1166730 - Crash in @ js::gc::GetGCThingTraceKind(void const*)

Status: VERIFIED FIXED

(Core :: JavaScript: GC, defect)

Description

[Virtual_ManPL [:Virtual] 🇵🇱 - (please needinfo? me - so I will see your comment/reply/question/etc.)]

STR:
1. Open this URL
https://books.google.pl/books?id=PwuaRNYvwAYC&pg=PA198&lpg=PA198&dq=Coastal+dynamics+geological+processes&source=bl&ots=MRbIWOZlWW&sig=FvzHOnY8wco-NrBYbAlIhwP4TsQ&hl=pl&sa=X&ei=A5BcVe79OoSqsQGt4YCgDQ&ved=0CJ0CEOgBMB4
2. Enjoy the crash

crash log reports:
https://crash-stats.mozilla.com/report/index/146b902b-5617-4bcc-b626-19c042150520
https://crash-stats.mozilla.com/report/index/983e01fd-59a0-41d6-82e0-62d5e2150520

Comment 1

[Andrew McCreight [:mccr8] (PTO until 12-2)]

That link doesn't crash for me, for what it is worth, on what looks like the 5-19 Nightly.

Comment 2

[Virtual_ManPL [:Virtual] 🇵🇱 - (please needinfo? me - so I will see your comment/reply/question/etc.)]

Instacrash here when opening this URL,
try scrolling maybe.

Mozilla/5.0 (Windows NT 6.1; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0
build ID: 20150519030202
built rev: 4fb7ff694bf5

Comment 3

[Andrew McCreight [:mccr8] (PTO until 12-2)]

Could you try using mozregression to get a regression range for this?

Comment 4

[(Away)]

This is the top nightly crash in the most recent day. Looks like it spiked on 20150519030202. The 0520 volume is low right now, but maybe that's just because that build is still very new.
https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=35918b0441b4&tochange=4fb7ff694bf5

Comment 5

[(Away)]

mccr8 - were you testing with Windows? I don't see crashes from other OSes.

Comment 6

[Gary [:streetwolf52]]

No crash for me.  Running Windows 8.1 x64 and the latest inbound x64-PGO.  e10s on.

Comment 7

[Andrew McCreight [:mccr8] (PTO until 12-2)]

(In reply to David Major [:dmajor] from comment #5)
> mccr8 - were you testing with Windows? I don't see crashes from other OSes.

I tried both OSX and Windows 7 without a crash.

Comment 8

[Andrew McCreight [:mccr8] (PTO until 12-2)]

(In reply to David Major [:dmajor] from comment #4)
> https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=35918b0441b4&tochange=4fb7ff694bf5

Bug 1162199 is in that range.  I don't have any reason to suspect it specifically, aside from that it is a large change.

Comment 9

[Andrew McCreight [:mccr8] (PTO until 12-2)]

Terrence also landed bug 1163810 and bug 1163790, which are more explicitly GC-related changes.

Comment 10

[Andrew McCreight [:mccr8] (PTO until 12-2)]

This could also be a dupe of bug 1166542, which has a similar regression range, involves a GC-ish crash, and has a test case on another Google web site, Maps.

Comment 11

[Alice0775 White]

Pushlog:
https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=f8d7bb0b4f00&tochange=322487136b28

Trigered by:
322487136b28	Brian Hackett — Bug 1162199 - Use unboxed objects by default, r=jandem.

Comment 12

[Andrew McCreight [:mccr8] (PTO until 12-2)]

Thanks Alice!

Comment 13

[Virtual_ManPL [:Virtual] 🇵🇱 - (please needinfo? me - so I will see your comment/reply/question/etc.)]

[Tracking Requested - why for this release]: Regression

Comment 14

[Brian Hackett [Laid off!]]

Is this a dupe of bug 1166277?

Comment 15

[(Away)]

(In reply to Brian Hackett (:bhackett) from comment #14)
> Is this a dupe of bug 1166277?

Sure looks like it. Alice could you try the revision from that bug?

Comment 16

[(Away)]

I'm going to say yes, based on crash-stats.

Comment 17

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Given that fix for bug 1166277 landed in moz-central on 05/20 and since that day there are no new crash reports on FF41, I am setting the status flag as "Fixed". I also do not think we need to track this for FF41. Please re-nominate if you disagree.