1026672 - crash in jemalloc_crash | arena_dalloc | je_free | free | js::Shape::sweep()

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

This bug was filed from the Socorro interface and is 
report bp-ecd23567-1487-46c7-bd9a-379122140607.
=============================================================
Frame 	Module 	Signature 	Source
0 	libmozglue.so 	jemalloc_crash 	memory/mozjemalloc/jemalloc.c
1 	libmozglue.so 	arena_dalloc 	memory/mozjemalloc/jemalloc.c
2 	libmozglue.so 	je_free 	memory/mozjemalloc/jemalloc.c
3 	libmozglue.so 	free 	memory/build/replace_malloc.c
4 	libxul.so 	js::Shape::sweep() 	/builds/slave/b2g_m-cen_ham_ntly-00000000000/build/objdir-gecko/js/src/../../dist/include/js/Utility.h:121
5 	libxul.so 	js::gc::GCRuntime::sweepPhase(js::SliceBudget&) 	js/src/jsgc.cpp
6 	libxul.so 	js::gc::GCRuntime::incrementalCollectSlice(long long, JS::gcreason::Reason, js::JSGCInvocationKind) 	js/src/jsgc.cpp
7 	libxul.so 	js::gc::GCRuntime::gcCycle(bool, long long, js::JSGCInvocationKind, JS::gcreason::Reason) 	js/src/jsgc.cpp
8 	libxul.so 	js::gc::GCRuntime::collect(bool, long long, js::JSGCInvocationKind, JS::gcreason::Reason) 	js/src/jsgc.cpp
9 	libxul.so 	js::gc::GCIfNeeded(JSContext*) 	js/src/jsgc.cpp
10 	libxul.so 	js_NewString<(js::AllowGC)1u, jschar> 	js/src/jsgcinlines.h
11 	libxul.so 	js_NewStringCopyN<(js::AllowGC)1u> 	js/src/jsstr.cpp
12 	libxul.so 	JS_NewStringCopyN(JSContext*, char const*, unsigned int) 	js/src/jsapi.cpp
13 	libxul.so 	XPCConvert::NativeData2JS(JS::MutableHandle<JS::Value>, void const*, nsXPTType const&, nsID const*, unsigned int*) 	js/xpconnect/src/XPCConvert.cpp
14 	libxul.so 	XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) 	js/xpconnect/src/XPCWrappedNative.cpp
15 	libxul.so 	XPC_WN_CallMethod(JSContext*, unsigned int, JS::Value*) 	js/xpconnect/src/XPCWrappedNativeJSOps.cpp
16 	libxul.so 	js::Invoke 	js/src/jscntxtinlines.h
17 	libxul.so 	js::jit::DoCallFallback 	js/src/jit/BaselineIC.cpp
18 		@0x42dd6fd6

More reports : https://crash-stats.mozilla.com/report/list?product=B2G&signature=jemalloc_crash+|+arena_dalloc+|+je_free+|+free+|+js%3A%3AShape%3A%3Asweep%28%29#tab-reports

First appearance of crash seemed to occur from this signature : 20140606160206

Comment 1

[Jason Orendorff [:jorendorff]]

Terrence, does this look familiar?

Is there anything we could change to improve the crash dump info?

Comment 2

[Terrence Cole [:terrence]]

(In reply to Jason Orendorff [:jorendorff] from comment #1)
> Terrence, does this look familiar?

Nope, looks new.
 
> Is there anything we could change to improve the crash dump info?

Not that I know of.

Comment 3

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

Is this a related crash:
https://crash-stats.mozilla.com/report/list?signature=jemalloc_crash%20|%20arena_dalloc%20|%20je_free%20|%20free%20|%20js%3A%3APropertyTree%3A%3AinsertChild%28js%3A%3AExclusiveContext*%2C%20js%3A%3AShape*%2C%20js%3A%3AShape*%29

Comment 4

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

Sorry, wrong copy paste in buffer; please ignore the last link.  I meant for this link:
https://crash-stats.mozilla.com/report/list?signature=jemalloc_crash%20|%20arena_dalloc%20|%20je_free%20|%20free%20|%20js%3A%3ASweepScriptData%28JSRuntime*%29

Comment 5

[Pi Wei Cheng [:piwei] (inactive)]

I looked at the reports and saw that this crash hasn't been occurring in the past 28 days. The original report was seen on Hamachi v2.0 nightly build ID 20140606160206. Is this bug still valid?

Naoki, what were you doing at the time of the crash? So we can get a better idea on how and where to start with the steps-wanted request. Thanks.

Comment 6

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

Based on the search ( https://crash-stats.mozilla.com/search/?signature=~js%3A%3AShape%3A%3Asweep&product=B2G&_facets=signature&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform ) , this report doesn't seem relevant anymore.

I do a crash analysis and report based on crash-stats.

Comment 7

[Pi Wei Cheng [:piwei] (inactive)]

Thanks. Removing keyword.