1174180 - Intermittent test_basic_form_html5.html | application crashed [@ js::jit::RObjectState::recover(JSContext*, js::jit::SnapshotIterator&) const] | 07:25:00 INFO - Assertion failure: (object->as<UnboxedPlainObject>().setValue(cx, properties[i], val)), at /bu

Status: RESOLVED DUPLICATE of bug 1175233

(Core :: JavaScript Engine: JIT, defect)

Description

[Carsten Book [:Tomcat]]

mozilla-inbound_snowleopard-debug_test-mochitest-5

https://treeherder.mozilla.org/logviewer.html#?job_id=10716422&repo=mozilla-inbound

07:25:29 WARNING - PROCESS-CRASH | toolkit/components/passwordmgr/test/test_basic_form_html5.html | application crashed [@ js::jit::RObjectState::recover(JSContext*, js::jit::SnapshotIterator&) const]
07:25:29 INFO - Crash dump filename: /var/folders/gu/guGmOKvYFA8jkJ+NSYJ4MU+++-k/-Tmp-/tmpVhOXp_.mozrunner/minidumps/66CE8384-66C4-4053-96C6-27E382CC0DC4.dmp
07:25:29 INFO - Operating system: Mac OS X
07:25:29 INFO - 10.6.8 10K549
07:25:29 INFO - CPU: amd64
07:25:29 INFO - family 6 model 23 stepping 10
07:25:29 INFO - 2 CPUs
07:25:29 INFO - Crash reason: EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
07:25:29 INFO - Crash address: 0x0
07:25:29 INFO - Thread 0 (crashed)
07:25:29 INFO - 0 XUL!js::jit::RObjectState::recover(JSContext*, js::jit::SnapshotIterator&) const [Recover.cpp:61e83526454d : 1386 + 0x0]
07:25:29 INFO - rbx = 0x00007fff70f082f8 r12 = 0x00007fff5fbf37c0
07:25:29 INFO - r13 = 0x000000011db94150 r14 = 0x000000010d793340
07:25:29 INFO - r15 = 0x000000010d793380 rip = 0x00000001058b1e77
07:25:29 INFO - rsp = 0x00007fff5fbf3700 rbp = 0x00007fff5fbf37a0
07:25:29 INFO - Found by: given as instruction pointer in context
07:25:29 INFO - 1 XUL!js::jit::SnapshotIterator::computeInstructionResults(JSContext*, js::jit::RInstructionResults*) const [JitFrames.cpp:61e83526454d : 2257 + 0x12]
07:25:29 INFO - rbx = 0x0000000000000001 r12 = 0x00007fff5fbf3828
07:25:29 INFO - r13 = 0x00007fff5fbf3808 r14 = 0x00007fff5fbf37c0
07:25:29 INFO - r15 = 0x00000001003be690 rip = 0x00000001057e5bc3
07:25:29 INFO - rsp = 0x00007fff5fbf37b0 rbp = 0x00007fff5fbf3b50
07:25:29 INFO - Found by: call frame info
07:25:29 INFO - 2 XUL!js::jit::SnapshotIterator::initInstructionResults(js::jit::MaybeReadFallback&) [JitFrames.cpp:61e83526454d : 2211 + 0x11]
07:25:29 INFO - rbx = 0x00007fff5fbf3b70 r12 = 0x00007fff5fbf4c50
07:25:29 INFO - r13 = 0x00007fff5fbf3fa8 r14 = 0x00007fff5fbf4a00
07:25:29 INFO - r15 = 0x0000000000000001 rip = 0x00000001057e5114
07:25:29 INFO - rsp = 0x00007fff5fbf3b60 rbp = 0x00007fff5fbf3ef0
07:25:29 INFO - Found by: call frame info
07:25:29 INFO - 3 XUL!js::jit::BailoutIonToBaseline(JSContext*, js::jit::JitActivation*, js::jit::JitFrameIterator&, bool, js::jit::BaselineBailoutInfo**, js::jit::ExceptionBailoutInfo const*) [BaselineBailouts.cpp:61e83526454d : 436 + 0x4]
07:25:29 INFO - rbx = 0x00000001003be690 r12 = 0x00007fff5fbf4450
07:25:29 INFO - r13 = 0x00000001003be690 r14 = 0x00007fff5fbf4450
07:25:29 INFO - r15 = 0x0000000000000001 rip = 0x00000001056a6fe1
07:25:29 INFO - rsp = 0x00007fff5fbf3f00 rbp = 0x00007fff5fbf4440
07:25:29 INFO - Found by: call frame info
07:25:29 INFO - 4 XUL!js::jit::InvalidationBailout(js::jit::InvalidationBailoutStack*, unsigned long*, js::jit::BaselineBailoutInfo**) [Bailouts.cpp:61e83526454d : 129 + 0x12]
07:25:29 INFO - rbx = 0x00007fff5fbf4728 r12 = 0x00007fff5fbf4a00
07:25:29 INFO - r13 = 0x00000001003be690 r14 = 0x00007fff5fbf4788
07:25:29 INFO - r15 = 0x00007fff5fbf4780 rip = 0x00000001056a7b71
07:25:29 INFO - rsp = 0x00007fff5fbf4450 rbp = 0x00007fff5fbf4760
07:25:29 INFO - Found by: call frame info
07:25:29 INFO - 5 0x1007c1a8e
07:25:29 INFO - rbx = 0x00007fff5fbf4788 r12 = 0x0000000000000008
07:25:29 INFO - r13 = 0x00007fff5fbf58b8 r14 = 0x000000011db940e0 

07:25:00 INFO - Assertion failure: (object->as<UnboxedPlainObject>().setValue(cx, properties[i], val)), at /builds/slave/m-in-m64-d-0000000000000000000/build/src/js/src/jit/Recover.cpp:1386

Comment 1

[Legacy TBPL/Treeherder Robot]

log: https://treeherder.mozilla.org/logviewer.html#?repo=mozilla-inbound&job_id=10716422
repository: mozilla-inbound
start_time: 2015-06-12T07:06:56
who: tomcat[at]mozilla[dot]com
machine: t-snow-r4-0079
buildname: Rev4 MacOSX Snow Leopard 10.6 mozilla-inbound debug test mochitest-5
revision: 61e83526454d

Assertion failure: (object->as<UnboxedPlainObject>().setValue(cx, properties[i], val)), at /builds/slave/m-in-m64-d-0000000000000000000/build/src/js/src/jit/Recover.cpp:1386
TEST-UNEXPECTED-FAIL | toolkit/components/passwordmgr/test/test_basic_form_html5.html | application terminated with exit code 1
PROCESS-CRASH | toolkit/components/passwordmgr/test/test_basic_form_html5.html | application crashed [@ js::jit::RObjectState::recover(JSContext*, js::jit::SnapshotIterator&) const]
TEST-UNEXPECTED-FAIL | leakcheck | default process: missing output line for total leaks!
Return code: 1
No tests run or test summary not found

Comment 2

[Legacy TBPL/Treeherder Robot]

log: https://treeherder.mozilla.org/logviewer.html#?repo=mozilla-central&job_id=1655701
repository: mozilla-central
start_time: 2015-06-13T20:27:42
who: philringnalda[at]gmail[dot]com
machine: t-yosemite-r5-0011
buildname: Rev5 MacOSX Yosemite 10.10 mozilla-central debug test mochitest-2
revision: c223b8844264

Assertion failure: (object->as<UnboxedPlainObject>().setValue(cx, properties[i], val)), at /builds/slave/m-cen-m64-d-000000000000000000/build/src/js/src/jit/Recover.cpp:1386
TEST-UNEXPECTED-FAIL | dom/imptests/html/dom/ranges/test_Range-insertNode.html | application terminated with exit code 1
PROCESS-CRASH | dom/imptests/html/dom/ranges/test_Range-insertNode.html | application crashed [@ js::jit::RObjectState::recover(JSContext*, js::jit::SnapshotIterator&) const]
TEST-UNEXPECTED-FAIL | leakcheck | default process: missing output line for total leaks!
Return code: 1
No tests run or test summary not found

Comment 3

[Legacy TBPL/Treeherder Robot]

log: https://treeherder.mozilla.org/logviewer.html#?repo=b2g-inbound&job_id=2157360
repository: b2g-inbound
start_time: 2015-06-13T20:32:56
who: philringnalda[at]gmail[dot]com
machine: t-snow-r4-0130
buildname: Rev4 MacOSX Snow Leopard 10.6 b2g-inbound debug test xpcshell
revision: c223b8844264

TEST-UNEXPECTED-FAIL | toolkit/components/passwordmgr/test/unit/test_logins_search.js | xpcshell return code: 1
PROCESS | 4895 | Assertion failure: (object->as<UnboxedPlainObject>().setValue(cx, properties[i], val)), at /builds/slave/b2g-in-m64-d-00000000000000000/build/src/js/src/jit/Recover.cpp:1386
PROCESS-CRASH | toolkit/components/passwordmgr/test/unit/test_logins_search.js | application crashed [@ js::jit::RObjectState::recover(JSContext*, js::jit::SnapshotIterator&) const]
Return code: 1

Comment 4

[Legacy TBPL/Treeherder Robot]

log: https://treeherder.mozilla.org/logviewer.html#?repo=fx-team&job_id=3452872
repository: fx-team
start_time: 2015-06-14T01:30:18
who: philringnalda[at]gmail[dot]com
machine: tst-linux64-spot-256
buildname: Ubuntu VM 12.04 x64 fx-team debug test mochitest-2
revision: 19ba04cd72c2

Assertion failure: (object->as<UnboxedPlainObject>().setValue(cx, properties[i], val)), at /builds/slave/fx-team-l64-d-0000000000000000/build/src/js/src/jit/Recover.cpp:1386
TEST-UNEXPECTED-FAIL | dom/imptests/html/dom/ranges/test_Range-surroundContents.html | application terminated with exit code 11
PROCESS-CRASH | dom/imptests/html/dom/ranges/test_Range-surroundContents.html | application crashed [@ js::jit::RObjectState::recover(JSContext*, js::jit::SnapshotIterator&) const]
TEST-UNEXPECTED-FAIL | leakcheck | default process: missing output line for total leaks!
Return code: 1
No tests run or test summary not found

Comment 5

[Legacy TBPL/Treeherder Robot]

log: https://treeherder.mozilla.org/logviewer.html#?repo=mozilla-inbound&job_id=10765142
repository: mozilla-inbound
start_time: 2015-06-14T07:37:34
who: philringnalda[at]gmail[dot]com
machine: tst-linux64-spot-2024
buildname: Ubuntu VM 12.04 x64 mozilla-inbound debug test mochitest-2
revision: 5bab2734cb2e

Assertion failure: (object->as<UnboxedPlainObject>().setValue(cx, properties[i], val)), at /builds/slave/m-in-l64-d-0000000000000000000/build/src/js/src/jit/Recover.cpp:1386
TEST-UNEXPECTED-FAIL | dom/imptests/html/dom/ranges/test_Range-surroundContents.html | application terminated with exit code 11
PROCESS-CRASH | dom/imptests/html/dom/ranges/test_Range-surroundContents.html | application crashed [@ js::jit::RObjectState::recover(JSContext*, js::jit::SnapshotIterator&) const]
TEST-UNEXPECTED-FAIL | leakcheck | default process: missing output line for total leaks!
Return code: 1
No tests run or test summary not found

Comment 6

[Legacy TBPL/Treeherder Robot]

log: https://treeherder.mozilla.org/logviewer.html#?repo=b2g-inbound&job_id=2168242
repository: b2g-inbound
start_time: 2015-06-15T19:30:48
who: philringnalda[at]gmail[dot]com
machine: tst-linux32-spot-551
buildname: Ubuntu VM 12.04 b2g-inbound debug test mochitest-2
revision: f42cf1d7c1bb

Assertion failure: (object->as<UnboxedPlainObject>().setValue(cx, properties[i], val)), at /builds/slave/b2g-in-lx-d-000000000000000000/build/src/js/src/jit/Recover.cpp:1386
TEST-UNEXPECTED-FAIL | dom/imptests/html/dom/ranges/test_Range-surroundContents.html | application terminated with exit code 11
PROCESS-CRASH | dom/imptests/html/dom/ranges/test_Range-surroundContents.html | application crashed [@ js::jit::RObjectState::recover(JSContext*, js::jit::SnapshotIterator&) const]
TEST-UNEXPECTED-FAIL | leakcheck | default process: missing output line for total leaks!
Return code: 1
No tests run or test summary not found

Comment 7

[Legacy TBPL/Treeherder Robot]

log: https://treeherder.mozilla.org/logviewer.html#?repo=mozilla-inbound&job_id=10811575
repository: mozilla-inbound
start_time: 2015-06-15T20:23:25
who: philringnalda[at]gmail[dot]com
machine: tst-linux64-spot-1036
buildname: Ubuntu VM 12.04 x64 mozilla-inbound debug test mochitest-e10s-2
revision: 6fc0cc353d24

Assertion failure: (object->as<UnboxedPlainObject>().setValue(cx, properties[i], val)), at /builds/slave/m-in-l64-d-0000000000000000000/build/src/js/src/jit/Recover.cpp:1386
TEST-UNEXPECTED-TIMEOUT | dom/imptests/html/dom/ranges/test_Range-insertNode.html | application timed out after 330 seconds with no output
TEST-UNEXPECTED-FAIL | dom/imptests/html/dom/ranges/test_Range-insertNode.html | application terminated with exit code 6
PROCESS-CRASH | dom/imptests/html/dom/ranges/test_Range-insertNode.html | application crashed [@ js::jit::RObjectState::recover(JSContext*, js::jit::SnapshotIterator&) const]
PROCESS-CRASH | dom/imptests/html/dom/ranges/test_Range-insertNode.html | application crashed [@ libc-2.15.so + 0xe8933]
TEST-UNEXPECTED-FAIL | leakcheck | default process: missing output line for total leaks!
TEST-UNEXPECTED-FAIL | leakcheck | tab process: missing output line for total leaks!
Return code: 1
No tests run or test summary not found

Comment 8

[Nicolas B. Pierron [:nbp]]

This is probably a duplicate of Bug 1174322.

Comment 9

[Legacy TBPL/Treeherder Robot]

log: https://treeherder.mozilla.org/logviewer.html#?repo=mozilla-inbound&job_id=10851519
repository: mozilla-inbound
start_time: 2015-06-16T15:47:23
who: wkocher[at]mozilla[dot]com
machine: t-snow-r4-0038
buildname: Rev4 MacOSX Snow Leopard 10.6 mozilla-inbound debug test xpcshell
revision: f50a771d7d1b

TEST-UNEXPECTED-FAIL | toolkit/components/passwordmgr/test/unit/test_logins_search.js | xpcshell return code: 1
PROCESS | 4937 | Assertion failure: (object->as<UnboxedPlainObject>().setValue(cx, properties[i], val)), at /builds/slave/m-in-m64-d-0000000000000000000/build/src/js/src/jit/Recover.cpp:1386
PROCESS-CRASH | toolkit/components/passwordmgr/test/unit/test_logins_search.js | application crashed [@ js::jit::RObjectState::recover(JSContext*, js::jit::SnapshotIterator&) const]
Return code: 1

Comment 10

[Legacy TBPL/Treeherder Robot]

log: https://treeherder.mozilla.org/logviewer.html#?repo=mozilla-inbound&job_id=10854043
repository: mozilla-inbound
start_time: 2015-06-16T16:24:14
who: philringnalda[at]gmail[dot]com
machine: tst-emulator64-spot-372
buildname: Android 4.3 armv7 API 11+ mozilla-inbound debug test mochitest-8
revision: 6c05b6375d9f

PROCESS-CRASH | dom/imptests/html/dom/ranges/test_Range-surroundContents.html | application crashed [@ js::jit::RObjectState::recover]
06-16 16:40:05.755 F/MOZ_Assert(  739): Assertion failure: (object->as<UnboxedPlainObject>().setValue(cx, properties[i], val)), at /builds/slave/m-in-and-api-11-d-000000000000/build/src/js/src/jit/Recover.cpp:1386
Return code: 1
No tests run or test summary not found

Comment 11

[Legacy TBPL/Treeherder Robot]

log: https://treeherder.mozilla.org/logviewer.html#?repo=b2g-inbound&job_id=2179542
repository: b2g-inbound
start_time: 2015-06-16T18:00:13
who: philringnalda[at]gmail[dot]com
machine: tst-linux64-spot-211
buildname: Ubuntu VM 12.04 x64 b2g-inbound debug test mochitest-e10s-2
revision: c5bbc9ae05ed

Assertion failure: (object->as<UnboxedPlainObject>().setValue(cx, properties[i], val)), at /builds/slave/b2g-in-l64-d-00000000000000000/build/src/js/src/jit/Recover.cpp:1386
TEST-UNEXPECTED-TIMEOUT | dom/imptests/html/dom/ranges/test_Range-surroundContents.html | application timed out after 330 seconds with no output
TEST-UNEXPECTED-FAIL | dom/imptests/html/dom/ranges/test_Range-surroundContents.html | application terminated with exit code 6
PROCESS-CRASH | dom/imptests/html/dom/ranges/test_Range-surroundContents.html | application crashed [@ libc-2.15.so + 0xe8933]
PROCESS-CRASH | dom/imptests/html/dom/ranges/test_Range-surroundContents.html | application crashed [@ js::jit::RObjectState::recover(JSContext*, js::jit::SnapshotIterator&) const]
TEST-UNEXPECTED-FAIL | leakcheck | default process: missing output line for total leaks!
TEST-UNEXPECTED-FAIL | leakcheck | tab process: missing output line for total leaks!
Return code: 1
No tests run or test summary not found

Comment 12

[Legacy TBPL/Treeherder Robot]

log: https://treeherder.mozilla.org/logviewer.html#?repo=mozilla-central&job_id=1672650
repository: mozilla-central
start_time: 2015-06-16T18:02:14
who: philringnalda[at]gmail[dot]com
machine: tst-linux64-spot-017
buildname: Ubuntu VM 12.04 x64 mozilla-central debug test mochitest-2
revision: d7c148c84594

Assertion failure: (object->as<UnboxedPlainObject>().setValue(cx, properties[i], val)), at /builds/slave/m-cen-l64-d-000000000000000000/build/src/js/src/jit/Recover.cpp:1386
TEST-UNEXPECTED-FAIL | dom/imptests/html/dom/ranges/test_Range-surroundContents.html | application terminated with exit code 11
PROCESS-CRASH | dom/imptests/html/dom/ranges/test_Range-surroundContents.html | application crashed [@ js::jit::RObjectState::recover(JSContext*, js::jit::SnapshotIterator&) const]
TEST-UNEXPECTED-FAIL | leakcheck | default process: missing output line for total leaks!
Return code: 1
No tests run or test summary not found

Comment 13

[Nicolas B. Pierron [:nbp]]

This issue should be fixed by either Bug 1174322, or Bug 1175233.