Closed Bug 550044 Opened 14 years ago Closed 12 years ago

Crash during test_errorPropagation.html [@ JSScope::newDictionaryProperty(JSContext*, JSScopeProperty const&, JSScopeProperty**)]

Categories

(Core :: JavaScript Engine, defect)

x86
macOS
defect
Not set
critical

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: dholbert, Unassigned)

References

()

Details

(Keywords: crash, intermittent-failure)

Crash Data

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1267656510.1267657192.5230.gz
OS X 10.5.2 mozilla-central opt test mochitests-2/5 on 2010/03/03 14:48:30
s: moz2-darwin9-slave18

{
394 INFO Running /tests/dom/src/threads/test/test_errorPropagation.html...
TEST-UNEXPECTED-FAIL | automation.py | Exited with code 1 during test run
INFO | automation.py | Application ran for: 0:01:49.468502
INFO | automation.py | Reading PID log: /var/folders/TL/TLg3RrMbFAur2hBCXvCeqk+++TM/-Tmp-/tmpGXXgdKpidlog
PROCESS-CRASH | automation.py | application crashed (minidump found)
Operating system: Mac OS X
                  10.5.2 9C31
CPU: x86
     GenuineIntel family 6 model 15 stepping 2
     2 CPUs

Crash reason:  EXC_BAD_ACCESS / KERN_PROTECTION_FAILURE
Crash address: 0x0

Thread 0 (crashed)
 0  libmozjs.dylib!JSScope::newDictionaryProperty(JSContext*, JSScopeProperty const&, JSScopeProperty**) [jsscope.cpp:56b8a3bd290f : 521 + 0x6]
    eip = 0x00296415   esp = 0xbfffc0c0   ebp = 0xbfffc108   ebx = 0x00297b7e
    esi = 0x0e98a090   edi = 0xbfffc190   eax = 0x00000000   ecx = 0x0f704b80
    edx = 0x00000000   efl = 0x00210206
    Found by: given as instruction pointer in context
 1  libmozjs.dylib!JSScope::getChildProperty(JSContext*, JSScopeProperty*, JSScopeProperty&) [jsscope.cpp:56b8a3bd290f : 989 + 0x19]
    eip = 0x00297a81   esp = 0xbfffc110   ebp = 0xbfffc148
    Found by: previous frame's frame pointer
 2  libmozjs.dylib!JSScope::addPropertyHelper(JSContext*, long, int (*)(JSContext*, JSObject*, long, long*), int (*)(JSContext*, JSObject*, long, long*), unsigned int, unsigned int, unsigned int, int, JSScopeProperty**) [jsscope.cpp:56b8a3bd290f : 1301 + 0x1c]
    eip = 0x00297d85   esp = 0xbfffc150   ebp = 0xbfffc1c8
    Found by: previous frame's frame pointer
 3  libmozjs.dylib!JSScope::putProperty(JSContext*, long, int (*)(JSContext*, JSObject*, long, long*), int (*)(JSContext*, JSObject*, long, long*), unsigned int, unsigned int, unsigned int, int) [jsscope.cpp:56b8a3bd290f : 1360 + 0x49]
    eip = 0x0029818d   esp = 0xbfffc1d0   ebp = 0xbfffc278
    Found by: previous frame's frame pointer
 4  libmozjs.dylib!js_DefineNativeProperty [jsobj.cpp:56b8a3bd290f : 4548 + 0x40]
    eip = 0x0023f812   esp = 0xbfffc280   ebp = 0xbfffc318
    Found by: previous frame's frame pointer
 5  libmozjs.dylib!js_DefineNativeProperty [jsobj.cpp:56b8a3bd290f : 4405 + 0x54]
    eip = 0x0023f9db   esp = 0xbfffc320   ebp = 0xbfffc358
    Found by: previous frame's frame pointer
 6  XUL!DefinePropertyIfFound [xpcwrappednativejsops.cpp:56b8a3bd290f : 534 + 0x44]
    eip = 0x01f424b3   esp = 0xbfffc360   ebp = 0xbfffc428
    Found by: previous frame's frame pointer
 7  XUL!XPC_WN_ModsAllowed_Proto_Resolve [xpcwrappednativejsops.cpp:56b8a3bd290f : 1921 + 0x54]
    eip = 0x01f42c89   esp = 0xbfffc430   ebp = 0xbfffc508
    Found by: previous frame's frame pointer
 8  libmozjs.dylib!js_LookupPropertyWithFlags [jsobj.cpp:56b8a3bd290f : 4711 + 0x13]
    eip = 0x0023c096   esp = 0xbfffc510   ebp = 0xbfffc5a8
    Found by: previous frame's frame pointer
 9  libmozjs.dylib!js_GetPropertyHelper [jsobj.cpp:56b8a3bd290f : 5071 + 0x2d]
    eip = 0x0023df77   esp = 0xbfffc5b0   ebp = 0xbfffc628
    Found by: previous frame's frame pointer
10  libmozjs.dylib!js_Interpret [jsops.cpp:56b8a3bd290f : 1521 + 0x40]
    eip = 0x0021cc2a   esp = 0xbfffc630   ebp = 0xbfffc978
    Found by: previous frame's frame pointer
11  libmozjs.dylib!js_Invoke [jsinterp.cpp:56b8a3bd290f : 1378 + 0xa]
    eip = 0x0022d077   esp = 0xbfffc980   ebp = 0xbfffca78
    Found by: previous frame's frame pointer
12  XUL!nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS*, unsigned short, XPTMethodDescriptor const*, nsXPTCMiniVariant*) [xpcwrappedjsclass.cpp:56b8a3bd290f : 1696 + 0x2a]
    eip = 0x01f3611a   esp = 0xbfffca80   ebp = 0xbfffce08
    Found by: previous frame's frame pointer
13  XUL!nsXPCWrappedJS::CallMethod(unsigned short, XPTMethodDescriptor const*, nsXPTCMiniVariant*) [xpcwrappedjs.cpp:56b8a3bd290f : 570 + 0x20]
    eip = 0x01f2f9e3   esp = 0xbfffce10   ebp = 0xbfffce38
    Found by: previous frame's frame pointer
14  XUL!PrepareAndDispatch [xptcstubs_unixish_x86.cpp:56b8a3bd290f : 93 + 0x28]
    eip = 0x02ab19f5   esp = 0xbfffce40   ebp = 0xbfffcef8
    Found by: previous frame's frame pointer
15  XUL!NS_InvokeByIndex_P + 0x3a
    eip = 0x02aadae0   esp = 0xbfffcf00   ebp = 0xbfffcf18
    Found by: previous frame's frame pointer
16  XUL!nsEventListenerManager::HandleEventSubType(nsListenerStruct*, nsIDOMEventListener*, nsIDOMEvent*, nsPIDOMEventTarget*, unsigned int, nsCxPusher*) [nsEventListenerManager.cpp:56b8a3bd290f : 1082 + 0x11]
    eip = 0x023b287a   esp = 0xbfffcf20   ebp = 0xbfffd038
    Found by: previous frame's frame pointer
17  XUL!nsEventListenerManager::HandleEvent(nsPresContext*, nsEvent*, nsIDOMEvent**, nsPIDOMEventTarget*, unsigned int, nsEventStatus*, nsCxPusher*) [nsEventListenerManager.cpp:56b8a3bd290f : 1198 + 0x32]
    eip = 0x023b2f0a   esp = 0xbfffd040   ebp = 0xbfffd0d8
    Found by: previous frame's frame pointer
18  XUL!nsEventTargetChainItem::HandleEventTargetChain(nsEventChainPostVisitor&, unsigned int, nsDispatchingCallback*, int, nsCxPusher*) [nsEventDispatcher.cpp:56b8a3bd290f : 201 + 0x36]
    eip = 0x023cec30   esp = 0xbfffd0e0   ebp = 0xbfffd158
    Found by: previous frame's frame pointer
19  XUL!nsEventDispatcher::Dispatch(nsISupports*, nsPresContext*, nsEvent*, nsIDOMEvent*, nsEventStatus*, nsDispatchingCallback*, nsCOMArray<nsPIDOMEventTarget>*) [nsEventDispatcher.cpp:56b8a3bd290f : 601 + 0x35]
    eip = 0x023cfabf   esp = 0xbfffd160   ebp = 0xbfffd238
    Found by: previous frame's frame pointer
20  XUL!nsEventDispatcher::DispatchDOMEvent(nsISupports*, nsEvent*, nsIDOMEvent*, nsPresContext*, nsEventStatus*) [nsEventDispatcher.cpp:56b8a3bd290f : 664 + 0x33]
    eip = 0x023cfc8f   esp = 0xbfffd240   ebp = 0xbfffd298
    Found by: previous frame's frame pointer
21  XUL!nsDocument::DispatchPageTransition(nsPIDOMEventTarget*, nsAString_internal const&, int) [nsDocument.cpp:56b8a3bd290f : 7154 + 0x29]
    eip = 0x023353ab   esp = 0xbfffd2a0   ebp = 0xbfffd308
    Found by: previous frame's frame pointer
22  XUL!nsDocument::OnPageShow(int, nsIDOMEventTarget*) [nsDocument.cpp:56b8a3bd290f : 7209 + 0x19]
    eip = 0x0233d77e   esp = 0xbfffd310   ebp = 0xbfffd368
    Found by: previous frame's frame pointer
23  XUL!DocumentViewerImpl::LoadComplete(unsigned int) [nsDocumentViewer.cpp:56b8a3bd290f : 1060 + 0x19]
    eip = 0x02147185   esp = 0xbfffd370   ebp = 0xbfffd3e8
    Found by: previous frame's frame pointer
24  XUL!nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, unsigned int) [nsDocShell.cpp:56b8a3bd290f : 5749 + 0xe]
    eip = 0x027e991f   esp = 0xbfffd3f0   ebp = 0xbfffd698
    Found by: previous frame's frame pointer
25  XUL!nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, unsigned int) [nsDocShell.cpp:56b8a3bd290f : 5627 + 0x25]
    eip = 0x027eb184   esp = 0xbfffd6a0   ebp = 0xbfffd718
    Found by: previous frame's frame pointer
26  XUL!nsDocLoader::FireOnStateChange(nsIWebProgress*, nsIRequest*, int, unsigned int) [nsDocLoader.cpp:56b8a3bd290f : 1314 + 0x23]
    eip = 0x027fe511   esp = 0xbfffd720   ebp = 0xbfffd788
    Found by: previous frame's frame pointer
27  XUL!nsDocLoader::DocLoaderIsEmpty(int) [nsDocLoader.cpp:56b8a3bd290f : 926 + 0x21]
    eip = 0x027ffbcb   esp = 0xbfffd790   ebp = 0xbfffd838
    Found by: previous frame's frame pointer
28  XUL!nsDocLoader::OnStopRequest(nsIRequest*, nsISupports*, unsigned int) [nsDocLoader.cpp:56b8a3bd290f : 697 + 0xf]
    eip = 0x027fff6c   esp = 0xbfffd840   ebp = 0xbfffd8a8
    Found by: previous frame's frame pointer
29  XUL!nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, unsigned int) [nsLoadGroup.cpp:56b8a3bd290f : 680 + 0x19]
    eip = 0x01fc3cd0   esp = 0xbfffd8b0   ebp = 0xbfffd908
    Found by: previous frame's frame pointer
30  XUL!nsHttpChannel::OnStopRequest(nsIRequest*, nsISupports*, unsigned int) [nsHttpChannel.cpp:56b8a3bd290f : 5313 + 0x1a]
    eip = 0x020463b1   esp = 0xbfffd910   ebp = 0xbfffd958
    Found by: previous frame's frame pointer
31  XUL!nsInputStreamPump::OnStateStop() [nsInputStreamPump.cpp:56b8a3bd290f : 576 + 0x19]
    eip = 0x01fbe680   esp = 0xbfffd960   ebp = 0xbfffd978
    Found by: previous frame's frame pointer
32  XUL!nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream*) [nsInputStreamPump.cpp:56b8a3bd290f : 401 + 0x7]
    eip = 0x01fbece8   esp = 0xbfffd980   ebp = 0xbfffd9c8
    Found by: previous frame's frame pointer
33  XUL!nsInputStreamReadyEvent::Run() [nsStreamUtils.cpp:56b8a3bd290f : 112 + 0xb]
    eip = 0x02a80454   esp = 0xbfffd9d0   ebp = 0xbfffd9e8
    Found by: previous frame's frame pointer
34  XUL!nsThread::ProcessNextEvent(int, int*) [nsThread.cpp:56b8a3bd290f : 527 + 0x7]
    eip = 0x02a9da0c   esp = 0xbfffd9f0   ebp = 0xbfffda38
    Found by: previous frame's frame pointer
35  XUL!NS_ProcessPendingEvents_P(nsIThread*, unsigned int) [nsThreadUtils.cpp : 200 + 0x16]
    eip = 0x02a5e207   esp = 0xbfffda40   ebp = 0xbfffda88
    Found by: previous frame's frame pointer
36  XUL!nsBaseAppShell::NativeEventCallback() [nsBaseAppShell.cpp:56b8a3bd290f : 125 + 0x1a]
    eip = 0x02a0cf52   esp = 0xbfffda90   ebp = 0xbfffdab8
    Found by: previous frame's frame pointer
37  XUL!nsAppShell::ProcessGeckoEvents(void*) [nsAppShell.mm:56b8a3bd290f : 510 + 0x7]
    eip = 0x029d26c8   esp = 0xbfffdac0   ebp = 0xbfffdb98
    Found by: previous frame's frame pointer
}

Looks like bug 538307 & bug 538184, just in a different test.
cjones reported an earlier instance of this failure in Bug 538184 #4:
> http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1262885371.1262885802.29602.gz&fulltext=1
> s: moz2-darwin9-slave19
> 
> 395 INFO Running /tests/dom/src/threads/test/test_errorPropagation.html...
> TEST-UNEXPECTED-FAIL | automation.py | Exited with code 1 during test run
> INFO | automation.py | Application ran for: 0:02:15.835922
> INFO | automation.py | Reading PID log:
> /var/folders/TL/TLg3RrMbFAur2hBCXvCeqk+++TM/-Tmp-/tmpbrp7G8pidlog
> TEST-UNEXPECTED-FAIL | automation.py | application crashed (minidump found)

FWIW, the metatata from that log is:
OS X 10.5.2 mozilla-central test mochitests-2/5 on 2010/01/07 09:29:31
Depends on: 538307
Got the same crash when restarting Minefield after yesterdays update. It crashed right after the start: bp-4a8f5621-f66d-4a02-84ad-408a72100315.

Daniel, please always add the complete signature to the summary so that the bug will show up on crash-stats. Updating summary.
Severity: normal → critical
Keywords: crash
Summary: Crash during test_errorPropagation.html [@JSScope::newDictionaryProperty] → Crash during test_errorPropagation.html [@ JSScope::newDictionaryProperty(JSContext*, JSScopeProperty const&, JSScopeProperty**)]
Crash Signature: [@ JSScope::newDictionaryProperty(JSContext*, JSScopeProperty const&, JSScopeProperty**)]
Mass marking whiteboard:[orange] bugs WFM (to clean up TBPL bug suggestions) that:
* Haven't changed in > 6months
* Whose whiteboard contains none of the strings: {disabled,marked,random,fuzzy,todo,fails,failing,annotated,leave open,time-bomb}
* Passed a (quick) manual inspection of bug summary/whiteboard to ensure they weren't a false positive.

I've also gone through and searched for cases where the whiteboard wasn't labelled correctly after test disabling, by using attachment description & basic comment searches. However if the test for which this bug was about has in fact been disabled/annotated/..., please accept my apologies & reopen/mark the whiteboard appropriately so this doesn't get re-closed in the future (and please ping me via IRC or email so I can try to tweak the saved searches to avoid more edge cases).

Sorry for the spam! Filter on: #FFA500
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → WORKSFORME
Whiteboard: [orange]
You need to log in before you can comment on or make changes to this bug.