frequent crashes in TI code when using Shumway in recent Nightlies

RESOLVED FIXED in Firefox 41

Status

()

RESOLVED FIXED
3 years ago
3 years ago

People

(Reporter: till, Assigned: bhackett)

Tracking

(Blocks: 1 bug)

Trunk
mozilla41
Points:
---

Firefox Tracking Flags

(firefox41 fixed)

Details

(crash signature, URL)

Attachments

(1 attachment)

(Reporter)

Description

3 years ago
When loading the linked URL in recent Nightlies, I get frequent crashes with the given signatures. Reports include:

https://crash-stats.mozilla.com/report/index/f9aefa3f-9f44-41e1-8033-d39222150618
https://crash-stats.mozilla.com/report/index/6d1d5228-da86-499c-9061-050432150618
https://crash-stats.mozilla.com/report/index/d6165e24-a6e5-4205-871c-94c9a2150618

Brian, is bug 1162986 a likely candidate for causing this? Yury's mozregression run indicates it is within the regression range.
Flags: needinfo?(bhackett1024)
20:32.20 LOG: MainThread Bisector INFO Last good revision: dd39dc238ef1
20:32.20 LOG: MainThread Bisector INFO First bad revision: ce863f9d8864
20:32.20 LOG: MainThread Bisector INFO Pushlog:
https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=dd39dc238ef1&tochange=ce863f9d8864
(Assignee)

Comment 2

3 years ago
I can't reproduce this crash.
(Reporter)

Comment 3

3 years ago
(In reply to Brian Hackett (:bhackett) from comment #2)
> I can't reproduce this crash.

I just tried with the current Nightly and a clean profile: after a few (in this case: three) reloads, each after letting the page run for maybe a second or two, the tab crashed. With e10s disabled, a crash occurred after the first reload.
(Assignee)

Comment 4

3 years ago
Created attachment 8625105 [details] [diff] [review]
patch

OK, thanks, I was eventually able to get this to reproduce.  After bug 1162986 we need to take care during IonBuilder to look for nursery objects when reading prototypes off a group or object, as the existence of prototype nursery objects does not mean compilations will automatically be canceled by minor GCs.  So there are these checkNurseryObject calls sprinkled around IonBuilder, and I missed a spot where this was needed (I don't see any others like this, though).
Assignee: nobody → bhackett1024
Flags: needinfo?(bhackett1024)
Attachment #8625105 - Flags: review?(jdemooij)

Updated

3 years ago
Attachment #8625105 - Flags: review?(jdemooij) → review+
https://hg.mozilla.org/mozilla-central/rev/a195a8127e8d
Status: NEW → RESOLVED
Last Resolved: 3 years ago
status-firefox41: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla41
You need to log in before you can comment on or make changes to this bug.