOrDeletedBucket [0x680EEEFD+13]
Found crashpad_database_util

0033d00c 6702f0fd 0033d02c 6702e5b6 6876e1d4 0x0
	0033d02c 65eff8bb 6876e1d4 00000174 6876e244 chrome_child!v8::base::OS::Abort+0xd
	0033d050 65eff7f9 0033d07c 00000050 00000000 chrome_child!v8::internal::PagedSpace::AllocateRaw+0x2b
	0033d08c 65f2d910 0033d0bc 00000050 00000001 chrome_child!v8::internal::Heap::AllocateRaw+0x1f9
	0033d0ac 65f045e2 0033d0d4 00000050 01267700 chrome_child!v8::internal::Heap::AllocateFillerObject+0x20
	0033d0d8 661006e9 0033d118 00000050 01267700 chrome_child!v8::internal::Factory::NewFillerObject+0x22
	0033d108 660fad97 00000002 0033d158 01267700 chrome_child!v8::internal::Runtime::ThrowIteratorError+0x3c9
	0033d128 0c986c0a 00000002 0033d158 01267740 chrome_child!v8::internal::Runtime_AllocateInTargetSpace+0xd7
	0033d14c 05ebe39e 00000004 000000a0 3ac321b1 0xc986c0a
	0033d210 0c9f2ffb 3ac31cc5 3ac324f5 3ac324e9 0x5ebe39e
	0033d29c 0c9f2ffb 00000000 0000000c 3ac2f28d 0xc9f2ffb
	0033d364 0c9f2ffb 00000002 0000000c 3ac2f28d 0xc9f2ffb
	0033d3b4 0c9f2ffb 00000000 00000002 00000000 0xc9f2ffb
	0033d408 0c9f2ffb 00000002 00000000 00002806 0xc9f2ffb
	0033d454 0c9f2ffb 00000000 00002806 0000000c 0xc9f2ffb
	0033d4c4 0c9f2ffb 3ac2ea25 3ac2e9c9 3ac2e1e1 0xc9f2ffb
	0033d52c 0c9f2ffb 3ecacf79 27da34e1 04804185 0xc9f2ffb
	0033d640 65ef8ab5 04804185 3ecac7a5 1a4e81e1 0xc9f2ffb
	0033d694 680eeefd 2f6e4f08 0033d798 0033d76c chrome_child!v8::internal::StackGuard::InitThread+0x365
	00000000 00000000 00000000 00000000 00000000 chrome_child!WTF::HashTableHelper<WTF::KeyValuePair<blink::Member<blink::CSSPendingSubstitutionValue const >,blink::Member<blink::HeapHashMap<enum blink::CSSPropertyID,blink::Member<blink::CSSValue const >,WTF::IntHash<unsigned int>,WTF::HashTraits<enum blink::CSSPropertyID>,WTF::HashTraits<blink::Member<blink::CSSValue const > > > > >,WTF::KeyValuePairKeyExtractor,WTF::HashTraits<blink::Member<blink::CSSPendingSubstitutionValue const > > >::IsEmptyOrDeletedBucket+0xd

CC'ing some folks who might be able to route this to the right people.
 
Cc: briander...@chromium.org
Labels: OS-Linux
Summary: WebGLConformanceIntegrationTest.WebglConformance_deqp_functional_gles3_clipping flaky on GPU FYI and ANGLE bots, suspecting V8 (was: WebGLConformanceIntegrationTest.WebglConformance_deqp_functional_gles3_clipping flaky on Windows GPU FYI and ANGLE bots, suspecting V8)
Also seems to be affecting Linux. Brian, do you know a good contact on the v8 team to figure out which roll affected this?

https://build.chromium.org/p/tryserver.chromium.angle/builders/linux_angle_rel_ng/builds/6460
Cc: machenb...@chromium.org hablich@chromium.org kozyatinskiy@chromium.org
CC'ing v8 auto-roll owners.
Components: -Infra>Client>V8 Blink>JavaScript>GC
Owner: mlippautz@chromium.org
Status: Assigned (was: Untriaged)
Assuming https://chromium.googlesource.com/v8/v8/+log/fab831bb..399c4c84 is the range were it appeared (for now). Do you have more accurate data jmadill@?
Cc: u...@chromium.org
Cc: hpayer@chromium.org ofrobots@google.com
This is none of my CLs in the roll but likely introduced (or flushing out something) in
  https://chromium-review.googlesource.com/c/v8/v8/+/671127

Ali, any idea?
I think the real regressing roll might be https://chromium-review.googlesource.com/674825 with range:

https://chromium.googlesource.com/v8/v8/+log/b7b0ee77..fab831bb

Here are the first failing builds for x64 and x64 windows release ANGLE trybots:

https://build.chromium.org/p/tryserver.chromium.angle/builders/win_angle_x64_rel_ng/builds/6486
https://build.chromium.org/p/tryserver.chromium.angle/builders/win_angle_rel_ng/builds/6852

Both have a "got_v8_revision" of fab831bb. Anything in there strike you as suspect?
Ah, sorry, didn't read the comment in #5 first. That CL is indeed in the suspect regression range. Should we revert rolls or revert and roll forward or something of the kind?
Ulan, Ali: You were involved. Can you take a look?

I think there were already follow up CLs, so I am unsure whether just reverting would work.
Status: Fixed (was: Assigned)
Reverted in
  https://chromium-review.googlesource.com/c/v8/v8/+/676683
The revert didn't roll into chromium yet, but will soon...
Thanks for fixing!
Is there an easy way to run the affected test-case run with my build of V8 without needing special hardware?
I would try making a build of chrome that uses similar settings as the bots (see page below). The crash was popping up in every platform last I saw (Linux/Windows/Mac) so as long as you have the ability to run the tests, you should be able to repro. You don't need a special GPU, as long as you have a real machine and not a VM. I would try running the test many times and try to repro the crash. You can run it online at https://www.khronos.org/registry/webgl/sdk/tests/webgl-conformance-tests.html

https://luci-logdog.appspot.com/v/?s=chromium%2Fbb%2Fchromium.gpu.fyi%2FGPU_Win_Builder%2F75371%2F%2B%2Frecipes%2Fsteps%2Fgenerate_build_files%2F0%2Fstdout

Sign in to add a comment