Closed Bug 1020154 Opened 12 years ago Closed 11 years ago

Intermittent test_bug582181-2.html | application crashed [@ js::gc::StoreBuffer::putSlotFromAnyThread(JSObject *,int,int,int)]

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
Windows XP
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: cbook, Unassigned)

References

(
URL
)

Details

(Keywords: crash, intermittent-failure)

Windows XP 32-bit mozilla-inbound opt test mochitest-4 on 2014-06-03 17:31:06 PDT for push cd2ef9d646ff slave: t-xp32-ix-111 https://tbpl.mozilla.org/php/getParsedLog.php?id=40995903&tree=Mozilla-Inbound TEST-UNEXPECTED-FAIL | /tests/layout/base/tests/test_bug582181-2.html | application terminated with exit code 3221225477 PROCESS-CRASH | /tests/layout/base/tests/test_bug582181-2.html | application crashed [@ js::gc::StoreBuffer::putSlotFromAnyThread(JSObject *,int,int,int)] 17:36:05 INFO - CPU: x86 17:36:05 INFO - GenuineIntel family 6 model 30 stepping 5 17:36:05 INFO - 8 CPUs 17:36:05 INFO - Crash reason: EXCEPTION_ACCESS_VIOLATION_READ 17:36:05 INFO - Crash address: 0x2b2b2b80 17:36:05 INFO - Thread 0 (crashed) 17:36:05 INFO - 0 mozjs.dll!js::gc::StoreBuffer::putSlotFromAnyThread(JSObject *,int,int,int) [StoreBuffer.h:cd2ef9d646ff : 449 + 0xd] 17:36:05 INFO - eip = 0x00bb3a73 esp = 0x0012d938 ebp = 0x0012d94c ebx = 0x00000002 17:36:05 INFO - esi = 0x07800000 edi = 0x2b2b2b2b eax = 0x00000002 ecx = 0x2b2b2b2b 17:36:05 INFO - edx = 0x079ff450 efl = 0x00010206 17:36:05 INFO - Found by: given as instruction pointer in context 17:36:05 INFO - 1 mozjs.dll!js::ObjectImpl::setSlot(unsigned int,JS::Value const &) [ObjectImpl.h:cd2ef9d646ff : 737 + 0x66] 17:36:05 INFO - eip = 0x00d9f89e esp = 0x0012d954 ebp = 0x0012d978 17:36:05 INFO - Found by: call frame info 17:36:05 INFO - 2 mozjs.dll!UpdateShapeTypeAndValue<0> [jsobj.cpp:cd2ef9d646ff : 3750 + 0x23] 17:36:05 INFO - eip = 0x00dbe8cf esp = 0x0012d980 ebp = 0x0012d994 17:36:05 INFO - Found by: call frame info 17:36:05 INFO - 3 mozjs.dll!DefinePropertyOrElement<0> [jsobj.cpp:cd2ef9d646ff : 3850 + 0xe] 17:36:05 INFO - eip = 0x00dbf249 esp = 0x0012d99c ebp = 0x0012da08 17:36:05 INFO - Found by: call frame info 17:36:05 INFO - 4 mozjs.dll!js::DefineNativeProperty(js::ExclusiveContext *,JS::Handle<JSObject *>,JS::Handle<jsid>,JS::Handle<JS::Value>,bool (*)(JSContext *,JS::Handle<JSObject *>,JS::Handle<jsid>,JS::MutableHandle<JS::Value>),bool (*)(JSContext *,JS::Handle<JSObject *>,JS::Handle<jsid>,bool,JS::MutableHandle<JS::Value>),unsigned int) [jsobj.cpp:cd2ef9d646ff : 3954 + 0x12] 17:36:05 INFO - eip = 0x00dbfa0a esp = 0x0012da10 ebp = 0x0012da78 17:36:05 INFO - Found by: call frame info 17:36:05 INFO - 5 mozjs.dll!JSObject::defineProperty(js::ExclusiveContext *,JS::Handle<JSObject *>,js::PropertyName *,JS::Handle<JS::Value>,bool (*)(JSContext *,JS::Handle<JSObject *>,JS::Handle<jsid>,JS::MutableHandle<JS::Value>),bool (*)(JSContext *,JS::Handle<JSObject *>,JS::Handle<jsid>,bool,JS::MutableHandle<JS::Value>),unsigned int) [jsobj.cpp:cd2ef9d646ff : 3603 + 0x1a] 17:36:05 INFO - eip = 0x00dc0999 esp = 0x0012da80 ebp = 0x0012daac 17:36:05 INFO - Found by: call frame info 17:36:05 INFO - 6 mozjs.dll!js::PropDesc::makeObject(JSContext *) [jsobj.cpp:cd2ef9d646ff : 331 + 0x103] 17:36:05 INFO - eip = 0x00dcc25b esp = 0x0012dab4 ebp = 0x0012db18 17:36:05 INFO - Found by: call frame info 17:36:05 INFO - 7 mozjs.dll!js::NewPropertyDescriptorObject(JSContext *,JS::Handle<JSPropertyDescriptor>,JS::MutableHandle<JS::Value>) [jsobj.cpp:cd2ef9d646ff : 269 + 0x5] 17:36:05 INFO - eip = 0x00dd3165 esp = 0x0012db20 ebp = 0x0012db58 17:36:05 INFO - Found by: call frame info 17:36:05 INFO - 8 mozjs.dll!js::GetOwnPropertyDescriptor(JSContext *,JS::Handle<JSObject *>,JS::Handle<jsid>,JS::MutableHandle<JS::Value>) [jsobj.cpp:cd2ef9d646ff : 386 + 0x33] 17:36:05 INFO - eip = 0x00dd3209 esp = 0x0012db60 ebp = 0x0012db94 17:36:05 INFO - Found by: call frame info 17:36:05 INFO - 9 mozjs.dll!obj_getOwnPropertyDescriptor [Object.cpp:cd2ef9d646ff : 807 + 0x1c]
https://tbpl.mozilla.org/php/getParsedLog.php?id=41020129&tree=Mozilla-Inbound jandem do you know whats going on here ? seems this is a new intermittent in different tests
Flags: needinfo?(jdemooij)
Summary: Intermittent test_bug582181-2.html | application terminated with exit code 3221225477 | application crashed [@ js::gc::StoreBuffer::putSlotFromAnyThread(JSObject *,int,int,int)] → Intermittent test_bug582181-2.html | application crashed [@ js::gc::StoreBuffer::putSlotFromAnyThread(JSObject *,int,int,int)]
(In reply to Carsten Book [:Tomcat] from comment #1) > jandem do you know whats going on here ? seems this is a new intermittent in > different tests Forwarding to Terrence, StoreBuffer::putSlotFromAnyThread is (G)GC territory.
Flags: needinfo?(jdemooij) → needinfo?(terrence)
This is a use-after-free: 0x2b is the swept-nursery pattern. This indicates that a live pointer did not get marked during a minor GC. This means that the pointer in question was used at some point without correct rooting or without the proper barriers being fired. This is either a missing Rooted<T>, HeapPtr<T>, or missing barrier manual barrier in the JIT. Do we have a regression range?
Flags: needinfo?(terrence)
Inactive; closing (see bug 1180138).
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.