Closed Bug 1085032 Opened 11 years ago Closed 10 years ago

[e10s] Tabs can hang and consume 100% of a CPU

Categories

(Core :: General, defect)

Product:
Core
Component:
General
Platform:
x86_64
Linux
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED INVALID
Tracking Flags:
Tracking Status
e10s + ---

People

(Reporter: stephen.moehle, Unassigned)

References

(Blocks 1 open bug)

Details

Occasionally on Nightly when e10s is enabled, a tab will hang and consume 100% of a CPU. The page cannot be scrolled and clicking on links has no effect. Chrome menus, other tabs, etc. are OK. Running strace on the Web Content process that is pegging the CPU shows the following which repeats endlessly once every second or so: --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f2cae5173fd} --- mprotect(0x7f2cae50e000, 42152, PROT_READ|PROT_WRITE|PROT_EXEC) = 0 rt_sigreturn() Once I kill the offending Web Content process, I get a message about the tab having crashed or failed, and I can then reload the tab. This seems to happen randomly on various sites, but http://feedly.com seems to be a fairly reliable trigger for the problem. Nightly 20141018030201 Fedora 20 Linux, 64 bit
Had another hang with a Web Content process taking 100% of a CPU. This time strace produces the following with a repeating cycle of addresses for si_addr: --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7fce892403d8} --- mprotect(0x7fce8fddf000, 7392, PROT_READ|PROT_WRITE|PROT_EXEC) = 0 mprotect(0x7fce9a5a0000, 19560, PROT_READ|PROT_WRITE|PROT_EXEC) = 0 mprotect(0x7fce9917f000, 65408, PROT_READ|PROT_WRITE|PROT_EXEC) = 0 mprotect(0x7fce8fd9f000, 58032, PROT_READ|PROT_WRITE|PROT_EXEC) = 0 mprotect(0x7fce9e873000, 64632, PROT_READ|PROT_WRITE|PROT_EXEC) = 0 mprotect(0x7fce90d60000, 65504, PROT_READ|PROT_WRITE|PROT_EXEC) = 0 mprotect(0x7fce96117000, 65312, PROT_READ|PROT_WRITE|PROT_EXEC) = 0 mprotect(0x7fce9680d000, 33336, PROT_READ|PROT_WRITE|PROT_EXEC) = 0 mprotect(0x7fce8923c000, 21400, PROT_READ|PROT_WRITE|PROT_EXEC) = 0 mprotect(0x7fce8d906000, 65232, PROT_READ|PROT_WRITE|PROT_EXEC) = 0 mprotect(0x7fce9bc5e000, 65464, PROT_READ|PROT_WRITE|PROT_EXEC) = 0 mprotect(0x7fce991ef000, 64784, PROT_READ|PROT_WRITE|PROT_EXEC) = 0 mprotect(0x7fce9fc82000, 64848, PROT_READ|PROT_WRITE|PROT_EXEC) = 0 mprotect(0x7fce991af000, 65368, PROT_READ|PROT_WRITE|PROT_EXEC) = 0 rt_sigreturn() = 1 In addition, I managed to use gdb to break the into the Web Content process and get a call stack. I did this a number of times and always got the same call stack: 0x00007fceb8d18e9f in js::SetObjectElement(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, bool) () from /home/stephe/mozilla/nightly/libxul.so (gdb) bt #0 0x00007fceb8d18e9f in js::SetObjectElement(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, bool) () from /home/stephe/mozilla/nightly/libxul.so #1 0x00007fcebd51d4d6 in ?? () #2 0x0000000000000e00 in ?? () #3 0x00007fff3bd5ebf0 in ?? () #4 0x00007fcebc7d81e0 in js::jit::CallElementInfo () from /home/stephe/mozilla/nightly/libxul.so #5 0x00007fcea0727b20 in ?? () #6 0x00007fce892403ad in ?? () #7 0x0000000000000b80 in ?? () #8 0x00007fcea19929e0 in ?? () #9 0xfffaffce9ba13d90 in ?? () #10 0xfff8800000000000 in ?? () #11 0x0000000000000000 in ?? ()
Blocks: e10s-perf
Some more call stacks from gdb during a 100% CPU hang. Like the previous call stack, they all have js::jit::CallElementInfo() and js::SetObjectElement() in common. #0 0x00007f21a8eeb3e4 in js::types::TypeObject::basePropertyCount() () from /home/stephe/mozilla/nightly/libxul.so #1 0x00007f21a746c528 in js::SetObjectElement(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, bool) () from /home/stephe/mozilla/nightly/libxul.so #2 0x00007f21abc834d6 in ?? () #3 0x00007f218ef28b20 in ?? () #4 0x00007fff37afee78 in ?? () #5 0x0000000000000c00 in ?? () #6 0x00007f21aaf41420 in js::jit::CallElementInfo () from /home/stephe/mozilla/nightly/libxul.so #7 0x00007f218ef27b20 in ?? () #8 0x00007f2188dbb2f4 in ?? () #9 0x0000000000000a00 in ?? () #10 0x00007f2190591940 in ?? () #11 0xfffaff215c09eb08 in ?? () #12 0xfff9800000000001 in ?? () #13 0x0000000000000000 in ?? () #0 0x00007f21a8ed9f49 in js::types::PrimitiveTypeFlag(JSValueType) () from /home/stephe/mozilla/nightly/libxul.so #1 0x00007f21a742302e in js::types::AddTypePropertyId(js::ExclusiveContext*, js::types::TypeObject*, jsid, js::types::Type) () from /home/stephe/mozilla/nightly/libxul.so #2 0x00007f21a74231b5 in js::types::AddTypePropertyId(js::ExclusiveContext*, js::types::TypeObject*, jsid, JS::Value const&) () from /home/stephe/mozilla/nightly/libxul.so #3 0x00007f21a7400612 in js::NativeObject::setSlotWithType(js::ExclusiveContext*, js::Shape*, JS::Value const&, bool) () from /home/stephe/mozilla/nightly/libxul.so #4 0x00007f21a7469a6c in bool js::NativeSet<(js::ExecutionMode)0>(js::ExecutionModeTraits<(js::ExecutionMode)0>::ContextType, JS::Handle<js::NativeObject*>, JS::Handle<JSObject*>, JS::Handle<js::Shape*>, bool, JS::MutableHandle<JS::Value>) () from /home/stephe/mozilla/nightly/libxul.so #5 0x00007f21a746a3d5 in bool js::baseops::SetPropertyHelper<(js::ExecutionMode)0>(js::ExecutionModeTraits<(js::ExecutionMode)0>::ContextType, JS::Handle<js::NativeObject*>, JS::Handle<JSObject*>, JS::Handle<jsid>, js::baseops::QualifiedBool, JS::MutableHandle<JS::Value>, bool) () from /home/stephe/mozilla/nightly/libxul.so #6 0x00007f21a746c5f9 in js::SetObjectElement(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, bool) () from /home/stephe/mozilla/nightly/libxul.so #7 0x00007f21abc834d6 in ?? () #8 0x00007f218ef28b20 in ?? () #9 0x00007fff37afee78 in ?? () #10 0x0000000000000c00 in ?? () #11 0x00007f21aaf41420 in js::jit::CallElementInfo () from /home/stephe/mozilla/nightly/libxul.so #12 0x00007f218ef27b20 in ?? () #13 0x00007f2188dbb2c9 in ?? () #14 0x0000000000000a00 in ?? () #15 0x00007f2190591940 in ?? () #16 0xfffaff218a2116b8 in ?? () #17 0x0000000000000000 in ?? () #0 0x00007f21a737f380 in JSAtom* js::ToAtom<(js::AllowGC)1>(js::ExclusiveContext*, js::MaybeRooted<JS::Value, (js::AllowGC)1>::HandleType) () from /home/stephe/mozilla/nightly/libxul.so #1 0x00007f21a737069d in bool js::ValueToId<(js::AllowGC)1>(JSContext*, js::MaybeRooted<JS::Value, (js::AllowGC)1>::HandleType, js::MaybeRooted<jsid, (js::AllowGC)1>::MutableHandleType) () from /home/stephe/mozilla/nightly/libxul.so #2 0x00007f21a746c4eb in js::SetObjectElement(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, bool) () from /home/stephe/mozilla/nightly/libxul.so #3 0x00007f21abc834d6 in ?? () #4 0x00007f218ef28b20 in ?? () #5 0x00007fff37afee78 in ?? () #6 0x0000000000000c00 in ?? () #7 0x00007f21aaf41420 in js::jit::CallElementInfo () from /home/stephe/mozilla/nightly/libxul.so #8 0x00007f218ef27b20 in ?? () #9 0x00007f2188dbb2c9 in ?? () #10 0x0000000000000a00 in ?? () #11 0x00007f2190591940 in ?? () #12 0xfffaff218a2116b8 in ?? () #13 0x0000000000000000 in ?? () #0 0x00007f21a736db56 in js::InternalGCMethods<JS::Value>::preBarrier(JS::Value) () from /home/stephe/mozilla/nightly/libxul.so #1 0x00007f21a740050b in js::NativeObject::setSlotWithType(js::ExclusiveContext*, js::Shape*, JS::Value const&, bool) () from /home/stephe/mozilla/nightly/libxul.so #2 0x00007f21a7469a6c in bool js::NativeSet<(js::ExecutionMode)0>(js::ExecutionModeTraits<(js::ExecutionMode)0>::ContextType, JS::Handle<js::NativeObject*>, JS::Handle<JSObject*>, JS::Handle<js::Shape*>, bool, JS::MutableHandle<JS::Value>) () from /home/stephe/mozilla/nightly/libxul.so #3 0x00007f21a746a3d5 in bool js::baseops::SetPropertyHelper<(js::ExecutionMode)0>(js::ExecutionModeTraits<(js::ExecutionMode)0>::ContextType, JS::Handle<js::NativeObject*>, JS::Handle<JSObject*>, JS::Handle<jsid>, js::baseops::QualifiedBool, JS::MutableHandle<JS::Value>, bool) () from /home/stephe/mozilla/nightly/libxul.so #4 0x00007f21a746c5f9 in js::SetObjectElement(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, bool) () from /home/stephe/mozilla/nightly/libxul.so #5 0x00007f21abc834d6 in ?? () #6 0x00007f218ef28b20 in ?? () #7 0x00007fff37afee78 in ?? () #8 0x0000000000000c00 in ?? () #9 0x00007f21aaf41420 in js::jit::CallElementInfo () from /home/stephe/mozilla/nightly/libxul.so #10 0x00007f218ef27b20 in ?? () #11 0x00007f2188dbb2f4 in ?? () #12 0x0000000000000a00 in ?? () #13 0x00007f2190591940 in ?? () #14 0xfffaff215c09eb08 in ?? () #15 0xfff9800000000001 in ?? () #16 0x0000000000000000 in ?? () #0 0x00007f21a7469a79 in bool js::NativeSet<(js::ExecutionMode)0>(js::ExecutionModeTraits<(js::ExecutionMode)0>::ContextType, JS::Handle<js::NativeObject*>, JS::Handle<JSObject*>, JS::Handle<js::Shape*>, bool, JS::MutableHandle<JS::Value>) () from /home/stephe/mozilla/nightly/libxul.so #1 0x00007f21a746a3d5 in bool js::baseops::SetPropertyHelper<(js::ExecutionMode)0>(js::ExecutionModeTraits<(js::ExecutionMode)0>::ContextType, JS::Handle<js::NativeObject*>, JS::Handle<JSObject*>, JS::Handle<jsid>, js::baseops::QualifiedBool, JS::MutableHandle<JS::Value>, bool) () from /home/stephe/mozilla/nightly/libxul.so #2 0x00007f21a746c5f9 in js::SetObjectElement(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, bool) () from /home/stephe/mozilla/nightly/libxul.so #3 0x00007f21abc834d6 in ?? () #4 0x00007f218ef28b20 in ?? () #5 0x00007fff37afee78 in ?? () #6 0x0000000000000c00 in ?? () #7 0x00007f21aaf41420 in js::jit::CallElementInfo () from /home/stephe/mozilla/nightly/libxul.so #8 0x00007f218ef27b20 in ?? () #9 0x00007f2188dbb2f4 in ?? () #10 0x0000000000000a00 in ?? () #11 0x00007f2190591940 in ?? () #12 0xfffaff215c09eb08 in ?? () #13 0xfff9800000000001 in ?? () #14 0x0000000000000000 in ?? ()
I am seeing a slight variation of this more recently with the latest nightly builds. As usual, the Web Content process is pegging a CPU, and the whole browser is looked up tight. Killing Web Content allows the browser to recover with one of the tabs saying that it has crashed. The other tabs are usually pretty dead, too, and have to be reloaded. The following from strace repeats endlessly: --- SIGVTALRM {si_signo=SIGVTALRM, si_code=SI_TKILL, si_pid=24620, si_uid=500} --- rt_sigreturn() = 139805282367784 --- SIGVTALRM {si_signo=SIGVTALRM, si_code=SI_TKILL, si_pid=24620, si_uid=500} --- rt_sigreturn() = 8 --- SIGVTALRM {si_signo=SIGVTALRM, si_code=SI_TKILL, si_pid=24620, si_uid=500} --- rt_sigreturn() = 139804551152256 --- SIGVTALRM {si_signo=SIGVTALRM, si_code=SI_TKILL, si_pid=24620, si_uid=500} --- rt_sigreturn() = 139804475907184 --- SIGVTALRM {si_signo=SIGVTALRM, si_code=SI_TKILL, si_pid=24620, si_uid=500} --- rt_sigreturn() = 139804551152256 --- SIGVTALRM {si_signo=SIGVTALRM, si_code=SI_TKILL, si_pid=24620, si_uid=500} --- rt_sigreturn() = 1 --- SIGVTALRM {si_signo=SIGVTALRM, si_code=SI_TKILL, si_pid=24620, si_uid=500} --- rt_sigreturn() = 16 The stack in gdb always seems to be the following when I break execution: #0 0x00007f271115c72e in js::LookupNativeProperty(js::ExclusiveContext*, JS::Handle<js::NativeObject*>, JS::Handle<jsid>, JS::MutableHandle<JSObject*>, JS::MutableHandle<js::Shape*>) () from /home/stephe/mozilla/nightly/libxul.so #1 0x00007f2711173632 in bool js::baseops::SetPropertyHelper<(js::ExecutionMode)0>(js::ExecutionModeTraits<(js::ExecutionMode)0>::ContextType, JS::Handle<js::NativeObject*>, JS::Handle<JSObject*>, JS::Handle<jsid>, js::baseops::QualifiedBool, JS::MutableHandle<JS::Value>, bool) () from /home/stephe/mozilla/nightly/libxul.so #2 0x00007f2711174cec in js::SetObjectElement(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, bool) () from /home/stephe/mozilla/nightly/libxul.so #3 0x00007f2715a5f60e in ?? () #4 0x00007f26e714db92 in ?? () #5 0x00007fffebf8cdd0 in ?? () #6 0x00007f2714d1c380 in js::jit::CallElementInfo () from /home/stephe/mozilla/nightly/libxul.so #7 0x00007f26f8d51b50 in ?? () #8 0x00007f26e714d31d in ?? () #9 0x0000000000000a00 in ?? () #10 0x00007f26fa2f3370 in ?? () #11 0xfffaff26c89c0280 in ?? () #12 0xfff9800000000001 in ?? () #13 0x0000000000000000 in ?? ()
Stephen, does this still happen with latest Nightly build?
Flags: needinfo?(stephen.moehle)
Status: UNCONFIRMED → RESOLVED
Closed: 10 years ago
Resolution: --- → INVALID
Moving from Core::Untriaged to Core::General https://bugzilla.mozilla.org/show_bug.cgi?id=1407598
Component: Untriaged → General
Flags: needinfo?(stephen.moehle)
You need to log in before you can comment on or make changes to this bug.