Closed Bug 768833 Opened 12 years ago Closed 12 years ago

Intermittent crash during jsreftest.html?test=js1_5/Regress/regress-280769-3.js [@ JSC::Yarr::YarrGenerator::matchCharacterClassRange]

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Version:
15 Branch
Platform:
x86_64
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED INVALID

People

(Reporter: emorley, Unassigned)

References

Details

(Keywords: crash, intermittent-failure, Whiteboard: [js:t])

Crash Data

Rev4 MacOSX Snow Leopard 10.6 mozilla-aurora opt test jsreftest on 2012-06-26 20:21:51 PDT for push d2329f2b08da

slave: talos-r4-snow-041

https://tbpl.mozilla.org/php/getParsedLog.php?id=13022680&tree=Mozilla-Aurora

{
REFTEST TEST-START | file:///Users/cltbld/talos-slave/test/build/jsreftest/tests/jsreftest.html?test=js1_5/Regress/regress-280769-3.js | 1962 / 3409 (57%)
BUGNUMBER: 280769
STATUS: Do not crash on overflow of 64K boundary in number of classes in regexp
TEST-UNEXPECTED-FAIL | file:///Users/cltbld/talos-slave/test/build/jsreftest/tests/jsreftest.html?test=js1_5/Regress/regress-280769-3.js | Exited with code 1 during test run
INFO | automation.py | Application ran for: 0:02:44.808895
INFO | automation.py | Reading PID log: /var/folders/Hs/HsDn6a9SG8idoIya6p9mtE+++TI/-Tmp-/tmp1o5mXTpidlog
Downloading symbols from: http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-aurora-macosx64/1340762862/firefox-15.0a2.en-US.mac.crashreporter-symbols.zip
PROCESS-CRASH | file:///Users/cltbld/talos-slave/test/build/jsreftest/tests/jsreftest.html?test=js1_5/Regress/regress-280769-3.js | application crashed (minidump found)
Crash dump filename: /var/folders/Hs/HsDn6a9SG8idoIya6p9mtE+++TI/-Tmp-/tmpicGrIj/minidumps/5BB1EDF1-020A-4BB3-9498-87046526F6D7.dmp
Operating system: Mac OS X
                  10.6.8 10K549
CPU: amd64
     family 6 model 23 stepping 10
     2 CPUs

Crash reason:  EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
Crash address: 0x34f09588

Thread 0 (crashed)
 0  XUL!JSC::Yarr::YarrGenerator::matchCharacterClassRange [YarrJIT.cpp : 138 + 0x6]
    rbx = 0x5fbfb560   r12 = 0x00000004   r13 = 0xffffffc0   r14 = 0x32304e08
    r15 = 0x00000000   rip = 0x026ac532   rsp = 0x5fbfb050   rbp = 0x5fbfb1bc
    Found by: given as instruction pointer in context
 1  XUL!JSC::Yarr::YarrGenerator::matchCharacterClass [YarrJIT.cpp : 216 + 0x37]
    rbx = 0x5fbfb148   r12 = 0x34f09550   r13 = 0x5fbfb340   r14 = 0xffffffff
    r15 = 0x00000000   rip = 0x026ad091   rsp = 0x5fbfb0f0   rbp = 0x5fbfb560
    Found by: call frame info
 2  XUL!JSC::Yarr::YarrGenerator::generateTerm [YarrJIT.cpp : 879 + 0x10]
    rbx = 0x56843960   r12 = 0x62f2b648   r13 = 0x5fbfb340   r14 = 0x5fbfbab0
    r15 = 0x0000c133   rip = 0x026af441   rsp = 0x5fbfb200   rbp = 0x5fbfb560
    Found by: call frame info
 3  XUL!JSC::Yarr::YarrGenerator::generate [YarrJIT.cpp : 1169 + 0xa]
    rbx = 0x257d22b0   r12 = 0x62f2b648   r13 = 0x5fbfbc00   r14 = 0x5fbfbab0
    r15 = 0x0000c133   rip = 0x026b2d33   rsp = 0x5fbfb450   rbp = 0x5fbfb560
    Found by: call frame info
 4  XUL!JSC::Yarr::jitCompile [YarrJIT.cpp : 2422 + 0x7]
    rbx = 0x24a956a8   r12 = 0x5fbfb560   r13 = 0x5fbfbc00   r14 = 0x5fbfbab0
    r15 = 0x5fbfbad8   rip = 0x026a8ac8   rsp = 0x5fbfb4f0   rbp = 0x24a95680
    Found by: call frame info
 5  XUL!js::detail::RegExpCode::compile [RegExpObject.cpp : 195 + 0x12]
    rbx = 0x24a956a8   r12 = 0x00331890   r13 = 0x00000000   r14 = 0x00000000
    r15 = 0x00000000   rip = 0x025bcdb0   rsp = 0x5fbfbb50   rbp = 0x24a95680
    Found by: call frame info
 6  XUL!js::RegExpShared::compile [RegExpObject.cpp : 446 + 0xb]
    rbx = 0x0a6b0140   r12 = 0x00331890   r13 = 0x00000000   r14 = 0x00000000
    r15 = 0x00000000   rip = 0x025bdc36   rsp = 0x5fbfbc40   rbp = 0x24a95680
    Found by: call frame info
 7  XUL!js::RegExpCompartment::get [RegExpObject.cpp : 567 + 0x12]
    rbx = 0x0a6b0140   r12 = 0x261f6430   r13 = 0x00000000   r14 = 0x00000000
    r15 = 0x00000000   rip = 0x025bf8bc   rsp = 0x5fbfbcd0   rbp = 0xfbf564e8
    Found by: call frame info
 8  XUL!js::RegExpObject::createShared [RegExpObject.cpp : 591 + 0x1f]
    rbx = 0x5bf7cca0   r12 = 0x5fbfbe70   r13 = 0x00331890   r14 = 0x025c21f0
    r15 = 0xffffffff   rip = 0x025be429   rsp = 0x5fbfbd90   rbp = 0x00331890
    Found by: call frame info
 9  XUL!ExecuteRegExp [RegExpObject-inl.h : 50 + 0x12]
    rbx = 0x00000001   r12 = 0x5bf7cca0   r13 = 0x00331890   r14 = 0x025c21f0
    r15 = 0xffffffff   rip = 0x025c1e13   rsp = 0x5fbfbdc0   rbp = 0x06b000b0
}
Whiteboard: [orange] → [js:t][orange]
This bug was observed only on one or more of the six machines listed in
bug 787281 comment 11, which seem likely to have bad memory, disk, or
other hardware problem, based on the rate of failures on those machines
and the types of failures observed.

Therefore I'm marking this bug invalid, though it should be reopened if
it occurs on other (more reliable) hardware.
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → INVALID
Whiteboard: [js:t][orange] → [js:t]
You need to log in before you can comment on or make changes to this bug.