Closed Bug 1181986 Opened 6 years ago Closed 6 years ago

crash in js::ConstraintTypeSet::sweep(JS::Zone*, js::AutoClearTypeInferenceStateOnOOM&)

Categories

(Core :: JavaScript: GC, defect)

Product:
Core
Component:
JavaScript: GC
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1191465
Tracking Flags:
Tracking Status
firefox42 --- affected

People

(Reporter: phorea, Unassigned)

Details

(Keywords: crash, dogfood)

Crash Data

This bug was filed from the Socorro interface and is 
report bp-1bb77516-aa40-452a-a5a6-4292a2150709.
=============================================================

Reproduced this crash with Aurora 41.0a2 2015-07-08 under Mac OS X 10.9.5 while on YouTube with html5. I couldn't find reliable steps to reproduce.

YouTube and Facebook are mentioned in other comments, so it could be related to html5.
Hit this with nothing obvious open (gmail, gcal, mingle, gdocs, and hacker news) and no particular action to trigger it.

https://crash-stats.mozilla.com/report/index/e932aa6d-0cbc-4120-92c5-7efaf2150805
I already had 2 crashes in the last hour with Nightly 42.0a1 (2015-08-05), no issue with the previous version.
I also had a spike (4 or 5 crashes) from the Nightly on 2015-08-05 and had to downgrade and shut off updates.
Keywords: dogfood
I suspect comment 1, comment 2, and comment 3 are a separate bug that manifested in the last day or so, likely bug 1191259.
Bug 1191465 also has a comment or two recently that might really be this.
This signature spiked on the August 5 build and the recent occurrences are likely the same root cause as bug 1191465.
I had crash signature from this bug, and also this one: https://crash-stats.mozilla.com/report/index/d9e83587-1850-40fa-86a5-d1ba12150806 with signature:

@ memset | nsIPresShell::AllocateByObjectID(nsPresArena::ObjectID, unsigned __int64)

-- this also mentions "Arena", so the root issue would be the same as in #bug 1191465

David, this whole thing becomes super annoying, I have all those various crashes every 1.5 hours no matter what I do in FireFox. Could you please confirm and elevate #bug 1181465 in certain way so more people could help with finding the issue? It makes Nightly almost unusable.
Flags: needinfo?(dmajor)
New nightlies are being built right now. Please check for updates in a few hours.
Flags: needinfo?(dmajor)
(In reply to User Dderss from comment #7)
> I had crash signature from this bug, and also this one:
> https://crash-stats.mozilla.com/report/index/d9e83587-1850-40fa-86a5-
> d1ba12150806 with signature:
> 
> @ memset | nsIPresShell::AllocateByObjectID(nsPresArena::ObjectID, unsigned
> __int64)
> 
> -- this also mentions "Arena", so the root issue would be the same as in
> #bug 1191465

For future reference, "arena" is a very generic term in computer science for a data structure containing memory in which a bunch of *another* data structure is stored.  There are arenas used to store JavaScript objects, and there are *entirely separate* nsPresArenas used to store data structures used for layout and rendering.

So your crash here, and anything going through nsIPresShell or nsPresArena or similar things, is not related to a JS engine crash, no matter that the stack claims "arena" in both.
Thanks; I did not look at the signatures closely enough.

It looks like it starts with JS interpreter, then goes to update styles, and then it dies during layout render. So it looks like this should be files as totally separate bug?
Assuming it's not a dup of something, yeah, separate bug.
Testing shows that the new nightly may not fix bug 1191465, but rest assured that the issue is under active investigation.
Crashed today at this at https://crash-stats.mozilla.com/report/index/a9afe9d0-3bb1-4758-9dd7-7331e2150806 . 

The steps I did just prior to crash (remember the steps quite well since I was showing page links to a coworker):

1. Went to about:support, and "Refresh Nightly"
2. Navigated to http://clb.demon.fi/emcc/emunittest/emunittest-AngryBots-0.2/ and ran the test until I received "TEST PASSED".
3. Left the tab open, and opened a new tab, and navigated to "https://dl.dropboxusercontent.com/u/40949268/emcc/10kCubes_vsync/10kCubes.html".
4. Had the 10kCubes tab running for perhaps half a minute, and opened a new tab, and navigated to "http://tiny.cc".
5. Left the computer for a few minutes to go grab a coffee, and came back to a "this tab has crashed".

Really vague, and when I tried these steps again (twice), it did not crash, so not sure if there's much help with this.
Do you still crash on the latest nightly?
Flags: needinfo?(zxspectrum3579)
I thought that latest Nightly would still not solve the issue, so I am running release version now. Now I will turn back to (updated) Nightly and report on how long it will go on without crashing.
Flags: needinfo?(zxspectrum3579)
I got this crash on this Windows 2015-08-08 build
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 1191465
You need to log in before you can comment on or make changes to this bug.