Closed Bug 1026672 Opened 8 years ago Closed 8 years ago

crash in jemalloc_crash | arena_dalloc | je_free | free | js::Shape::sweep()

Categories

(Core :: JavaScript Engine, defect)

29 Branch
ARM
Gonk (Firefox OS)
defect
Not set
critical

Tracking

()

RESOLVED WORKSFORME
Tracking Status
b2g-v2.0 --- affected
b2g-v2.1 --- affected

People

(Reporter: nhirata, Unassigned)

Details

(Keywords: crash, Whiteboard: [b2g-crash])

Crash Data

This bug was filed from the Socorro interface and is 
report bp-ecd23567-1487-46c7-bd9a-379122140607.
=============================================================
Frame 	Module 	Signature 	Source
0 	libmozglue.so 	jemalloc_crash 	memory/mozjemalloc/jemalloc.c
1 	libmozglue.so 	arena_dalloc 	memory/mozjemalloc/jemalloc.c
2 	libmozglue.so 	je_free 	memory/mozjemalloc/jemalloc.c
3 	libmozglue.so 	free 	memory/build/replace_malloc.c
4 	libxul.so 	js::Shape::sweep() 	/builds/slave/b2g_m-cen_ham_ntly-00000000000/build/objdir-gecko/js/src/../../dist/include/js/Utility.h:121
5 	libxul.so 	js::gc::GCRuntime::sweepPhase(js::SliceBudget&) 	js/src/jsgc.cpp
6 	libxul.so 	js::gc::GCRuntime::incrementalCollectSlice(long long, JS::gcreason::Reason, js::JSGCInvocationKind) 	js/src/jsgc.cpp
7 	libxul.so 	js::gc::GCRuntime::gcCycle(bool, long long, js::JSGCInvocationKind, JS::gcreason::Reason) 	js/src/jsgc.cpp
8 	libxul.so 	js::gc::GCRuntime::collect(bool, long long, js::JSGCInvocationKind, JS::gcreason::Reason) 	js/src/jsgc.cpp
9 	libxul.so 	js::gc::GCIfNeeded(JSContext*) 	js/src/jsgc.cpp
10 	libxul.so 	js_NewString<(js::AllowGC)1u, jschar> 	js/src/jsgcinlines.h
11 	libxul.so 	js_NewStringCopyN<(js::AllowGC)1u> 	js/src/jsstr.cpp
12 	libxul.so 	JS_NewStringCopyN(JSContext*, char const*, unsigned int) 	js/src/jsapi.cpp
13 	libxul.so 	XPCConvert::NativeData2JS(JS::MutableHandle<JS::Value>, void const*, nsXPTType const&, nsID const*, unsigned int*) 	js/xpconnect/src/XPCConvert.cpp
14 	libxul.so 	XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) 	js/xpconnect/src/XPCWrappedNative.cpp
15 	libxul.so 	XPC_WN_CallMethod(JSContext*, unsigned int, JS::Value*) 	js/xpconnect/src/XPCWrappedNativeJSOps.cpp
16 	libxul.so 	js::Invoke 	js/src/jscntxtinlines.h
17 	libxul.so 	js::jit::DoCallFallback 	js/src/jit/BaselineIC.cpp
18 		@0x42dd6fd6

More reports : https://crash-stats.mozilla.com/report/list?product=B2G&signature=jemalloc_crash+|+arena_dalloc+|+je_free+|+free+|+js%3A%3AShape%3A%3Asweep%28%29#tab-reports

First appearance of crash seemed to occur from this signature : 20140606160206
Terrence, does this look familiar?

Is there anything we could change to improve the crash dump info?
Flags: needinfo?(terrence)
(In reply to Jason Orendorff [:jorendorff] from comment #1)
> Terrence, does this look familiar?

Nope, looks new.
 
> Is there anything we could change to improve the crash dump info?

Not that I know of.
Flags: needinfo?(terrence)
Keywords: steps-wanted
I looked at the reports and saw that this crash hasn't been occurring in the past 28 days. The original report was seen on Hamachi v2.0 nightly build ID 20140606160206. Is this bug still valid?

Naoki, what were you doing at the time of the crash? So we can get a better idea on how and where to start with the steps-wanted request. Thanks.
Flags: needinfo?(nhirata.bugzilla)
Based on the search ( https://crash-stats.mozilla.com/search/?signature=~js%3A%3AShape%3A%3Asweep&product=B2G&_facets=signature&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform ) , this report doesn't seem relevant anymore.

I do a crash analysis and report based on crash-stats.
Status: NEW → RESOLVED
Closed: 8 years ago
Flags: needinfo?(nhirata.bugzilla)
Resolution: --- → WORKSFORME
Thanks. Removing keyword.
Flags: needinfo?(jmitchell)
Keywords: steps-wanted
Flags: needinfo?(jmitchell)
You need to log in before you can comment on or make changes to this bug.