Closed Bug 1087828 Opened 9 years ago Closed 9 years ago

Intermittent regress-436741.js | application crashed [@ js::types::TypeObject::addFlags(unsigned int)]

Categories

(Core :: JavaScript Engine: JIT, defect)

Product:
Core
Component:
JavaScript Engine: JIT
Version:
36 Branch
Platform:
x86_64
Linux
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla36
Tracking Flags:
Tracking Status
firefox34 --- unaffected
firefox35 --- unaffected
firefox36 --- fixed
firefox-esr31 --- unaffected

People

(Reporter: KWierso, Assigned: bhackett1024)

Details

(Keywords: crash, intermittent-failure)

Attachments

(1 file)

patch
661 bytes, patch
billm
: review+
Details | Diff | Splinter Review 
https://treeherder.mozilla.org/ui/logviewer.html#?job_id=3224979&repo=mozilla-inbound
builder 	Ubuntu VM 12.04 x64 mozilla-inbound debug test jsreftest
buildid 	20141022131919
builduid 	e23b80e2aae3412684e169dc909f605b
results 	warnings (1)
revision 	f0520d8ed4ed
slave 	tst-linux64-spot-981
starttime 	Wed Oct 22 2014 13:37:35 GMT-0700 (Pacific Standard Time)



13:55:16 INFO - REFTEST TEST-START | file:///builds/slave/test/build/tests/jsreftest/tests/jsreftest.html?test=js1_5/extensions/regress-436741.js
13:55:16 INFO - REFTEST TEST-LOAD | file:///builds/slave/test/build/tests/jsreftest/tests/jsreftest.html?test=js1_5/extensions/regress-436741.js | 2411 / 6851 (35%)
13:55:16 INFO - ++DOMWINDOW == 78 (0x7f601bf14400) [pid = 1812] [serial = 4575] [outer = 0x7f601ed67c00]
13:55:16 INFO - TEST-INFO | BUGNUMBER: 436741
13:55:16 INFO - TEST-INFO | STATUS: Do not assert: OBJ_IS_NATIVE(obj)
13:55:16 INFO - JavaScript warning: file:///builds/slave/test/build/tests/jsreftest/tests/js1_5/extensions/regress-436741.js, line 29: mutating the [[Prototype]] of an object will cause your code to run very slowly; instead create the object with the correct initial [[Prototype]] value using Object.create
13:55:16 INFO - Assertion failure: !needsSweep(), at /builds/slave/m-in-l64-d-0000000000000000000/build/js/src/jsinfer.h:1109
13:55:17 WARNING - TEST-UNEXPECTED-FAIL | file:///builds/slave/test/build/tests/jsreftest/tests/jsreftest.html?test=js1_5/extensions/regress-436741.js | application terminated with exit code 11
13:55:25 INFO - mozcrash INFO | Saved minidump as /builds/slave/test/build/blobber_upload_dir/013eb07c-2cd4-8798-46a38686-6a3583fb.dmp
13:55:25 INFO - mozcrash INFO | Saved app info as /builds/slave/test/build/blobber_upload_dir/013eb07c-2cd4-8798-46a38686-6a3583fb.extra
13:55:25 WARNING - PROCESS-CRASH | file:///builds/slave/test/build/tests/jsreftest/tests/jsreftest.html?test=js1_5/extensions/regress-436741.js | application crashed [@ js::types::TypeObject::addFlags(unsigned int)]
13:55:25 INFO - Crash dump filename: /tmp/tmpFZ6DwC.mozrunner/minidumps/013eb07c-2cd4-8798-46a38686-6a3583fb.dmp
13:55:25 INFO - Operating system: Linux
13:55:25 INFO - 0.0.0 Linux 3.2.0-23-generic #36-Ubuntu SMP Tue Apr 10 20:39:51 UTC 2012 x86_64
13:55:25 INFO - CPU: amd64
13:55:25 INFO - family 6 model 62 stepping 4
13:55:25 INFO - 1 CPU
13:55:25 INFO - Crash reason: SIGSEGV
13:55:25 INFO - Crash address: 0x0
13:55:25 INFO - Thread 0 (crashed)
13:55:25 INFO - 0 libxul.so!js::types::TypeObject::addFlags(unsigned int) [jsinfer.h:f0520d8ed4ed : 1109 + 0x5]
13:55:25 INFO - rbx = 0x0000000000000000 r12 = 0x00007f600f7d0c10
13:55:25 INFO - r13 = 0x00007f601ec7f000 r14 = 0x0000000000000002
13:55:25 INFO - r15 = 0x00007f6044078de0 rip = 0x00007f6041d75d18
13:55:25 INFO - rsp = 0x00007fffcacfd5c0 rbp = 0x00007fffcacfd5c0
13:55:25 INFO - Found by: given as instruction pointer in context
13:55:25 INFO - 1 libxul.so!js::types::TypeObject::addFlags(unsigned int) [jsinfer.h:f0520d8ed4ed : 1111 + 0x1b]
13:55:25 INFO - rbx = 0x0000000000000000 r12 = 0x00007f600f7d0c10
13:55:25 INFO - r13 = 0x00007f601ec7f000 r14 = 0x0000000000000002
13:55:25 INFO - r15 = 0x00007f6044078de0 rip = 0x00007f6041d7eafe
13:55:25 INFO - rsp = 0x00007fffcacfd5d0 rbp = 0x00007fffcacfd5f0
13:55:25 INFO - Found by: call frame info
13:55:25 INFO - 2 libxul.so!js::types::TypeObject::setProto(JSContext*, js::TaggedProto) [jsinfer.cpp:f0520d8ed4ed : 2910 + 0xc]
13:55:25 INFO - rbx = 0x00007f600f7d0c10 r12 = 0x00007f6030d08ab0
13:55:25 INFO - r13 = 0x00007fffcacfd660 r14 = 0x00007f6028c9caa0
13:55:25 INFO - r15 = 0x00007f6044078de0 rip = 0x00007f6041da3269
13:55:25 INFO - rsp = 0x00007fffcacfd600 rbp = 0x00007fffcacfd620
13:55:25 INFO - Found by: call frame info
13:55:25 INFO - 3 libxul.so!JSObject::splicePrototype(JSContext*, js::Class const*, JS::Handle<js::TaggedProto>) [jsinfer.cpp:f0520d8ed4ed : 4251 + 0x4]
13:55:25 INFO - rbx = 0x0000000000000001 r12 = 0x00007fffcacfd640
13:55:25 INFO - r13 = 0x00007fffcacfd660 r14 = 0x00007f6028c9caa0
13:55:25 INFO - r15 = 0x00007f6044078de0 rip = 0x00007f6041e1b43e
13:55:25 INFO - rsp = 0x00007fffcacfd630 rbp = 0x00007fffcacfd6d0
13:55:25 INFO - Found by: call frame info
13:55:25 INFO - 4 libxul.so!js::SetClassAndProto(JSContext*, JS::Handle<JSObject*>, js::Class const*, JS::Handle<js::TaggedProto>) [jsobj.cpp:f0520d8ed4ed : 2799 + 0xe]
13:55:25 INFO - rbx = 0x00007f6028c9caa0 r12 = 0x00007fffcacfd8c0
13:55:25 INFO - r13 = 0x00007fffcacfd700 r14 = 0x00007f6044078de0
13:55:25 INFO - r15 = 0x00007fffcacfd7b0 rip = 0x00007f6041e1b6e2
13:55:25 INFO - rsp = 0x00007fffcacfd6e0 rbp = 0x00007fffcacfd760
13:55:25 INFO - Found by: call frame info
13:55:25 INFO - 5 libxul.so!JSObject::setProto(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, bool*) [jsobjinlines.h:f0520d8ed4ed : 242 + 0x7]
13:55:25 INFO - rbx = 0x00007fffcacfd8c0 r12 = 0x00007fffcacfd840
13:55:25 INFO - r13 = 0x00007fffcacfd8e0 r14 = 0x00007f6028c9caa0
13:55:25 INFO - r15 = 0x00007fffcacfd7b0 rip = 0x00007f60419bd1f3
13:55:25 INFO - rsp = 0x00007fffcacfd770 rbp = 0x00007fffcacfd810
13:55:25 INFO - Found by: call frame info
13:55:25 INFO - 6 libxul.so!ProtoSetter [Object.cpp:f0520d8ed4ed : 1157 + 0x4]
13:55:25 INFO - rbx = 0x00007fffcacfe008 r12 = 0x00007fffcacfd890
13:55:25 INFO - r13 = 0x00007fffcacfe010 r14 = 0x00007fffcacfe018
13:55:25 INFO - r15 = 0x00007f6028c9caa0 rip = 0x00007f60419c45e9
13:55:25 INFO - rsp = 0x00007fffcacfd820 rbp = 0x00007fffcacfd920
13:55:25 INFO - Found by: call frame info
13:55:25 INFO - 7 libxul.so!js::CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&) [jscntxtinlines.h:f0520d8ed4ed : 231 + 0x13]
13:55:25 INFO - rbx = 0x00007f6028c9caa0 r12 = 0x00007fffcacfdf40
13:55:25 INFO - r13 = 0x0000000000000000 r14 = 0x00007f60419c4390
13:55:25 INFO - r15 = 0x00007fffcacfe0c0 rip = 0x00007f6041e79e29
13:55:25 INFO - rsp = 0x00007fffcacfd930 rbp = 0x00007fffcacfd980
13:55:25 INFO - Found by: call frame info
13:55:25 INFO - 8 libxul.so!js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) [Interpreter.cpp:f0520d8ed4ed : 482 + 0xf]
13:55:25 INFO - rbx = 0x00007f6028c9caa0 r12 = 0x0000000000000000
13:55:25 INFO - r13 = 0x00007f6028c9caa0 r14 = 0x00007f6044251c20
13:55:25 INFO - r15 = 0x00007fffcacfe0c0 rip = 0x00007f6041ed4c20
13:55:25 INFO - rsp = 0x00007fffcacfd990 rbp = 0x00007fffcacfdf30
13:55:25 INFO - Found by: call frame info
13:55:25 INFO - 9 libxul.so!js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value const*, JS::MutableHandle<JS::Value>) [Interpreter.cpp:f0520d8ed4ed : 538 + 0x2a]
13:55:25 INFO - rbx = 0x00007fffcacfdfc8 r12 = 0x0000000000000001
13:55:25 INFO - r13 = 0x00007f6028c9caa0 r14 = 0x00007fffcacfe0a0
13:55:25 INFO - r15 = 0x00007fffcacfe0c0 rip = 0x00007f6041ed5a75
13:55:25 INFO - rsp = 0x00007fffcacfdf40 rbp = 0x00007fffcacfe090
13:55:25 INFO - Found by: call frame info
13:55:25 INFO - 10 libxul.so!js::InvokeGetterOrSetter(JSContext*, JSObject*, JS::Value, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) [Interpreter.cpp:f0520d8ed4ed : 611 + 0x1c]
13:55:25 INFO - rbx = 0x00007f6028c9caa0 r12 = 0x00007fffcacfe0bc
13:55:25 INFO - r13 = 0x00007fffcacfe840 r14 = 0x00007fffcacfe840
13:55:25 INFO - r15 = 0x00007f600f7c1020 rip = 0x00007f6041ed5bf5
13:55:25 INFO - rsp = 0x00007fffcacfe0a0 rbp = 0x00007fffcacfe100
13:55:25 INFO - Found by: call frame info
13:55:25 INFO - 11 libxul.so!js::CallSetter(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, bool (*)(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, bool, JS::MutableHandle<JS::Value>), unsigned int, bool, JS::MutableHandle<JS::Value>) [jscntxtinlines.h:f0520d8ed4ed : 334 + 0x4]
13:55:25 INFO - rbx = 0x00007f6028c9caa0 r12 = 0x00007fffcacfe960
13:55:25 INFO - r13 = 0x00007fffcacfe230 r14 = 0x00007f6028c9caa0
13:55:25 INFO - r15 = 0x00007fffcacfe240 rip = 0x00007f6041e43bfe
13:55:25 INFO - rsp = 0x00007fffcacfe110 rbp = 0x00007fffcacfe160
13:55:25 INFO - Found by: call frame info
13:55:25 INFO - 12 libxul.so!bool js::baseops::SetPropertyHelper<(js::ExecutionMode)0>(js::ExecutionModeTraits<(js::ExecutionMode)0>::ContextType, JS::Handle<js::NativeObject*>, JS::Handle<JSObject*>, JS::Handle<jsid>, js::baseops::QualifiedBool, JS::MutableHandle<JS::Value>, bool) [NativeObject.cpp:f0520d8ed4ed : 1973 + 0x2c]
13:55:25 INFO - rbx = 0x00007fffcacfe960 r12 = 0x00007fffcacfe250
13:55:25 INFO - r13 = 0x00007fffcacfe230 r14 = 0x00007f6028c9caa0
13:55:25 INFO - r15 = 0x00007fffcacfe240 rip = 0x00007f6041ed9083
13:55:25 INFO - rsp = 0x00007fffcacfe170 rbp = 0x00007fffcacfe300
13:55:25 INFO - Found by: call frame info
13:55:25 INFO - 13 libxul.so!Interpret [Interpreter.cpp:f0520d8ed4ed : 327 + 0x2e]
13:55:25 INFO - rbx = 0x00007f6028c9caa0 r12 = 0x00007f6043ecda20
13:55:25 INFO - r13 = 0x0000000000000000 r14 = 0x00007fffcacfebf0
13:55:25 INFO - r15 = 0x00007fffcacfe960 rip = 0x00007f6041eca712
13:55:25 INFO - rsp = 0x00007fffcacfe310 rbp = 0x00007fffcacfeb10
13:55:25 INFO - Found by: call frame info
13:55:25 INFO - 14 libxul.so!js::RunScript(JSContext*, js::RunState&) [Interpreter.cpp:f0520d8ed4ed : 432 + 0xa]
13:55:25 INFO - rbx = 0x00007f6028c9caa0 r12 = 0x00007fffcacfebf0
13:55:25 INFO - r13 = 0x00007fffcacfeb30 r14 = 0x00007fffcacfede0
13:55:25 INFO - r15 = 0x0000000000000000 rip = 0x00007f6041ed3f88
13:55:25 INFO - rsp = 0x00007fffcacfeb20 rbp = 0x00007fffcacfeb80
13:55:25 INFO - Found by: call frame info
13:55:25 INFO - 15 libxul.so!js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value const&, js::ExecuteType, js::AbstractFramePtr, JS::Value*) [Interpreter.cpp:f0520d8ed4ed : 638 + 0xe]
13:55:25 INFO - rbx = 0x00007fffcacfecf0 r12 = 0x00007f6028c9caa0
13:55:25 INFO - r13 = 0x0000000000000001 r14 = 0x00007fffcacfede0
13:55:25 INFO - r15 = 0x0000000000000000 rip = 0x00007f6041ed4138
13:55:25 INFO - rsp = 0x00007fffcacfeb90 rbp = 0x00007fffcacfecb0
13:55:25 INFO - Found by: call frame info
Jan, can you please help us find an owner?
Component: JavaScript Engine → JavaScript Engine: JIT
Flags: needinfo?(jdemooij)
Bug 1072564 comes to mind, this started shortly after that patch landed.
Flags: needinfo?(jdemooij) → needinfo?(bhackett1024)
Attached patch patch — — Splinter Review 
Assignee: nobody → bhackett1024
Flags: needinfo?(bhackett1024)

        Attachment #8510719 -
        Flags: review?(wmccloskey)

        Attachment #8510719 -
        Flags: review?(wmccloskey) → review+

    
    

    
      
  

    
    

    
      
  

    
    

    
  
https://hg.mozilla.org/mozilla-central/rev/e94b66dca22c
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla36

          You need to log in
          before you can comment on or make changes to this bug.