Crash in @ js::gc::GetGCThingTraceKind(void const*)

VERIFIED FIXED in Firefox 41

Status

()

--
critical
VERIFIED FIXED
4 years ago
9 months ago

People

(Reporter: Virtual, Assigned: bhackett)

Tracking

(4 keywords)

41 Branch
mozilla41
x86_64
Windows 7
crash, crashreportid, nightly-community, regression
Points:
---

Firefox Tracking Flags

(firefox40 unaffected, firefox41 verified)

Details

(Whiteboard: [fixed by patch from bug #1166277], crash signature, URL)

That link doesn't crash for me, for what it is worth, on what looks like the 5-19 Nightly.
Instacrash here when opening this URL,
try scrolling maybe.

Mozilla/5.0 (Windows NT 6.1; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0
build ID: 20150519030202
built rev: 4fb7ff694bf5
Could you try using mozregression to get a regression range for this?
This is the top nightly crash in the most recent day. Looks like it spiked on 20150519030202. The 0520 volume is low right now, but maybe that's just because that build is still very new.
https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=35918b0441b4&tochange=4fb7ff694bf5
mccr8 - were you testing with Windows? I don't see crashes from other OSes.
No crash for me.  Running Windows 8.1 x64 and the latest inbound x64-PGO.  e10s on.
(In reply to David Major [:dmajor] from comment #5)
> mccr8 - were you testing with Windows? I don't see crashes from other OSes.

I tried both OSX and Windows 7 without a crash.
(In reply to David Major [:dmajor] from comment #4)
> https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=35918b0441b4&tochange=4fb7ff694bf5

Bug 1162199 is in that range.  I don't have any reason to suspect it specifically, aside from that it is a large change.
Terrence also landed bug 1163810 and bug 1163790, which are more explicitly GC-related changes.
This could also be a dupe of bug 1166542, which has a similar regression range, involves a GC-ish crash, and has a test case on another Google web site, Maps.

Comment 11

4 years ago
Pushlog:
https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=f8d7bb0b4f00&tochange=322487136b28

Trigered by:
322487136b28	Brian Hackett — Bug 1162199 - Use unboxed objects by default, r=jandem.
Thanks Alice!
Blocks: 1162199
Keywords: regression
[Tracking Requested - why for this release]: Regression
status-firefox40: --- → unaffected
tracking-firefox41: --- → ?
Flags: needinfo?(bhackett1024)
(Assignee)

Comment 14

4 years ago
Is this a dupe of bug 1166277?
Flags: needinfo?(bhackett1024)
(In reply to Brian Hackett (:bhackett) from comment #14)
> Is this a dupe of bug 1166277?

Sure looks like it. Alice could you try the revision from that bug?
Flags: needinfo?(alice0775)
I'm going to say yes, based on crash-stats.
Status: NEW → RESOLVED
Last Resolved: 4 years ago
Flags: needinfo?(alice0775)
Resolution: --- → DUPLICATE
Duplicate of bug: 1166277
Given that fix for bug 1166277 landed in moz-central on 05/20 and since that day there are no new crash reports on FF41, I am setting the status flag as "Fixed". I also do not think we need to track this for FF41. Please re-nominate if you disagree.
status-firefox41: affected → fixed
tracking-firefox41: ? → ---
Status: RESOLVED → VERIFIED
status-firefox41: fixed → verified
Resolution: DUPLICATE → FIXED
Whiteboard: [fixed by patch from bug #1166277]
You need to log in before you can comment on or make changes to this bug.