1011281 - crash in js::detail::HashTable<js::HashMapEntry<float, unsigned int>, js::HashMap<float, unsigned int, js::DefaultHasher<float>, js::SystemAllocPolicy>::MapHashPolicy, js::SystemAllocPolicy>::checkOverloaded()

Status: RESOLVED DUPLICATE of bug 999158

(Core :: JavaScript Engine, defect)

Description

[juan becerra [:juanb]]

This bug was filed from the Socorro interface and is 
report bp-7b9af913-9575-4439-96aa-33d012140508.
=============================================================

Currently on the top 10 in the list of crashers for nightly. It's happening mostly on Windows 7 while the rest evenly split between the other Windows flavors. The first appearance on nightly was around 5/8. There are no comments in the bug reports, so there's not much to go on from there.

More reports at: https://crash-stats.mozilla.com/report/list?product=Firefox&signature=js%3A%3Adetail%3A%3AHashTable%3Cjs%3A%3AHashMapEntry%3Cfloat%2C+unsigned+int%3E%2C+js%3A%3AHashMap%3Cfloat%2C+unsigned+int%2C+js%3A%3ADefaultHasher%3Cfloat%3E%2C+js%3A%3ASystemAllocPolicy%3E%3A%3AMapHashPolicy%2C+js%3A%3ASystemAllocPolicy%3E%3A%3AcheckOverloaded%28%29

0 	mozjs.dll 	js::detail::HashTable<js::HashMapEntry<float,unsigned int>,js::HashMap<float,unsigned int,js::DefaultHasher<float>,js::SystemAllocPolicy>::MapHashPolicy,js::SystemAllocPolicy>::checkOverloaded() 	
1 	mozjs.dll 	JS::Handle<js::GlobalObject *>::operator->() 	
2 	mozjs.dll 	js::XDRInterpretedFunction<0>(js::XDRState<0> *,JS::Handle<JSObject *>,JS::Handle<JSScript *>,JS::MutableHandle<JSObject *>) 	
3 	mozjs.dll 	js::jit::ICSetProp_Native::Compiler::generateStubCode(js::jit::MacroAssembler &) 	
4 	mozjs.dll 	js::Shape::search(js::ExclusiveContext *,js::Shape *,jsid,js::Shape * * *,bool) 	
5 	mozjs.dll 	js::Shape::search(js::ExclusiveContext *,js::Shape *,jsid,js::Shape * * *,bool) 	
6 	mozjs.dll 	js::gcstats::MaybeAutoPhase::~MaybeAutoPhase() 	
7 	mozjs.dll 	js::SPSProfiler::enable(bool) 	
8 	mozjs.dll 	js::FrameIter::operator++() 	
9 	mozjs.dll 	js::GlobalObject::initIteratorClasses(JSContext *,JS::Handle<js::GlobalObject *>) 	
10 	mozjs.dll 	js::GlobalObject::initIteratorClasses(JSContext *,JS::Handle<js::GlobalObject *>) 	
11 	mozjs.dll 	JS_LinkConstructorAndPrototype(JSContext *,JS::Handle<JSObject *>,JS::Handle<JSObject *>) 	
12 	mozjs.dll 	JSC::Yarr::YarrGenerator<0>::readCharacter(int,JSC::X86Registers::RegisterID) 	
13 		@0xd946478 	
14 		@0x7a59699 	
15 		@0x291835d8 	
16 		@0x7a59699 	
17 		@0x291835d8 	
18 		@0x7a59699 	
19 		@0x291835d8 	
20 		@0x7a59699 	
21 		@0x291835d8 	
22 		@0x7a59699 	
23 		@0x291835d8 	
24 		@0x7a59699 	
25 		@0x291835d8 	
26 		@0x7a59699 	
27 		@0x2917de98 	
28 		@0x7a58591 	
29 		@0x29170710 	
30 		@0x7a58591 	
31 		@0x2917d9b8 	
32 		@0x20029250 	
33 		@0x2915e698 	
34 		@0x7a58591 	
35 		@0x2917cf98 	
36 		@0xd940644 	
37 		@0x20029250 	
38 		@0x2916fad0 	
39 		@0x7a58591 	
40 		@0x2916f470 	
41 		@0xd9408f4 	
42 	mozjs.dll 	js::jit::BaselineCompiler::emitBody() 	
43 	mozjs.dll 	js::jit::BaselineCompiler::emitBody() 	
44 	mozjs.dll 	js::jit::BaselineCompiler::emitBody() 	
45 	mozjs.dll 	js::jit::BaselineCompiler::emitBody() 	
46 	mozjs.dll 	JS::Rooted<JSFunction *>::Rooted<JSFunction *>(js::ContextFriendFields *,JSFunction *) 	
47 	mozjs.dll 	js::jit::BaselineCompiler::emitBody() 	
48 	mozjs.dll 	js::jit::BaselineCompiler::emitBody() 	
49 	mozjs.dll 	js::jit::LinearScanAllocator::assign(js::jit::LAllocation) 	
50 	mozjs.dll 	js::jit::BaselineCompiler::emitBody() 	
51 	mozjs.dll 	js::frontend::Parser<js::frontend::FullParseHandler>::expressionStatement() 	
52 	mozjs.dll 	js::jit::BaselineCompiler::emitBody() 	
53 	mozjs.dll 	JS::Rooted<JSFunction *>::Rooted<JSFunction *>(js::ContextFriendFields *,JSFunction *) 	
54 	mozjs.dll 	js::jit::BaselineCompiler::emitBody() 	
55 	mozjs.dll 	js::jit::BaselineCompiler::emitBody() 	
56 	mozjs.dll 	js::jit::BaselineCompiler::emitBody() 	
57 	mozjs.dll 	js::jit::BaselineCompiler::emitBody() 	
58 		@0xd94547d 	
59 		@0x28f53810 	
60 		@0xd9408f4 	
61 	mozjs.dll 	js::jit::BaselineCompiler::emitBody() 	
62 	mozjs.dll 	js::jit::BaselineCompiler::emitBody() 	
63 	mozjs.dll 	JS::Rooted<JSFunction *>::Rooted<JSFunction *>(js::ContextFriendFields *,JSFunction *) 	
64 	mozjs.dll 	js::jit::BaselineCompiler::emitBody() 	
65 	mozjs.dll 	js::jit::BaselineCompiler::emitBody() 	
66 	mozjs.dll 	js::jit::BaselineCompiler::emitBody() 	
67 	mozjs.dll 	js::jit::BaselineCompiler::emitBody() 	
68 		@0xd94547d 	
69 		@0x28f8d0c8 	
70 		@0x7a58591 	
71 		@0x28f53db0 	
72 		@0xd9408f4 	
73 	mozjs.dll 	js::jit::BaselineCompiler::emitBody() 	
74 	mozjs.dll 	js::jit::BaselineCompiler::emitBody() 	
75 	mozjs.dll 	JS::Rooted<JSFunction *>::Rooted<JSFunction *>(js::ContextFriendFields *,JSFunction *) 	
76 	mozjs.dll 	js::jit::BaselineCompiler::emitBody() 	
77 	mozjs.dll 	js::jit::BaselineCompiler::emitBody() 	
78 	mozjs.dll 	js::jit::LinearScanAllocator::assign(js::jit::LAllocation) 	
79 	mozjs.dll 	js::jit::BaselineCompiler::emitBody() 	
80 	mozjs.dll 	js::frontend::Parser<js::frontend::FullParseHandler>::expressionStatement() 	
81 	mozjs.dll 	js::jit::BaselineCompiler::emitBody() 	
82 	mozjs.dll 	JS::Rooted<JSFunction *>::Rooted<JSFunction *>(js::ContextFriendFields *,JSFunction *) 	
83 	mozjs.dll 	js::jit::BaselineCompiler::emitBody() 	
84 	mozjs.dll 	js::jit::BaselineCompiler::emitBody() 	
85 	mozjs.dll 	js::jit::BaselineCompiler::emitBody() 	
86 	mozjs.dll 	js::jit::BaselineCompiler::emitBody() 	
87 		@0xd94547d 	
88 		@0x290db1a0 	
89 		@0xd9408f4 	
134 	xul.dll 	mozilla::widget::TaskbarTabPreview::DetachFromNSWindow() 	
135 	xul.dll 	nsContainerFrame::InsertFrames(mozilla::layout::FrameChildListID,nsIFrame *,nsFrameList &) 	
136 	xul.dll 	nsDNSRecord::ReportUnusable(unsigned short) 	
137 	firefox.exe 	do_main 	browser/app/nsBrowserApp.cpp
138 	firefox.exe 	NS_internal_main(int,char * *) 	browser/app/nsBrowserApp.cpp
139 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp
140 	firefox.exe 	__tmainCRTStartup 	f:/dd/vctools/crt_bld/self_x86/crt/src/crtexe.c:552
141 	kernel32.dll 	kernel32.dll@0x4ee1c 	
142 	ntdll.dll 	__RtlUserThreadStart 	
143 	ntdll.dll 	_RtlUserThreadStart

Comment 1

[Jon Coppeard (:jonco)]

This stack trace looks like it's garbage.

Comment 2

[(Away)]

There was a symbol problem last week, WinDbg says this is the true stack:

mozjs!js::CrashAtUnhandlableOOM
mozjs!js::Nursery::MinorGCCallback
mozjs!js::gc::StoreBuffer::SlotsEdge::mark
mozjs!js::gc::StoreBuffer::MonoTypeBuffer<js::gc::StoreBuffer::SlotsEdge>::mark
mozjs!js::Nursery::collect