902384 - crash in js::types::UseNewTypeForClone

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Scoobidiver (away)]

It started spiking in 26.0a1/20130806104538. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=a0dd80f800e2&tochange=1e381c91885d
It's likely a regression from bug 901178.

Signature 	js::types::UseNewTypeForClone(JSFunction*) More Reports Search
UUID 	1eaa0a28-cddd-4130-803b-e9bb82130807
Date Processed	2013-08-07 07:13:58.035564
Uptime	1709
Last Crash	209060 seconds before submission
Install Age 	9169 since version was first installed.
Install Time 	2013-08-07 06:40:01
Product 	Firefox
Version 	26.0a1
Build ID 	20130806104538
Release Channel 	nightly
OS 	Windows NT
OS Version 	6.2.9200
Build Architecture 	x86
Build Architecture Info 	GenuineIntel family 6 model 42 stepping 7 | 2
Crash Reason 	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address 	0x75
App Notes 	
AdapterVendorID: 0x8086, AdapterDeviceID: 0x0106, AdapterSubsysID: 06491025, AdapterDriverVersion: 9.17.10.2828
D2D? D2D+ DWrite? DWrite+ D3D10 Layers? D3D10 Layers+ 

Frame 	Module 	Signature 	Source
0 	mozjs.dll 	js::types::UseNewTypeForClone(JSFunction *) 	js/src/jsinfer.cpp
1 	mozjs.dll 	js::ion::LIRGenerator::visitLambda(js::ion::MLambda *) 	js/src/ion/Lowering.cpp
2 	mozjs.dll 	js::ion::MLambda::accept(js::ion::MInstructionVisitor *) 	js/src/ion/MIR.h
3 	mozjs.dll 	js::ion::LIRGenerator::visitBlock(js::ion::MBasicBlock *) 	js/src/ion/Lowering.cpp
4 	mozjs.dll 	js::ion::LIRGenerator::generate() 	js/src/ion/Lowering.cpp
5 	mozjs.dll 	js::ion::GenerateLIR(js::ion::MIRGenerator *) 	js/src/ion/Ion.cpp
6 	mozjs.dll 	js::ion::CompileBackEnd(js::ion::MIRGenerator *,js::ion::MacroAssembler *) 	js/src/ion/Ion.cpp
7 	mozjs.dll 	js::WorkerThread::handleIonWorkload(js::WorkerThreadState &) 	js/src/jsworkers.cpp
8 	mozjs.dll 	js::WorkerThread::threadLoop() 	js/src/jsworkers.cpp
9 	mozjs.dll 	js::WorkerThread::ThreadMain(void *) 	js/src/jsworkers.cpp
10 	nss3.dll 	_PR_NativeRunThread 	nsprpub/pr/src/threads/combined/pruthr.c
11 	nss3.dll 	pr_root 	nsprpub/pr/src/md/windows/w95thred.c
12 	msvcr100.dll 	_callthreadstartex 	f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\threadex.c
13 	msvcr100.dll 	_threadstartex 	f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\threadex.c
14 	kernel32.dll 	BaseThreadInitThunk 	
15 	ntdll.dll 	__RtlUserThreadStart 	
16 	ntdll.dll 	_RtlUserThreadStart

More reports at:
https://crash-stats.mozilla.com/report/list?product=Firefox&signature=js%3A%3Atypes%3A%3AUseNewTypeForClone%28JSFunction*%29

Comment 1

[Scoobidiver (away)]

It's #3 unfixed crasher in 26.0a1.

Comment 2

[Nicolas B. Pierron [:nbp]]

(In reply to Scoobidiver from comment #1)
> It's #3 unfixed crasher in 26.0a1.

I am trying to make a reproducible test case for this one, the problem is that it depends on the scheduling of threads.  I've opened Bug 902690 to be able to reduce the test case of Bug 902253 such as we can add it to the test suite and prevent any re-apparition of this one.

If this bug becomes urgent, we should probably backout Bug 901178.

Comment 3

[Scoobidiver (away)]

(In reply to Nicolas B. Pierron [:nbp] from comment #2)
> I am trying to make a reproducible test case for this one, the problem is
> that it depends on the scheduling of threads.
Is bug 902794 of any help?

Comment 4

[Nicolas B. Pierron [:nbp]]

Scheduling issues are hard to reproduce, especially in debuggers, so I want to get it right such as we can have a deterministic test failure which can be added to the test suite.  Even if we have to backout the original patch in the mean time.

(In reply to Scoobidiver from comment #3)
> Is bug 902794 of any help?

Pure shell test case as provided in Bug 902690 are easier to handle than mochitest failures which involve a browser build.

Comment 5

[Nicolas B. Pierron [:nbp]]

This crash-stat bug should be closed, as the original patch has been backout.  I will add a test case as part of the original patch when I would be able to reproduce at 100%.