Closed Bug 1039547 Opened 8 years ago Closed 8 years ago

crash in js::detail::HashTable<js::HashMapEntry<* (multiple variations; see crash signature field)

Categories

(Core :: JavaScript Engine, defect)

33 Branch
All
Windows NT
defect
Not set
critical

Tracking

()

VERIFIED FIXED
mozilla34
Tracking Status
firefox32 --- verified
firefox33 + verified
firefox34 --- verified
firefox-esr31 --- fixed

People

(Reporter: tracy, Assigned: bholley)

References

Details

(Keywords: crash, topcrash-win)

Crash Data

This bug was filed from the Socorro interface and is 
report bp-2082f8ba-9a15-4a2f-9a5c-3b85b2140712.
=============================================================

Crashes in Nightly, Fx33.0a1, @ js::detail::HashTable<js::HashMapEntry in multiple variations since 2014071103.  Combined signatures put this in top 3 on the 7 day volume list.

changes between 20140710030200 and 20140711030201 : http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=cb75d6cfb004&tochange=e1a037c085d1
Work done on Xray?
Crash Signature: , unsigned int> >::isFree()] [@ js::detail::HashTableEntry<js::HashMapEntry<js::ScopeObject*, js::ScopeIterKey> >::isFree()] [@ js::detail::HashTableEntry<js::HashMapEntry<JSFlatString* → , unsigned int> >::isFree()] [@ js::detail::HashTableEntry<js::HashMapEntry<js::ScopeObject*, js::ScopeIterKey> >::isFree()] [@ js::detail::HashTableEntry<js::HashMapEntry<JSFlatString*
Keywords: topcrash-win
Looks like every day some new hashtable variant shows up.
Crash Signature: , js::DefaultHasher<js::PreBarriered<JSObject*> >, js::RuntimeAllocPolicy>::MapHashPolicy,js::RuntimeAllocPolicy>::lookup(JSObject * const &,unsigned int,unsigned int)] → , js::DefaultHasher<js::PreBarriered<JSObject*> >, js::RuntimeAllocPolicy>::MapHashPolicy,js::RuntimeAllocPolicy>::lookup(JSObject * const &,unsigned int,unsigned int)] [@ js::detail::HashTable<js::HashMapEntry<JSObject*, JS::Value>, js::HashMap<JSObject…
Crash Signature: , unsigned int)] [@ js::detail::HashTableEntry<js::PreBarriered<JSScript*> const >::isFree()] → , unsigned int)] [@ js::detail::HashTableEntry<js::PreBarriered<JSScript*> const >::isFree()] [@ js::detail::HashTable<js::HashMapEntry<js::PreBarriered<JSObject*>, js::PreBarriered<JSObject*> >, js::HashMap<js::PreBarriered<JSObject*>, js::PreBarriered…
more signatures
Crash Signature: , js::PreBarriered<JSObject*>, js::DefaultHasher<js::PreBarriered<JSObject*> >, js::RuntimeAllocPolicy>::MapHashPolicy, js::RuntimeAllocPolicy>::lookup(JSObject* const&, unsigned int, unsigned int) const] → , js::PreBarriered<JSObject*>, js::DefaultHasher<js::PreBarriered<JSObject*> >, js::RuntimeAllocPolicy>::MapHashPolicy, js::RuntimeAllocPolicy>::lookup(JSObject* const&, unsigned int, unsigned int) const] [@ js::detail::HashTable<js::HashMapEntry<js::Pro…
Terrence, cpeterson says you might have a clue of who to blame or who can look at this one, even if it's not GC code itself that crashes here.

Can you help us to find an assignee or at least someone to investigate this issue?

This is probably the top stability issue in 33 at this point.
Flags: needinfo?(terrence)
I know next to nothing about XRays, forwarding n-i to bholley.
Flags: needinfo?(terrence) → needinfo?(bobbyholley)
Flags: needinfo?(bobbyholley)
Depends on: 1044205
Duplicate of this bug: 1044120
Duplicate of this bug: 1044123
Crash Signature: ,js::HashSet<JSCompartment *,js::DefaultHasher<JSCompartment *>,js::RuntimeAllocPolicy>::SetOps,js::RuntimeAllocPolicy>::lookup(JSCompartment * const &,unsigned int,unsigned int)] → ,js::HashSet<JSCompartment *,js::DefaultHasher<JSCompartment *>,js::RuntimeAllocPolicy>::SetOps,js::RuntimeAllocPolicy>::lookup(JSCompartment * const &,unsigned int,unsigned int)] [@ js::detail::HashTable<js::HashMapEntry<JSObject*, unsigned int>, js::Ha…
NI?tracy to verify that the dependent bug fixed this signature.
Flags: needinfo?(twalker)
marking this fixed and verified per bug 1044205
Status: NEW → RESOLVED
Closed: 8 years ago
Flags: needinfo?(twalker)
Resolution: --- → FIXED
Status: RESOLVED → VERIFIED
Assignee: nobody → bobbyholley
Target Milestone: --- → mozilla34
Marking as Verified on Firefox 32 as well based on bug 1044205.
You need to log in before you can comment on or make changes to this bug.