787893 - crash in js::types::TypeSet::hasType mainly with ARMv6 devices

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Scoobidiver (away)]

It's #17 top crasher in 17.0a2 and #29 in 18.0a1.

It first appeared in 17.0a1/20120816. The regression range might be (discontinuous across builds):
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=86ee4deea55b&tochange=50e4ff05741e

Signature 	js::types::TypeSet::hasType More Reports Search
UUID	0693db6a-3bab-4b26-8105-96f0a2120903
Date Processed	2012-09-03 06:41:41
Uptime	2544
Install Age	1.2 hours since version was first installed.
Install Time	2012-09-03 05:27:39
Product	FennecAndroid
Version	18.0a1
Build ID	20120902030516
Release Channel	nightly
OS	Linux
OS Version	0.0.0 Linux 2.6.35.10-g696f19b #1 PREEMPT Tue Apr 10 18:15:52 CST 2012 armv6l
Build Architecture	arm
Build Architecture Info	
Crash Reason	SIGSEGV
Crash Address	0xfffffffe
App Notes 	
AdapterDescription: 'Qualcomm -- Adreno (TM) 200 -- OpenGL ES 2.0 1566933 -- Model: HTC Wildfire S A510e, Product: htc_marvel, Manufacturer: HTC, Hardware: marvel'
EGL? EGL+ GL Context? GL Context+ GL Layers? GL Layers+ 
nothumb Build
HTC HTC Wildfire S A510e
htc_europe/htc_marvel/marvel:2.3.5/GRJ90/362953.3:user/release-keys
EMCheckCompatibility	True
Adapter Vendor ID	Qualcomm
Adapter Device ID	Adreno (TM) 200

Frame 	Module 	Signature 	Source
0 		@0xfffffffe 	
1 	libxul.so 	js::types::TypeSet::hasType 	jsinferinlines.h:1168
2 		@0x57d3affe 	
3 	libxul.so 	js::mjit::JaegerShot 	MethodJIT.cpp:1016
4 	libxul.so 	js::Interpret 	jsinterp.cpp:2438
5 	libxul.so 	UncachedInlineCall 	InvokeHelpers.cpp:327
6 	libxul.so 	js::mjit::stubs::UncachedCallHelper 	InvokeHelpers.cpp:410
7 	libxul.so 	js::mjit::CallCompiler::update 	MonoIC.cpp:931
8 	libxul.so 	js::mjit::ic::Call 	MonoIC.cpp:993
9 	libxul.so 	libxul.so@0x15152fa 	
10 	libxul.so 	js::mjit::ic::New 	MonoIC.cpp:1001
11 		@0x5795b84e 	
12 	libxul.so 	js::mjit::JaegerShot 	MethodJIT.cpp:1016
13 	libxul.so 	js::Interpret 	jsinterp.cpp:2438 
...

More reports at:
https://crash-stats.mozilla.com/report/list?product=FennecAndroid&signature=js%3A%3Atypes%3A%3ATypeSet%3A%3AhasType

Comment 1

[Robert Kaiser]

This is the #3 ARMv6 crash in 17.0b1, see https://crash-analysis.mozilla.com/rkaiser/2012-10-16/2012-10-16.fennecandroid.17.0b1.armv6.topcrash.html

Comment 2

[Alex Keybl [:akeybl]]

Let's take a look at this in preparation for the possible ARMv6 launch in the next month.

Comment 3

[Alex Keybl [:akeybl]]

(naveed/dvander - do you have a suggested assignee?)

Comment 4

[David Anderson [:dvander] - inactive, e-mail if emergency]

This would be fixed by bug 793740 which disables TI on ARMv6. I can just land that on the beta branch, which apparently I totally forgot to do.

Comment 5

[David Anderson [:dvander] - inactive, e-mail if emergency]

Okay, that has been landed.

Comment 6

[Lukas Blakk [:lsblakk] use ?needinfo]

Updating status flags, getting confirmation in the next week or so that we're not seeing this signature (after Beta 3 goes out with the fix in bug 793740) would be great.

Comment 7

[Alex Keybl [:akeybl]]

(In reply to David Anderson [:dvander] from comment #4)
> This would be fixed by bug 793740 which disables TI on ARMv6. I can just
> land that on the beta branch, which apparently I totally forgot to do.

Are you suggesting that we're seeing these crashes when running ARMv6 builds on ARMv7?

Comment 8

[David Anderson [:dvander] - inactive, e-mail if emergency]

(In reply to Alex Keybl [:akeybl] from comment #7)
> (In reply to David Anderson [:dvander] from comment #4)
> > This would be fixed by bug 793740 which disables TI on ARMv6. I can just
> > land that on the beta branch, which apparently I totally forgot to do.
> 
> Are you suggesting that we're seeing these crashes when running ARMv6 builds
> on ARMv7?

I'm not sure if that's the case, but it wouldn't be surprising. Does it affect any decisions?

If I'm reading crash-stats right, the vast majority of crashes were on the 20121017143933 build, and the only build with crashes after that is the 20121023 one, and there are only a handful and they are ARMv7. Safe to mark this FIXED?

Comment 9

[Scoobidiver (away)]

It was #14 top crasher in 17.0b2 and is only #104 in 17.0b3 and #135 in 18.0a2 after the patch of bug 793740 landed.