Closed Bug 809322 Opened 12 years ago Closed 11 years ago

Intermittent crash [@ js::gc::MarkValueRootRange] in test_media_queries.html, test_parse_rule.html, test_bug57600.html, test_bug582412-1.html, test_HTMLDocument05.html, test_input_number_value.html, test_sessionStorageReplace.html, test_meter_element.html

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
ARM
Android
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME
Tracking Flags:
Tracking Status
firefox18 --- unaffected
firefox19 --- affected

People

(Reporter: philor, Unassigned)

References

Details

(Keywords: crash, intermittent-failure)

Crash Data

https://tbpl.mozilla.org/php/getParsedLog.php?id=16803700&tree=Mozilla-Inbound
Android Armv6 Tegra 250 mozilla-inbound opt test mochitest-8 on 2012-11-06 16:35:23 PST for push 11ff92705a23
slave: tegra-254

35164 INFO TEST-PASS | /tests/layout/style/test/test_media_queries.html | Media query 'not all and (max--moz-device-pixel-ratio: 1)' should NOT apply after cloning
INFO | automation.py | Application ran for: 0:07:37.749675
INFO | automation.py | Reading PID log: /tmp/tmpNu_fW5pidlog
getting files in '/mnt/sdcard/tests/profile/minidumps/'
Downloading symbols from: http://ftp.mozilla.org/pub/mozilla.org/mobile/tinderbox-builds/mozilla-inbound-android-armv6/1352244211/fennec-19.0a1.en-US.android-arm-armv6.crashreporter-symbols.zip
PROCESS-CRASH | /tests/layout/style/test/test_media_queries.html | application crashed (minidump found)
Crash dump filename: /tmp/tmprRqW5r/3a36def3-ecce-12cb-62384a09-3a5fab40.dmp
Operating system: Android
                  0.0.0 Linux 2.6.32.9-00002-gd8084dc-dirty #1 SMP PREEMPT Wed Feb 2 11:32:06 PST 2011 armv7l nvidia/harmony/harmony/harmony:2.2/FRF91/20110202.102810:eng/test-keys
CPU: arm
     0 CPUs

Crash reason:  SIGSEGV
Crash address: 0x4

Thread 4 (crashed)
 0  libxul.so!js::gc::MarkValueRootRange(JSTracer*, unsigned int, JS::Value*, char const*) [Marking.cpp : 443 + 0x8]
     r4 = 0x50331108    r5 = 0x0000011e    r6 = 0x00000000    r7 = 0x00000000
     r8 = 0x00000000    r9 = 0xffffff87   r10 = 0x5470f4a4    fp = 0x4e00cc04
     sp = 0x4e00cbf8    lr = 0x541aa55c    pc = 0x54357748
    Found by: given as instruction pointer in context
 1  libxul.so!JS::AutoGCRooter::traceAll(JSTracer*) [jsgc.cpp : 2385 + 0x12]
     r4 = 0x4e00cf4c    r5 = 0x50331108    r6 = 0x50331000    r7 = 0x58db2b18
     r8 = 0x50331108    r9 = 0x5470f194   r10 = 0x58db2b18    fp = 0x5470f1a4
     sp = 0x4e00cc30    pc = 0x541aa55c
    Found by: call frame info
 2  libxul.so!IncrementalCollectSlice [jsgc.cpp : 2435 + 0x6]
     r4 = 0x50331000    r5 = 0x58db2b18    r6 = 0x50331000    r7 = 0x58db2b18
     r8 = 0x50331108    r9 = 0x58db2b18   r10 = 0x58db2b18    fp = 0x503311d8
     sp = 0x4e00cc68    pc = 0x541b1108
    Found by: call frame info
 3  libxul.so!GCCycle [jsgc.cpp : 4452 + 0x1e]
     r4 = 0x50331000    r5 = 0x5470f514    r6 = 0x00000000    r7 = 0x503319b8
     r8 = 0x00000000    r9 = 0x00000000   r10 = 0x503311d8    fp = 0x50331000
     sp = 0x4e00ce28    pc = 0x541b6168
    Found by: call frame info
 4  libxul.so!js::GC(JSRuntime*, js::JSGCInvocationKind, js::gcreason::Reason) [jsgc.cpp : 4566 + 0x1a]
     r4 = 0x50331000    r5 = 0x503311d8    r6 = 0x00000004    r7 = 0x00000000
     r8 = 0x00000000    r9 = 0x5489d2f0   r10 = 0x00000002    fp = 0x50331000
     sp = 0x4e00ce58    pc = 0x541b6734
    Found by: call frame info
 5  libxul.so!js::gc::ArenaLists::refillFreeList(JSContext*, js::gc::AllocKind) [jsgc.cpp : 1733 + 0x2]
     r4 = 0x50395c00    r5 = 0x00000003    r6 = 0x5489d2f0    r7 = 0x50331000
     r8 = 0x00000020    r9 = 0x5489d2f0   r10 = 0x548e7818    fp = 0x50331000
     sp = 0x4e00ce80    pc = 0x541b6c1c
    Found by: call frame info
 6  libxul.so!JSObject::createDenseArray(JSContext*, js::gc::AllocKind, JS::Handle<js::Shape*>, JS::Handle<js::types::TypeObject*>, unsigned int) [jsgcinlines.h : 457 + 0x12]
     r4 = 0x54cd0700    r5 = 0x00001000    r6 = 0x50395c24    r7 = 0x00000000
     r8 = 0x00000020    r9 = 0x5489d2f0   r10 = 0x548e7818    fp = 0x50331000
     sp = 0x4e00cec8    pc = 0x541532cc
    Found by: call frame info
 7  libxul.so!js::NewDenseCopiedArray(JSContext*, unsigned int, JS::Value const*, JSObject*) [jsarray.cpp : 3664 + 0x6]
     r4 = 0x0000011e    r5 = 0x00000000    r6 = 0x0000000e    r7 = 0x54cd0700
     r8 = 0x5489d2f0    r9 = 0x5489d2f0   r10 = 0x548e7818    fp = 0x50331000
     sp = 0x4e00cee8    pc = 0x54157d48
    Found by: call frame info
 8  libxul.so!JS_NewArrayObject(JSContext*, int, JS::Value*) [jsapi.cpp : 4710 + 0x2]
     r4 = 0x00000000    r5 = 0x0000011e    r6 = 0x54cd0700    r7 = 0x4e00d340
     r8 = 0x4e00d310    r9 = 0x5489d2f0   r10 = 0x0000011e    fp = 0x4e00d070
     sp = 0x4e00cf48    pc = 0x54145054
    Found by: call frame info
 9  libxul.so!XPCConvert::NativeArray2JS(XPCLazyCallContext&, JS::Value*, void const**, nsXPTType const&, nsID const*, unsigned int, tag_nsresult*) [XPCConvert.cpp : 1415 + 0xe]
     r4 = 0x4e00d348    r5 = 0x4e00d3a0    r6 = 0x54cd0700    r7 = 0x4e00d340
     r8 = 0x4e00d310    r9 = 0x5489d2f0   r10 = 0x0000011e    fp = 0x4e00d070
     sp = 0x4e00cf70    pc = 0x538c7134
    Found by: call frame info
10  libxul.so!XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) [XPCWrappedNative.cpp : 2638 + 0x2]
     r4 = 0x00000000    r5 = 0x00000001    r6 = 0x4e00d178    r7 = 0x4e00d338
     r8 = 0x4e00d310    r9 = 0x00000008   r10 = 0x5489d2f0    fp = 0x0000011e
     sp = 0x4e00d000    pc = 0x538e13a8
    Found by: call frame info
11  libxul.so!XPC_WN_CallMethod(JSContext*, unsigned int, JS::Value*) [XPCWrappedNativeJSOps.cpp : 1488 + 0xa]
     r4 = 0x54cd0700    r5 = 0x4e00d3a0    r6 = 0x505002f0    r7 = 0x5b61e9a0
     r8 = 0x00000001    r9 = 0x4e00d784   r10 = 0x00000001    fp = 0x4e00d75c
     sp = 0x4e00d380    pc = 0x538e8dc8
    Found by: call frame info
12  libxul.so!js::InvokeKernel [jscntxtinlines.h : 364 + 0xa]
     r4 = 0x4e00d438    r5 = 0x00000000    r6 = 0x54cd0700    r7 = 0x5b61e9a0
     r8 = 0x00000000    r9 = 0x4e00d784   r10 = 0x4e00d764    fp = 0x4e00d75c
     sp = 0x4e00d428    pc = 0x541de428
    Found by: call frame info
13  libxul.so!js::Interpret(JSContext*, js::StackFrame*, js::InterpMode) [jsinterp.cpp : 2324 + 0x12]
     r4 = 0x54cd0700    r5 = 0x50500300    r6 = 0x548e8bc4    r7 = 0x00001cdc
     r8 = 0x4e00d8d0    r9 = 0x4e00d784   r10 = 0x4e00d764    fp = 0x4e00d75c
     sp = 0x4e00d4c0    pc = 0x541da07c
    Found by: call frame info
14  libxul.so!js::RunScript(JSContext*, JS::Handle<JSScript*>, js::StackFrame*) [jsinterp.cpp : 324 + 0xe]
     r4 = 0x54cd0700    r5 = 0x50500040    r6 = 0x4e00d99c    r7 = 0x00000000
     r8 = 0x4e00da08    r9 = 0x50500018   r10 = 0x54cd0764    fp = 0xffffff86
     sp = 0x4e00d990    pc = 0x541dd9d8
    Found by: call frame info
15  libxul.so!js::Invoke [jsinterp.cpp : 379 + 0x2]
     r4 = 0x50c751a0    r5 = 0x4e00d9d4    r6 = 0x54cd0700    r7 = 0x00000001
     r8 = 0x4e00da08    r9 = 0x50500018   r10 = 0x54cd0764    fp = 0xffffff86
     sp = 0x4e00d9c0    pc = 0x541df61c
    Found by: call frame info
16  libxul.so!js::BaseProxyHandler::call(JSContext*, JSObject*, unsigned int, JS::Value*) [jsproxy.cpp : 266 + 0x12]
     r4 = 0x50500010    r5 = 0x4e00da88    r6 = 0x5624e010    r7 = 0x00000001
     r8 = 0x54cd0700    r9 = 0x550c2c00   r10 = 0x00000000    fp = 0xffffff86
     sp = 0x4e00da70    pc = 0x542253d4
    Found by: call frame info
17  libxul.so!js::Wrapper::call(JSContext*, JSObject*, unsigned int, JS::Value*) [jswrapper.cpp : 294 + 0x2a]
     r4 = 0x5495ada0    r5 = 0x00000001    r6 = 0x5624e010    r7 = 0x54cd0700
     r8 = 0x50500010    r9 = 0x550c2c00   r10 = 0x00000001    fp = 0x5495ada0
     sp = 0x4e00dab0    pc = 0x5429d390
    Found by: call frame info
18  libxul.so!js::CrossCompartmentWrapper::call(JSContext*, JSObject*, unsigned int, JS::Value*) [jswrapper.cpp : 626 + 0x16]
     r4 = 0x54cd0700    r5 = 0x50500010    r6 = 0x5624e010    r7 = 0x50500028
     r8 = 0x00000001    r9 = 0x550c2c00   r10 = 0x00000001    fp = 0x5495ada0
     sp = 0x4e00dad8    pc = 0x5429fc2c
    Found by: call frame info
19  libxul.so!proxy_Call [jsproxy.cpp : 2461 + 0x16]
     r4 = 0x54cd0700    r5 = 0x50500020    r6 = 0x54cd0700    r7 = 0x00000001
     r8 = 0x4e00db68    r9 = 0x4e00dbe0   r10 = 0x54cd0764    fp = 0x4e00e028
     sp = 0x4e00db08    pc = 0x542286b8
    Found by: call frame info
20  libxul.so!js::Invoke [jscntxtinlines.h : 364 + 0xa]
     r4 = 0x5624e010    r5 = 0x50500020    r6 = 0x54cd0700    r7 = 0x00000001
     r8 = 0x4e00db68    r9 = 0x4e00dbe0   r10 = 0x54cd0764    fp = 0x4e00e028
     sp = 0x4e00db20    pc = 0x541df698
    Found by: call frame info
21  libxul.so!JS_CallFunctionValue(JSContext*, JSObject*, JS::Value, unsigned int, JS::Value*, JS::Value*) [jsapi.cpp : 5781 + 0x22]
     r4 = 0x54cd0700    r5 = 0x550f65e0    r6 = 0x502f5d40    r7 = 0x4e00de30
     r8 = 0x00000001    r9 = 0x80004005   r10 = 0x00102048    fp = 0x4e00e028
     sp = 0x4e00dbd0    pc = 0x5414abe4
    Found by: call frame info
22  libxul.so!nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS*, unsigned short, XPTMethodDescriptor const*, nsXPTCMiniVariant*) [XPCWrappedJSClass.cpp : 1420 + 0x22]
     r4 = 0x54cd0700    r5 = 0x550f65e0    r6 = 0x502f5d40    r7 = 0x4e00de30
     r8 = 0x00000001    r9 = 0x80004005   r10 = 0x00102048    fp = 0x4e00e028
     sp = 0x4e00dbf8    pc = 0x538dcb5c
    Found by: call frame info
23  libxul.so!nsXPCWrappedJS::CallMethod(unsigned short, XPTMethodDescriptor const*, nsXPTCMiniVariant*) [XPCWrappedJS.cpp : 580 + 0x1e]
     r4 = 0x56172340    r5 = 0x502f5d40    r6 = 0x4e00e028    r7 = 0x00000003
     r8 = 0x00000008    r9 = 0x00000003   r10 = 0x5617eb40    fp = 0x4e00e028
     sp = 0x4e00dff8    pc = 0x538d84ac
    Found by: call frame info
24  libxul.so!PrepareAndDispatch [xptcstubs_arm.cpp : 105 + 0x1a]
     r4 = 0x4e00e028    r5 = 0x00000008    r6 = 0x4e00e0e4    r7 = 0x4e00e0ac
     r8 = 0x00000008    r9 = 0x00000003   r10 = 0x5617eb40    fp = 0x4e00e028
     sp = 0x4e00e028    pc = 0x53dbcb3c
    Found by: call frame info
25  libxul.so + 0x1019226
     r4 = 0x5617eb40    r5 = 0x59ec7a60    r6 = 0x00000000    r7 = 0x4e00e220
     r8 = 0x56d54ec0    r9 = 0x00000004   r10 = 0x4e00e230    fp = 0x00000001
     sp = 0x4e00e0e0    pc = 0x53dbc228
    Found by: call frame info
26  libxul.so!nsEventListenerManager::HandleEventSubType(nsListenerStruct*, nsIDOMEventListener*, nsIDOMEvent*, nsIDOMEventTarget*, unsigned int, nsCxPusher*) [nsEventListenerManager.cpp : 872 + 0xa]
     r4 = 0x5617eb40    r5 = 0x59ec7a60    r6 = 0x00000000    r7 = 0x4e00e220
     r8 = 0x56d54ec0    r9 = 0x00000004   r10 = 0x4e00e230    fp = 0x00000001
     sp = 0x4e00e0f0    pc = 0x53466198
    Found by: call frame info
27  libxul.so!nsEventListenerManager::HandleEventInternal(nsPresContext*, nsEvent*, nsIDOMEvent**, nsIDOMEventTarget*, unsigned int, nsEventStatus*, nsCxPusher*) [nsEventListenerManager.cpp : 945 + 0x16]
     r4 = 0x56ebd240    r5 = 0x56785d28    r6 = 0x5614c6a0    r7 = 0x4e00e220
     r8 = 0x56d54ec0    r9 = 0x00000004   r10 = 0x4e00e230    fp = 0x00000001
     sp = 0x4e00e100    pc = 0x534663a4
    Found by: call frame info
28  libxul.so!nsEventTargetChainItem::HandleEvent(nsEventChainPostVisitor&, unsigned int, bool, nsCxPusher*) [nsEventListenerManager.h : 153 + 0x1e]
     r4 = 0x00000a8d    r5 = 0x4e00e224    r6 = 0x00000004    r7 = 0x00000000
     r8 = 0x00000006    r9 = 0x00001628   r10 = 0x00000000    fp = 0x00000000
     sp = 0x4e00e168    pc = 0x5348242c
    Found by: call frame info
29  libxul.so!nsEventTargetChainItem::HandleEventTargetChain(nsEventChainPostVisitor&, unsigned int, nsDispatchingCallback*, bool, nsCxPusher*) [nsEventDispatcher.cpp : 286 + 0x12]
     r4 = 0x4e00e218    r5 = 0x5763ec10    r6 = 0x5489d2f0    r7 = 0x4e00e230
     r8 = 0x00000006    r9 = 0x00001628   r10 = 0x00000000    fp = 0x00000000
     sp = 0x4e00e190    pc = 0x53482518
    Found by: call frame info
30  libxul.so!nsEventDispatcher::Dispatch(nsISupports*, nsPresContext*, nsEvent*, nsIDOMEvent*, nsEventStatus*, nsDispatchingCallback*, nsCOMArray<nsIDOMEventTarget>*) [nsEventDispatcher.cpp : 634 + 0x16]
     r4 = 0x56ebd240    r5 = 0x00000000    r6 = 0x00000000    r7 = 0x5763ec70
     r8 = 0x4e00e230    r9 = 0x549036c0   r10 = 0x5673c140    fp = 0x00000000
     sp = 0x4e00e1d8    pc = 0x53482ef0
    Found by: call frame info
31  libxul.so!nsEventDispatcher::DispatchDOMEvent(nsISupports*, nsEvent*, nsIDOMEvent*, nsPresContext*, nsEventStatus*) [nsEventDispatcher.cpp : 694 + 0x16]
     r4 = 0x59ec7a60    r5 = 0x00000000    r6 = 0x56ebd240    r7 = 0x00000000
     r8 = 0x00000000    r9 = 0x4e00e2fc   r10 = 0x4e5e6ae8    fp = 0x4e5e6ae8
     sp = 0x4e00e270    pc = 0x53483218
    Found by: call frame info
32  libxul.so!nsDocument::DispatchPageTransition(nsIDOMEventTarget*, nsAString_internal const&, bool) [nsDocument.cpp : 7009 + 0x16]
     r4 = 0x00000001    r5 = 0x5964d400    r6 = 0x00000000    r7 = 0x4e00e2b4
     r8 = 0x00000000    r9 = 0x4e00e2fc   r10 = 0x53522970    fp = 0x4e5e6ae8
     sp = 0x4e00e2a8    pc = 0x533be80c
    Found by: call frame info
33  libxul.so!nsDocument::OnPageShow(bool, nsIDOMEventTarget*) [nsDocument.cpp : 7068 + 0x2]
     r4 = 0x5964d400    r5 = 0x4e00e2fc    r6 = 0x4e00e2f7    r7 = 0x00000001
     r8 = 0x00000001    r9 = 0x56fdb434   r10 = 0x00000000    fp = 0x58536aac
     sp = 0x4e00e2f0    pc = 0x533bec38
    Found by: call frame info
34  libxul.so!DocumentViewerImpl::LoadComplete(tag_nsresult) [nsDocumentViewer.cpp : 1052 + 0x12]
     r4 = 0x4ff61350    r5 = 0x57b91e80    r6 = 0x4e5e6a90    r7 = 0x56fdb580
     r8 = 0x00000001    r9 = 0x56fdb434   r10 = 0x00000000    fp = 0x58536aac
     sp = 0x4e00e340    pc = 0x531f0ab0
    Found by: call frame info
35  libxul.so!nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, tag_nsresult) [nsDocShell.cpp : 6510 + 0x12]
     r4 = 0x56fdb400    r5 = 0x00000000    r6 = 0x58536aac    r7 = 0x56fdb580
     r8 = 0x00000001    r9 = 0x56fdb434   r10 = 0x00000000    fp = 0x58536aac
     sp = 0x4e00e3a0    pc = 0x53963ccc
    Found by: call frame info
36  libxul.so!nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, tag_nsresult) [nsDocShell.cpp : 6338 + 0x1a]
     r4 = 0x56fdb400    r5 = 0x56fdb414    r6 = 0x58536aac    r7 = 0x4e00e5f4
     r8 = 0x00000000    r9 = 0x56fdb434   r10 = 0xfffdffef    fp = 0x58536aac
     sp = 0x4e00e590    pc = 0x5395f97c
    Found by: call frame info
37  libxul.so!nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, tag_nsresult) [nsDocLoader.cpp : 1351 + 0x16]
     r4 = 0x00000000    r5 = 0x54e77320    r6 = 0x4e00e6cc    r7 = 0x5489d2f0
     r8 = 0x56fdb414    r9 = 0x56fdb434   r10 = 0x56fdb400    fp = 0x58536aac
     sp = 0x4e00e640    pc = 0x5396cc5c
    Found by: call frame info

(and on and on, 91 frames deep, well back into Java without useful detail)
Severity: normal → critical
Crash Signature: [@ js::gc::MarkValueRootRange]
https://tbpl.mozilla.org/php/getParsedLog.php?id=16834403&tree=Mozilla-Inbound
Summary: Intermittent crash [@ js::gc::MarkValueRootRange] in test_media_queries.html → Intermittent crash [@ js::gc::MarkValueRootRange] in test_media_queries.html, test_parse_rule.html
https://tbpl.mozilla.org/php/getParsedLog.php?id=16809068&tree=Services-Central
Summary: Intermittent crash [@ js::gc::MarkValueRootRange] in test_media_queries.html, test_parse_rule.html → Intermittent crash [@ js::gc::MarkValueRootRange] in test_media_queries.html, test_parse_rule.html, test_bug57600.html
https://tbpl.mozilla.org/php/getParsedLog.php?id=16879200&tree=Firefox
Summary: Intermittent crash [@ js::gc::MarkValueRootRange] in test_media_queries.html, test_parse_rule.html, test_bug57600.html → Intermittent crash [@ js::gc::MarkValueRootRange] in test_media_queries.html, test_parse_rule.html, test_bug57600.html, test_bug582412-1.html
https://tbpl.mozilla.org/php/getParsedLog.php?id=16896093&tree=Mozilla-Inbound
Summary: Intermittent crash [@ js::gc::MarkValueRootRange] in test_media_queries.html, test_parse_rule.html, test_bug57600.html, test_bug582412-1.html → Intermittent crash [@ js::gc::MarkValueRootRange] in test_media_queries.html, test_parse_rule.html, test_bug57600.html, test_bug582412-1.html, test_HTMLDocument05.html
https://tbpl.mozilla.org/php/getParsedLog.php?id=16942630&tree=Mozilla-Inbound
Summary: Intermittent crash [@ js::gc::MarkValueRootRange] in test_media_queries.html, test_parse_rule.html, test_bug57600.html, test_bug582412-1.html, test_HTMLDocument05.html → Intermittent crash [@ js::gc::MarkValueRootRange] in test_media_queries.html, test_parse_rule.html, test_bug57600.html, test_bug582412-1.html, test_HTMLDocument05.html, test_input_number_value.html
https://tbpl.mozilla.org/php/getParsedLog.php?id=16965238&tree=Mozilla-Inbound
Summary: Intermittent crash [@ js::gc::MarkValueRootRange] in test_media_queries.html, test_parse_rule.html, test_bug57600.html, test_bug582412-1.html, test_HTMLDocument05.html, test_input_number_value.html → Intermittent crash [@ js::gc::MarkValueRootRange] in test_media_queries.html, test_parse_rule.html, test_bug57600.html, test_bug582412-1.html, test_HTMLDocument05.html, test_input_number_value.html, test_sessionStorageReplace.html
Blocks: 811389
Bill please may you take a look at this? Between this bug and bug 811389, this crash is now occurring fairly frequently.
Flags: needinfo?(wmccloskey)
Blocks: 812585
Whiteboard: [orange]
Blocks: 820779
Blocks: 827062
I'd love to get this fixed, but it's hard to tell what could be going wrong. My first suspicion is some sort of compiler bug. The fact that it's ARM-only makes it pretty unlikely that I'd be able to help much.
Flags: needinfo?(wmccloskey)
Apparently fixed by some unknown thing in early January, there's been nothing but misstars and downbranches since then.
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.