New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 858862 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner:
Last visit > 30 days ago
Closed: Jul 5
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug-Regression
Hotlist-MemoryInfra

Blocking:
issue 852420



Sign in to add a comment

Crashes in chrome!GetBlackHoleMad / chrome!AddAllocatorDumpInternal while running WebGL 2.0 conformance tests

Project Member Reported by kbr@chromium.org, Jun 28 2018

Issue description

This seems to be blocking V8 rolls - fortunately, it looks like this hasn't made it into the source tree.

Shows up here:

https://ci.chromium.org/p/chromium/builders/luci.chromium.try/linux_optional_gpu_tests_rel?limit=200

Only a few failures:

https://ci.chromium.org/p/chromium/builders/luci.chromium.try/linux_optional_gpu_tests_rel/5252
https://ci.chromium.org/p/chromium/builders/luci.chromium.try/linux_optional_gpu_tests_rel/5247
https://ci.chromium.org/p/chromium/builders/luci.chromium.try/linux_optional_gpu_tests_rel/5241
https://ci.chromium.org/p/chromium/builders/luci.chromium.try/linux_optional_gpu_tests_rel/5230
https://ci.chromium.org/p/chromium/builders/luci.chromium.try/linux_optional_gpu_tests_rel/5226
https://ci.chromium.org/p/chromium/builders/luci.chromium.try/linux_optional_gpu_tests_rel/5223
https://ci.chromium.org/p/chromium/builders/luci.chromium.try/linux_optional_gpu_tests_rel/5220

One concrete example:

https://ci.chromium.org/p/chromium/builders/luci.chromium.try/linux_optional_gpu_tests_rel/5113
https://chromium-swarm.appspot.com/task?id=3e5b221db8028110&refresh=10&show_raw=1

Stack trace:

[107/134] gpu_tests.webgl_conformance_integration_test.WebGLConformanceIntegrationTest.WebglConformance_deqp_functional_gles3_shaderoperator_common_functions failed unexpectedly 120.1401s:
  No path to crashpad_database_util found
  No minidump found via crashpad_database_util
  Found minidump via globbing in minidump dir
  Minidump found: /b/swarm_slave/w/itboQdMl/tmp_OuTCu/chromium-renderer-minidump-954b2c22015937c3.dmp
  Uploading /b/swarm_slave/w/itboQdMl/tmp_OuTCu/chromium-renderer-minidump-954b2c22015937c3.dmp to gs://chrome-telemetry-output/minidump-2018-06-27_10-38-29-73108.dmp
  Dumping breakpad symbols.
  No path to crashpad_database_util found
  No minidump found via crashpad_database_util
  Found minidump via globbing in minidump dir
  Can't get standard output with --show-stdout
  
Traceback (most recent call last):
[...]
  DevtoolsTargetCrashException: Devtools target crashed
  ********************************************************************************
  (/b/swarm_slave/w/ir/third_party/catapult/telemetry/telemetry/internal/backends/chrome_inspector/inspector_backend.py:513 _AddDebuggingInformation) Received a socket error in the browser connection and the tab no longer exists. The tab probably crashed.
  ********************************************************************************
  (/b/swarm_slave/w/ir/third_party/catapult/telemetry/telemetry/internal/backends/chrome_inspector/inspector_backend.py:514 _AddDebuggingInformation) Debugger url: ws://127.0.0.1:39030/devtools/page/E7FD07CB89A63A15FA59DB7CB627696E
  Found Minidump: True
  Stack Trace:
  ********************************************************************************
  	Operating system: Linux
  	                  0.0.0 Linux 3.13.0-91-generic #138-Ubuntu SMP Fri Jun 24 17:00:34 UTC 2016 x86_64
  	CPU: amd64
  	     family 6 model 94 stepping 3
  	     1 CPU
  	
  	GPU: UNKNOWN
  	
  	Crash reason:  SIGSEGV
  	Crash address: 0x0
  	Process uptime: not available
  	
  	Thread 0 (crashed)
  	 0  libc-2.19.so + 0x3a177
  	    rax = 0x0000000000000006   rdx = 0x0000000000000006
  	    rcx = 0xffffffffffffffff   rbx = 0x0000000000000034
  	    rsi = 0x0000000000000001   rdi = 0x0000000000000001
  	    rbp = 0x00007ffdc6ebc2b0   rsp = 0x00007ffdc6ebc180
  	     r8 = 0x0000000000000000    r9 = 0x00007ffdc6ebc0d0
  	    r10 = 0x0000000000000008   r11 = 0x0000000000000202
  	    r12 = 0x00007ffdc6ebc780   r13 = 0x00007ffdc6ebc770
  	    r14 = 0x00007ffdc6ebc778   r15 = 0x000010c7b723546f
  	    rip = 0x00007f77ecc46177
  	    Found by: given as instruction pointer in context
  	 1  chrome!~LogMessage [callback.h : 129 + 0x7]
  	    rbp = 0x00007ffdc6ebc750   rsp = 0x00007ffdc6ebc2c0
  	    rip = 0x00007f77f87f620f
  	    Found by: previous frame's frame pointer
  	 2  chrome!GetBlackHoleMad [process_memory_dump.cc : 484 + 0x8]
  	    rbx = 0x00007ffdc6ebc770   rbp = 0x00007ffdc6ebc8c0
  	    rsp = 0x00007ffdc6ebc760   r12 = 0x0000000000000000
  	    r13 = 0x0000000000000000   r14 = 0x000010c7b7aefae0
  	    r15 = 0x000010c7b7aefae0   rip = 0x00007f77f886aa6b
  	    Found by: call frame info
  	 3  chrome!AddAllocatorDumpInternal [process_memory_dump.cc : 259 + 0x8]
  	    rbx = 0x00007ffdc6ebca60   rbp = 0x00007ffdc6ebca40
  	    rsp = 0x00007ffdc6ebc8d0   r12 = 0x0000000000000000
  	    r13 = 0x0000000000000000   r14 = 0x000010c7b7aefae0
  	    r15 = 0x000010c7b7aefae0   rip = 0x00007f77f886a858
  	    Found by: call frame info
  	 4  chrome!CreateAllocatorDump [process_memory_dump.cc : 242 + 0x8]
  	    rbx = 0x000010c7b73ace60   rbp = 0x00007ffdc6ebca80
  	    rsp = 0x00007ffdc6ebca50   r12 = 0x0000000000000000
  	    r13 = 0x0000000000000000   r14 = 0x00007ffdc6ebcbd0
  	    r15 = 0x000010c7b7aefae0   rip = 0x00007f77f886a71c
  	    Found by: call frame info
  	 5  chrome!DumpHeapStatistics [v8_isolate_memory_dump_provider.cc : 151 + 0x13]
  	    rbx = 0x0000000000000006   rbp = 0x00007ffdc6ebcd60
  	    rsp = 0x00007ffdc6ebca90   r12 = 0x0000000000000000
  	    r13 = 0x0000000000000000   r14 = 0x00007ffdc6ebcbb0
  	    r15 = 0x00007f77f370b398   rip = 0x00007f77fb7f5c41
  	    Found by: call frame info
  	 6  chrome!OnMemoryDump [v8_isolate_memory_dump_provider.cc : 44 + 0xe]
  	    rbx = 0x000010c7b701e6c0   rbp = 0x00007ffdc6ebcda0
  	    rsp = 0x00007ffdc6ebcd70   r12 = 0x000010c7b6f49db8
  	    r13 = 0x000010c7b6fe7d01   r14 = 0x000010c7b7aefae0
  	    r15 = 0x000010c7b7aefb20   rip = 0x00007f77fb7f5a78
  	    Found by: call frame info
  	 7  chrome!InvokeOnMemoryDump [memory_dump_manager.cc : 458 + 0x6]
  	    rbx = 0x00007ffdc6ebcdf0   rbp = 0x00007ffdc6ebcf60
  	    rsp = 0x00007ffdc6ebcdb0   r12 = 0x000010c7b6f49db8
  	    r13 = 0x000010c7b6fe7d01   r14 = 0x000010c7b74e1301
  	    r15 = 0x000010c7b6fe7d40   rip = 0x00007f77f88670d9
  	    Found by: call frame info
  	 8  chrome!ContinueAsyncProcessDump [memory_dump_manager.cc : 372 + 0xf]
  	    rbx = 0x000010c7b747bf38   rbp = 0x00007ffdc6ebd120
  	    rsp = 0x00007ffdc6ebcf70   r12 = 0x000010c7b74e13c0
  	    r13 = 0x000010c7b6fe7d40   r14 = 0x000010c7b74e13e0
  	    r15 = 0x000010c7b6fd97a0   rip = 0x00007f77f8866c65
  	    Found by: call frame info
  	 9  chrome!CreateProcessDump [memory_dump_manager.cc : 319 + 0xf]
  	    rbx = 0x000010c7b6f49db0   rbp = 0x00007ffdc6ebd2f0
  	    rsp = 0x00007ffdc6ebd130   r12 = 0x0000000000000002
  	    r13 = 0x000010c7b6f49d88   r14 = 0x000010c7b74e13c0
  	    r15 = 0x000010c7b6f49d80   rip = 0x00007f77f886698d
  	    Found by: call frame info
  	10  chrome!RequestChromeMemoryDump [client_process_impl.cc : 84 + 0xe]
  	    rbx = 0x000010c7b740e500   rbp = 0x00007ffdc6ebd460
  	    rsp = 0x00007ffdc6ebd300   r12 = 0x00007ffdc6ebd308
  	    r13 = 0x000010c7b6f45180   r14 = 0x00007ffdc6ebd4b0
  	    r15 = 0x000010c7b6f49d80   rip = 0x00007f77fa11cfda
  	    Found by: call frame info
  	11  chrome!AcceptWithResponder [memory_instrumentation.mojom.cc : 905 + 0x1a]
  	    rbx = 0x00007ffdc6ebd4a0   rbp = 0x00007ffdc6ebd640
  	    rsp = 0x00007ffdc6ebd470   r12 = 0x0000000000000001
  	    r13 = 0x000010c7b7a1d660   r14 = 0x000010c7b6f45180
  	    r15 = 0x00007ffdc6ebd4e8   rip = 0x00007f77fa1354bb
  	    Found by: call frame info
  	12  chrome!AcceptWithResponder [memory_instrumentation.mojom.h : 474 + 0x5]
  	    rbx = 0x000010c7b7a1d660   rbp = 0x00007ffdc6ebd660
  	    rsp = 0x00007ffdc6ebd650   r12 = 0x00007ffdc6ebd698
  	    r13 = 0x000010c7b6fcb160   r14 = 0x00007ffdc6ebdac8
  	    r15 = 0x000010c7b6f686e0   rip = 0x00007f77fa11da16
  	    Found by: call frame info
  	13  chrome!HandleValidatedMessage [interface_endpoint_client.cc : 394 + 0x10]
...

Please investigate. It's a relief this didn't make it through the commit queue.

 
Looks like V8 is enabled in background dumps but some paths emitted are not whitelisted for background in memory_infra_background_whitelist.cc (it's a PII and performance safety cross-check) and are causing that failure.

I guess v8 recently added some other memory-infra paths.
If they are meant to be added to background dumps (slow reports and the like) and they don't add significant size/performance penalty, add them to the whitelist.
If not, please exclude the code that generates them using an "if (dump_args_.level_of_detail != MemoryDumpLevelOfDetail::BACKGROUND)"

The current set of V8 paths whitelisted for bg dumps is (From memory_infra_background_whitelist.cc):
    "v8/isolate_0x?/contexts/detached_context",
    "v8/isolate_0x?/contexts/native_context",
    "v8/isolate_0x?/heap_spaces",
    "v8/isolate_0x?/heap_spaces/code_space",
    "v8/isolate_0x?/heap_spaces/large_object_space",
    "v8/isolate_0x?/heap_spaces/map_space",
    "v8/isolate_0x?/heap_spaces/new_space",
    "v8/isolate_0x?/heap_spaces/new_large_object_space",
    "v8/isolate_0x?/heap_spaces/old_space",
    "v8/isolate_0x?/heap_spaces/read_only_space",
    "v8/isolate_0x?/malloc",
    "v8/isolate_0x?/zapped_for_debug",
Owner: hpayer@chromium.org
Status: Assigned (was: Untriaged)
Hannes, is this fixed with your latest CLs?
Status: Fixed (was: Assigned)
Status: Assigned (was: Fixed)
Hannes, if this was fixed under some other bug then could you please duplicate this bug into the other one so that we can easily find the cause again later? Thanks. You can reference V8 bugs by duplicating it into "v8:[num]".

Status: Fixed (was: Assigned)
This was fixed with

commit 831e4d1fffc21204e38a2ff1ebe0bf100236daf2
Author: Hannes Payer <hpayer@chromium.org>
Date:   Mon Jul 2 08:41:11 2018 +0000

    Add new_large_object_space to allocator dump whitelist.
    
    Bug: chromium:852420
    Change-Id: I5974bf3d0576e383f1a1ae0b1163aed94ca88445
    Reviewed-on: https://chromium-review.googlesource.com/1119906
    Reviewed-by: Siddhartha S <ssid@chromium.org>
    Commit-Queue: Hannes Payer <hpayer@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#571841}

Blocking: 852420
Status: WontFix (was: Fixed)
Thanks. Blocking other bug, closing WontFix because no CL associated with this bug.

Sign in to add a comment