1058151 - Intermittent 994740-1.xhtml | application crashed [@ 0xffffffe4][@ js::BaseShape::getUnowned(js::ExclusiveContext*, js::StackBaseShape&)]

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine: JIT, defect)

Description

[Ryan VanderMeulen [:RyanVM]]

https://tbpl.mozilla.org/php/getParsedLog.php?id=46699718&tree=Mozilla-Central

Android 4.0 Panda mozilla-central debug test crashtest on 2014-08-25 10:14:58 PDT for push 4ca2bd0722d9
slave: panda-0341

10:31:24     INFO -  REFTEST TEST-START | http://10.26.130.23:30341/tests/dom/xml/crashtests/994740-1.xhtml
10:31:24     INFO -  REFTEST TEST-LOAD | http://10.26.130.23:30341/tests/dom/xml/crashtests/994740-1.xhtml | 654 / 2705 (24%)
10:31:24     INFO -  REFTEST TEST-PASS | http://10.26.130.23:30341/tests/dom/xml/crashtests/994740-1.xhtml | (LOAD ONLY)
10:31:24     INFO -  REFTEST INFO | Loading a blank page
10:31:24     INFO -  INFO | automation.py | Application ran for: 0:05:43.289811
10:31:24     INFO -  INFO | zombiecheck | Reading PID log: /tmp/tmpvUWbuspidlog
10:31:24     INFO -  Contents of /data/anr/traces.txt:
10:31:25     INFO -  /data/tombstones does not exist; tombstone check skipped
10:31:25     INFO -  mozcrash INFO | Downloading symbols from: https://ftp-ssl.mozilla.org/pub/mozilla.org/mobile/tinderbox-builds/mozilla-central-android-debug/1408981853/fennec-34.0a1.en-US.android-arm.crashreporter-symbols.zip
10:31:31     INFO -  mozcrash INFO | Saved minidump as /builds/panda-0341/test/build/blobber_upload_dir/6a2f29df-45dc-41c3-7528235e-4c6b767e.dmp
10:31:31     INFO -  mozcrash INFO | Saved app info as /builds/panda-0341/test/build/blobber_upload_dir/6a2f29df-45dc-41c3-7528235e-4c6b767e.extra
10:31:31  WARNING -  PROCESS-CRASH | http://10.26.130.23:30341/tests/dom/xml/crashtests/994740-1.xhtml | application crashed [@ 0xffffffe4]
10:31:31     INFO -  Crash dump filename: /tmp/tmpet1Med/6a2f29df-45dc-41c3-7528235e-4c6b767e.dmp
10:31:31     INFO -  Operating system: Android
10:31:31     INFO -                    0.0.0 Linux 3.2.0+ #2 SMP PREEMPT Thu Nov 29 08:06:57 EST 2012 armv7l pandaboard/pandaboard/pandaboard:4.0.4/IMM76I/5:eng/test-keys
10:31:31     INFO -  CPU: arm
10:31:31     INFO -       2 CPUs
10:31:31     INFO -  Crash reason:  SIGSEGV
10:31:31     INFO -  Crash address: 0xffffffe4
10:31:31     INFO -  Thread 13 (crashed)
10:31:31     INFO -   0  0xffffffe4
10:31:31     INFO -       r4 = 0x5d945bec    r5 = 0x5d945bcc    r6 = 0x5c3bb350    r7 = 0x5d945c84
10:31:31     INFO -       r8 = 0x70236310    r9 = 0x5d945b01   r10 = 0x64a56330    fp = 0x5d945c10
10:31:31     INFO -       sp = 0x5d945bc0    lr = 0x640d946b    pc = 0xffffffe4
10:31:31     INFO -      Found by: given as instruction pointer in context
10:31:31     INFO -   1  libxul.so!js::BaseShape::getUnowned(js::ExclusiveContext*, js::StackBaseShape&) [HashTable.h:4ca2bd0722d9 : 372 + 0x3]
10:31:31     INFO -       sp = 0x5d945be0    pc = 0x640d9aa1
10:31:31     INFO -      Found by: stack scanning
10:31:31     INFO -   2  libxul.so!js::Shape* JSObject::addPropertyInternal<(js::ExecutionMode)0>(js::ExecutionModeTraits<(js::ExecutionMode)0>::ExclusiveContextType, JS::Handle<JSObject*>, JS::Handle<jsid>, bool (*)(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>), bool (*)(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, bool, JS::MutableHandle<JS::Value>), unsigned int, unsigned int, unsigned int, js::Shape**, bool) [Shape.cpp:4ca2bd0722d9 : 644 + 0x7]
10:31:31     INFO -       r4 = 0x5c3bb340    r5 = 0x5d946288    r6 = 0x00000000    r7 = 0x5d945c74
10:31:31     INFO -       sp = 0x5d945c48    pc = 0x640d9d33
10:31:31     INFO -      Found by: call frame info
10:31:31     INFO -   3  libxul.so!js::Shape* JSObject::putProperty<(js::ExecutionMode)0>(js::ExecutionModeTraits<(js::ExecutionMode)0>::ExclusiveContextType, JS::Handle<JSObject*>, JS::Handle<jsid>, bool (*)(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>), bool (*)(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, bool, JS::MutableHandle<JS::Value>), unsigned int, unsigned int, unsigned int) [Shape.cpp:4ca2bd0722d9 : 832 + 0x1f]
10:31:31     INFO -       r4 = 0x00000000    r5 = 0x7023ad40    r6 = 0x00ffffff    r7 = 0x6dc0a26c
10:31:31     INFO -       r8 = 0x5d9460d8    r9 = 0x5d945d70   r10 = 0x00000000    fp = 0x5c3bb340
10:31:31     INFO -       sp = 0x5d945d28    pc = 0x640dadb9
10:31:31     INFO -      Found by: call frame info
10:31:31     INFO -   4  libxul.so!DefinePropertyOrElement<(js::ExecutionMode)0u> [jsobj.cpp:4ca2bd0722d9 : 4158 + 0x3]
10:31:31     INFO -       r4 = 0x5d9460d8    r5 = 0x00000001    r6 = 0x5c3bb340    r7 = 0x5d946288
10:31:31     INFO -       r8 = 0x00000000    r9 = 0x5d945f28   r10 = 0x00000000    fp = 0x00000000
10:31:31     INFO -       sp = 0x5d945e28    pc = 0x6402d7d5
10:31:31     INFO -      Found by: call frame info
10:31:31     INFO -   5  libxul.so!js::DefineNativeProperty(js::ExclusiveContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::Handle<JS::Value>, bool (*)(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>), bool (*)(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, bool, JS::MutableHandle<JS::Value>), unsigned int) [jsobj.cpp:4ca2bd0722d9 : 4309 + 0x7]
10:31:31     INFO -       r4 = 0x5c3bb340    r5 = 0x00000071    r6 = 0x00000000    r7 = 0x5d946288
10:31:31     INFO -       r8 = 0x5d945f38    r9 = 0x5d945f28   r10 = 0x5d9460d8    fp = 0x64cdce40
10:31:31     INFO -       sp = 0x5d945ef8    pc = 0x6402dd4f
10:31:31     INFO -      Found by: call frame info

Comment 1

[Ed Morley [:emorley]]

Inactive; closing (see bug 1180138).