1084074 - crash in js::AsmJSModule::lookupCodeRange(void*) const

Status: RESOLVED DUPLICATE of bug 1064668

(Core :: JavaScript Engine, defect)

Description

[Liz Henry (:lizzard) (relman/hg->git project)]

This bug was filed from the Socorro interface and is 
report bp-bebf1559-d455-4d2c-9f5c-1056e2141016.
=============================================================

Crashed while I was trying out the Gecko Profiler addon with Firefox 34.0a2 and about:home's game.  This appears to be the first and only instance of this crash signature! While trying to capture/analyze a profile of about: home I also got another few crashes with the same signature as in bug 1069912. 


Crashing thread:

0 	XUL 	js::AsmJSModule::lookupCodeRange(void*) const 	js/src/asmjs/AsmJSModule.h
1 	XUL 	js::AsmJSProfilingFrameIterator::AsmJSProfilingFrameIterator(js::AsmJSActivation const&, JS::ProfilingFrameIterator::RegisterState const&) 	js/src/asmjs/AsmJSFrameIterator.cpp
2 	XUL 	JS::ProfilingFrameIterator::ProfilingFrameIterator(JSRuntime*, JS::ProfilingFrameIterator::RegisterState const&) 	js/src/vm/Stack.cpp
3 	XUL 	mergeStacksIntoProfile 	tools/profiler/TableTicker.cpp
4 	XUL 	TableTicker::doNativeBacktrace(ThreadProfile&, TickSample*) 	tools/profiler/TableTicker.cpp
5 	XUL 	TableTicker::InplaceTick(TickSample*) 	tools/profiler/TableTicker.cpp
6 	XUL 	SamplerThread::SampleContext(Sampler*, ThreadProfile*, bool) 	tools/profiler/platform-macos.cc
7 	XUL 	SamplerThread::Run() 	tools/profiler/platform-macos.cc
8 	XUL 	ThreadEntry 	tools/profiler/platform-macos.cc
Ø 9 	libsystem_c.dylib 	libsystem_c.dylib@0x14771 	
Ø 10 	libsystem_c.dylib 	libsystem_c.dylib@0x11a0 	
11 	XUL 	XUL@0x1e9c0bf

Comment 1

[Luke Wagner [:luke]]

Ah hah, thanks for reporting this!  I think this actually *is* the bug introduced by bug 1057082 and fixed by bug 1064668 since the former is present on mozilla-beta (34)
  http://hg.mozilla.org/releases/mozilla-beta/log?rev=24ea34521876
and the latter isn't:
  http://hg.mozilla.org/releases/mozilla-beta/log?rev=5d9c1780c779
(My fault for not realizing this in bug 1069912.)

Can you confirm that you don't see the crashes on FF 35?  I'll put up a patch for mozilla-beta.

Comment 2

[Luke Wagner [:luke]]

I put up a beta patch in bug 1064668.  We can dup this bug to that one assuming positive confirmation to questions in comment 1.

Comment 3

[Luke Wagner [:luke]]

Feel free to reopen if the problem reproduces.