1027155 - crash in js::types::TypeSet::hasType(js::types::Type) const

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Kevin Brosnan [Ex-Mozilla]]

This bug was filed from the Socorro interface and is 
report bp-eb919e20-752b-4325-8bdd-2fb9e2140613.
=============================================================

0 	libxul.so 	js::types::TypeSet::hasType(js::types::Type) const 	js/src/jsinfer.h
1 	libxul.so 	js::types::TypeMonitorResult(JSContext*, JSScript*, unsigned char*, JS::Value const&) 	js/src/jsinfer.cpp
2 	libxul.so 	js::jit::DoGetPropFallback 	js/src/jsinferinlines.h
3 		@0x473d6112 	
4 	dalvik-heap (deleted) 	dalvik-heap (deleted)@0xf0a03e 	
5 	dalvik-heap (deleted) 	dalvik-heap (deleted)@0x273492d 	
6 	libxul.so 	js_Date(JSContext*, unsigned int, JS::Value*) 	js/src/jsdate.cpp
7 		@0xffffff80

Comment 1

[Sylvestre Ledru [:Sylvestre]]

Top crash. Tracking.

Comment 2

[Brad Lassey [:blassey] (use needinfo?)]

Naveed, top crash on beta, can we get an assignee?

Comment 3

[Naveed Ihsanullah [:naveed]]

Am I reading the data correctly that this signature started spiking about a week ago? Can we get a regression range.

Brian can you please start an investigation on why TypeMonitorResult callback is crashing here?

Comment 4

[Kevin Brosnan [Ex-Mozilla]]

This is new on beta going from 30 to 31. Aurora and Nightly are difficult to monitor for anything other than extremely common. The code that caused this regression is likely to be at least 8 weeks old and up to 14 for something that landed at the binging of the 31 nightly cycle. There is a smaller chance that a 32 uplift caused the issue.

Comment 5

[Brian Hackett [Laid off!]]

(In reply to Naveed Ihsanullah [:naveed] from comment #3)
> Am I reading the data correctly that this signature started spiking about a
> week ago? Can we get a regression range.
> 
> Brian can you please start an investigation on why TypeMonitorResult
> callback is crashing here?

Well, it looks like a null crash so presumably the TypeSet being passed in is null, and on the crash in comment 0 the code is being called from baseline.  This stuff hasn't changed so far as I know since last october (bug 928562) so the regressing problem could be something totally unrelated and without STR I don't see many options here.

Comment 6

[Kevin Brosnan [Ex-Mozilla]]

No crashes since 31b2 marking wfm

Comment 7

[Sylvestre Ledru [:Sylvestre]]

WFM, untracking.

Comment 8

[Chris Peterson [:cpeterson]]

Removing steps-wanted keyword because this bug has been resolved.