1166277 - Crash [@ js::gc::StoreBuffer::MonoTypeBuffer<js::gc::StoreBuffer::WholeCellEdges>::trace(js::gc::StoreBuffer*, js::TenuringTracer&) ]

Status: VERIFIED FIXED

(Core :: JavaScript: GC, defect)

Description

[Robin Whittleton]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:41.0) Gecko/20100101 Firefox/41.0
Build ID: 20150519030202

Steps to reproduce:

Visited Google Maps, searched for ‘Maldives’, zoomed one level


Actual results:

Bang.


Expected results:

No bang. Example crash log: https://crash-stats.mozilla.com/report/index/c520bd6a-8af1-4d5a-914b-b7fa32150519

I’m on a MacBook Air with ‘Intel HD Graphics 5000 1536 MB’ if it’s a WebGL problem. There don’t seem to be any other reports, but it happened to me twice in quick succession.

Comment 1

[Benjamin Bouvier [:bbouvier] (inactive)]

Could reproduce after loading a few tabs very quickly, searching for "maldives", zooming in and out, and then switching to a GMail tab.

bp-4ce6df97-9582-4775-90c2-074f12150519
bp-d9dbf443-f532-4252-b492-0bcc32150519
bp-e259b5f7-2951-4d0a-867d-c317d2150519

Comment 2

[Benjamin Bouvier [:bbouvier] (inactive)]

(note that the first crash also shows js::UnboxedPlainObject::create in the backtrace, and the latest nightly has unboxed objects by default)

Comment 3

[Brian Hackett [Laid off!]]

Attachment: patch

I think this will fix the problem.  Ion was triggering post barriers for boxed objects instead of actual object pointers, because of a bug in the code which adds post barriers for writes to object properties of unboxed and typed objects.

Comment 4

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/36ff3229daff

Comment 5

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/36ff3229daff

Comment 8

[u279076]

Just updating the keywords based on the duped bug.

Comment 10

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Benjamin, could you please confirm whether this bug is fixed in the latest nightly build or not? Adding a tracking flag for FF41 to ensure QE team verifies the fix.

Comment 11

[Benjamin Bouvier [:bbouvier] (inactive)]

I can't reproduce the crash I was seeing on google maps with the latest nightly, so that looks fixed.

Comment 12

[u279076]

Thanks for the help, Benjamin. Marking this verified fixed based on Benjamin's result in comment 11.