1180989 - Crash in js::TypeMonitorResult(JSContext*, JSScript*, unsigned char*, JS::Value const&)

Status: RESOLVED INVALID

(Core :: JavaScript Engine: JIT, defect, P3)

Description

[Maire Reavy [:mreavy]]

See https://crash-stats.mozilla.com/report/index/926dd2c1-fbe7-468d-86d1-3779d2150707

~1100 crashes in the last month with this signature

Not sure if the stacks match or not

Crashing Thread
Frame 	Module 	Signature 	Source
0 	XUL 	js::TypeMonitorResult(JSContext*, JSScript*, unsigned char*, JS::Value const&) 	js/src/vm/ObjectGroup.h
1 	XUL 	js::jit::DoTypeMonitorFallback 	js/src/vm/TypeInference-inl.h
2 		@0x1094dda5b 	
3 		@0x1094d684e 	
4 	XUL 	EnterBaseline 	js/src/jit/BaselineJIT.cpp
5 	XUL 	js::jit::EnterBaselineMethod(JSContext*, js::RunState&) 	js/src/jit/BaselineJIT.cpp
6 	XUL 	Interpret 	js/src/vm/Interpreter.cpp
7 	XUL 	js::RunScript(JSContext*, js::RunState&) 	js/src/vm/Interpreter.cpp
8 	XUL 	js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
9 	XUL 	js::fun_call(JSContext*, unsigned int, JS::Value*) 	js/src/jsfun.cpp
10 	XUL 	js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) 	js/src/jscntxtinlines.h
11 	XUL 	Interpret 	js/src/vm/Interpreter.cpp

Comment 1

[Wayne Mery (:wsmwk)]

none in the last week
https://crash-stats.mozilla.com/search/?signature=~js%3A%3ATypeMonitorResult%28JSContext&_facets=signature&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=platform&_columns=email&_columns=user_comments

However, there are for js::TypeMonitorResult. But 60+% are Fennec. For the firefox only crowd, a mere 100 crashes in 7 dates https://crash-stats.mozilla.com/search/?signature=%3Djs%3A%3ATypeMonitorResult&product=Firefox&_facets=signature&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=platform&_columns=email&_columns=user_comments#crash-reports

Seems unlikely to be anything actionable. Of the 3 crashes I sampled, the stacks are crap
bp-3d4803f7-d097-42c8-b4d2-11ed92160624
bp-07a9ea4a-0359-410d-8faa-96cdb2160623
bp-bf3b615f-aaf8-41a5-8e8a-21d302160620

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'js::TypeMonitorResult':
 - nightly (version 50): 1 crash from 2016-06-06.
 - aurora  (version 49): 2 crashes from 2016-06-07.
 - beta    (version 48): 32 crashes from 2016-06-06.
 - release (version 47): 532 crashes from 2016-05-31.
 - esr     (version 45): 13 crashes from 2016-04-07.

Crash volume on the last weeks:
             Week N-1   Week N-2   Week N-3   Week N-4   Week N-5   Week N-6   Week N-7
 - nightly          0          1          0          0          0          0          0
 - aurora           0          0          1          0          1          0          0
 - beta             3          5         16          7          0          0          0
 - release         81         71         73         94         83         66         30
 - esr              1          1          0          2          2          1          3

Affected platforms: Windows, Mac OS X, Linux

Comment 3

[Jan de Mooij [:jandem]]

Code no longer exists.