crash in js::detail::HashTable<js::HashMapEntry<* (multiple variations; see crash signature field)

VERIFIED FIXED in Firefox 32

Status

()

Core
JavaScript Engine
--
critical
VERIFIED FIXED
3 years ago
3 years ago

People

(Reporter: tracy, Assigned: Bobby Holley (parental leave - send mail for anything urgent))

Tracking

({crash, topcrash-win})

33 Branch
mozilla34
All
Windows NT
crash, topcrash-win
Points:
---

Firefox Tracking Flags

(firefox32 verified, firefox33+ verified, firefox34 verified, firefox-esr31 fixed)

Details

(crash signature)

(Reporter)

Description

3 years ago
This bug was filed from the Socorro interface and is 
report bp-2082f8ba-9a15-4a2f-9a5c-3b85b2140712.
=============================================================

Crashes in Nightly, Fx33.0a1, @ js::detail::HashTable<js::HashMapEntry in multiple variations since 2014071103.  Combined signatures put this in top 3 on the 7 day volume list.

changes between 20140710030200 and 20140711030201 : http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=cb75d6cfb004&tochange=e1a037c085d1
Work done on Xray?
(Reporter)

Updated

3 years ago
Crash Signature: , js::Vector<js::jit::MBasicBlock*, int, js::TempAllocPolicy> > >::isFree()] [@ js::detail::HashTable<js::HashMapEntry<js::PreBarriered<JSObject*>, js::RelocatablePtr<JSObject*> >, js::HashMap<js::PreBarriered<JSObject*>, js::RelocatablePtr<JSObje&hellip; → , js::Vector<js::jit::MBasicBlock*, int, js::TempAllocPolicy> > >::isFree()] [@ js::detail::HashTable<js::HashMapEntry<js::PreBarriered<JSObject*>, js::RelocatablePtr<JSObject*> >, js::HashMap<js::PreBarriered<JSObject*>, js::RelocatablePtr<JSObje&hellip;
(Reporter)

Updated

3 years ago
Keywords: topcrash-win

Comment 1

3 years ago
Looks like every day some new hashtable variant shows up.
Crash Signature: [@ js::detail::HashTable<js::HashMapEntry<js::PreBarriered<JSObject*>, js::PreBarriered<JSObject*> >, js::HashMap<js::PreBarriered<JSObject*>, js::PreBarriered<JSObject*>, js::DefaultHasher<js::PreBarriered<JSObject*> >, js::RuntimeAllocPolicy>::Ma&hellip; → [@ js::detail::HashTable<js::HashMapEntry<js::PreBarriered<JSObject*>, js::PreBarriered<JSObject*> >, js::HashMap<js::PreBarriered<JSObject*>, js::PreBarriered<JSObject*>, js::DefaultHasher<js::PreBarriered<JSObject*> >, js::RuntimeAllocPolicy>::Ma&hellip;
(Reporter)

Updated

3 years ago
Crash Signature: [@ js::detail::HashTable<js::HashMapEntry<js::PreBarriered<JSObject*>, js::PreBarriered<JSObject*> >, js::HashMap<js::PreBarriered<JSObject*>, js::PreBarriered<JSObject*>, js::DefaultHasher<js::PreBarriered<JSObject*> >, js::RuntimeAllocPolicy>::Ma&hellip; → [@ js::detail::HashTable<js::HashMapEntry<js::PreBarriered<JSObject*>, js::PreBarriered<JSObject*> >, js::HashMap<js::PreBarriered<JSObject*>, js::PreBarriered<JSObject*>, js::DefaultHasher<js::PreBarriered<JSObject*> >, js::RuntimeAllocPolicy>::Ma&hellip;
tracking-firefox33: ? → +
(Reporter)

Comment 2

3 years ago
more signatures
Crash Signature: [@ js::detail::HashTable<js::HashMapEntry<js::PreBarriered<JSObject*>, js::PreBarriered<JSObject*> >, js::HashMap<js::PreBarriered<JSObject*>, js::PreBarriered<JSObject*>, js::DefaultHasher<js::PreBarriered<JSObject*> >, js::RuntimeAllocPolicy>::Ma&hellip; → [@ js::detail::HashTable<js::HashMapEntry<js::PreBarriered<JSObject*>, js::PreBarriered<JSObject*> >, js::HashMap<js::PreBarriered<JSObject*>, js::PreBarriered<JSObject*>, js::DefaultHasher<js::PreBarriered<JSObject*> >, js::RuntimeAllocPolicy>::Ma&hellip;

Comment 3

3 years ago
Terrence, cpeterson says you might have a clue of who to blame or who can look at this one, even if it's not GC code itself that crashes here.

Can you help us to find an assignee or at least someone to investigate this issue?

This is probably the top stability issue in 33 at this point.
Flags: needinfo?(terrence)
I know next to nothing about XRays, forwarding n-i to bholley.
Flags: needinfo?(terrence) → needinfo?(bobbyholley)
Flags: needinfo?(bobbyholley)
Depends on: 1044205

Updated

3 years ago
Duplicate of this bug: 1044120

Updated

3 years ago
Duplicate of this bug: 1044123

Updated

3 years ago
Crash Signature: [@ js::detail::HashTable<js::HashMapEntry<js::PreBarriered<JSObject*>, js::PreBarriered<JSObject*> >, js::HashMap<js::PreBarriered<JSObject*>, js::PreBarriered<JSObject*>, js::DefaultHasher<js::PreBarriered<JSObject*> >, js::RuntimeAllocPolicy>::Ma&hellip; → [@ js::detail::HashTable<js::HashMapEntry<js::PreBarriered<JSObject*>, js::PreBarriered<JSObject*> >, js::HashMap<js::PreBarriered<JSObject*>, js::PreBarriered<JSObject*>, js::DefaultHasher<js::PreBarriered<JSObject*> >, js::RuntimeAllocPolicy>::Ma&hellip;
status-firefox34: --- → affected

Comment 8

3 years ago
NI?tracy to verify that the dependent bug fixed this signature.
Flags: needinfo?(twalker)
(Reporter)

Comment 9

3 years ago
marking this fixed and verified per bug 1044205
Status: NEW → RESOLVED
Last Resolved: 3 years ago
status-firefox33: affected → verified
status-firefox34: affected → verified
Flags: needinfo?(twalker)
Resolution: --- → FIXED
(Reporter)

Updated

3 years ago
Status: RESOLVED → VERIFIED
Assignee: nobody → bobbyholley
status-firefox32: --- → fixed
status-firefox-esr31: --- → fixed
Target Milestone: --- → mozilla34
Marking as Verified on Firefox 32 as well based on bug 1044205.
status-firefox32: fixed → verified
You need to log in before you can comment on or make changes to this bug.