1192228 - crash in js::jit::ICStubCompiler::getStubCode()

Status: RESOLVED INVALID

(Core :: JavaScript Engine, defect)

Description

[Ludovic Hirlimann [:Usul]]

This bug was filed from the Socorro interface and is 
report bp-41151fe4-4546-47a0-b4fc-a974e2150806.
=============================================================
0 	libxul.so 	js::jit::ICStubCompiler::getStubCode() 	js/src/gc/Heap.h
1 	libxul.so 	js::jit::DoCompareFallback 	js/src/jit/BaselineIC.h
2 		@0x7f871538c6af 	
3 		@0x7f871538584e 	
4 	libxul.so 	EnterBaseline 	js/src/jit/BaselineJIT.cpp
5 	libxul.so 	js::jit::EnterBaselineMethod(JSContext*, js::RunState&) 	js/src/jit/BaselineJIT.cpp
6 	libxul.so 	js::RunScript(JSContext*, js::RunState&) 	js/src/vm/Interpreter.cpp
7 	libxul.so 	js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
8 	libxul.so 	js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value const*, JS::MutableHandle<JS::Value>) 	js/src/vm/Interpreter.cpp
9 	libxul.so 	js::DirectProxyHandler::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) const 	js/src/proxy/DirectProxyHandler.cpp
10 	libxul.so 	js::CrossCompartmentWrapper::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) const 	js/src/proxy/CrossCompartmentWrapper.cpp
11 	libxul.so 	js::Proxy::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) 	js/src/proxy/Proxy.cpp
12 	libxul.so 	js::proxy_Call(JSContext*, unsigned int, JS::Value*) 	js/src/proxy/Proxy.cpp
13 	libxul.so 	js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) 	js/src/jscntxtinlines.h
14 	libxul.so 	js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value const*, JS::MutableHandle<JS::Value>) 	js/src/vm/Interpreter.cpp
15 	libxul.so 	js::jit::DoCallFallback 	js/src/jit/BaselineIC.cpp
16 		@0x7f871538b7cf 	
17 		@0x7f86b22c47c7 	
18 		@0x7f871538584e 	
19 	libxul.so 	EnterBaseline 	js/src/jit/BaselineJIT.cpp
20 	libxul.so 	js::jit::EnterBaselineMethod(JSContext*, js::RunState&) 	js/src/jit/BaselineJIT.cpp
21 	libxul.so 	Interpret 	js/src/vm/Interpreter.cpp
22 	libxul.so 	js::RunScript(JSContext*, js::RunState&) 	js/src/vm/Interpreter.cpp
23 	libxul.so 	js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
24 	libxul.so 	js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value const*, JS::MutableHandle<JS::Value>) 	js/src/vm/Interpreter.cpp
25 	libxul.so 	js::DirectProxyHandler::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) const 	js/src/proxy/DirectProxyHandler.cpp
26 	libxul.so 	js::CrossCompartmentWrapper::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) const 	js/src/proxy/CrossCompartmentWrapper.cpp
27 	libxul.so 	js::Proxy::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) 	js/src/proxy/Proxy.cpp
28 	libxul.so 	js::proxy_Call(JSContext*, unsigned int, JS::Value*) 	js/src/proxy/Proxy.cpp
29 	libxul.so 	js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) 	js/src/jscntxtinlines.h
30 	libxul.so 	js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value const*, JS::MutableHandle<JS::Value>) 	js/src/vm/Interpreter.cpp
31 	libxul.so 	JS_CallFunctionValue(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) 	js/src/jsapi.cpp
32 	libxul.so 	nsXPCWrappedJSClass::CallQueryInterfaceOnJSObject(JSContext*, JSObject*, nsID const&) 	js/xpconnect/src/XPCWrappedJSClass.cpp
33 	libxul.so 	nsXPCWrappedJS::GetNewOrUsed(JS::Handle<JSObject*>, nsID const&, nsXPCWrappedJS**) 	js/xpconnect/src/XPCWrappedJSClass.cpp
34 	libxul.so 	nsXPCWrappedJSClass::DelegatedQueryInterface(nsXPCWrappedJS*, nsID const&, void**) 	js/xpconnect/src/XPCWrappedJSClass.cpp
35 	libxul.so 	nsQueryReferent::operator()(nsID const&, void**) const 	xpcom/glue/nsWeakReference.cpp
36 	libxul.so 	nsCOMPtr_base::assign_from_helper(nsCOMPtr_helper const&, nsID const&) 	xpcom/glue/nsCOMPtr.cpp
37 	libxul.so 	nsObserverList::FillObserverArray(nsCOMArray<nsIObserver>&) 	xpcom/glue/nsCOMPtr.h
38 	libxul.so 	nsObserverList::NotifyObservers(nsISupports*, char const*, char16_t const*) 	xpcom/ds/nsObserverList.cpp
39 	libxul.so 	nsObserverService::NotifyObservers(nsISupports*, char const*, char16_t const*) 	xpcom/ds/nsObserverService.cpp
40 	libxul.so 	WindowDestroyedEvent::Run() 	dom/base/nsGlobalWindow.cpp
41 	libxul.so 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp
42 	libxul.so 	NS_ProcessNextEvent(nsIThread*, bool) 	xpcom/glue/nsThreadUtils.cpp
43 	libxul.so 	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
44 	libxul.so 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
45 	libxul.so 	nsBaseAppShell::Run() 	widget/nsBaseAppShell.cpp
46 	libxul.so 	XRE_RunAppShell 	toolkit/xre/nsEmbedFunctions.cpp
47 	libxul.so 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
48 	libxul.so 	XRE_InitChildProcess 	toolkit/xre/nsEmbedFunctions.cpp
49 	plugin-container 	content_process_main(int, char**) 	ipc/contentproc/plugin-container.cpp
Ø 50 	libc-2.21.so 	libc-2.21.so@0x206ff 	
51 	plugin-container 	_init 	
52 	plugin-container 	malloc_good_size 	memory/build/replace_malloc.c
53 	plugin-container 	__libc_csu_fini 	
54 	plugin-container 	malloc_good_size 	memory/build/replace_malloc.c
55 	plugin-container 	_start

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'js::jit::ICStubCompiler::getStubCode':
 - nightly (version 51): 1 crash from 2016-08-01.
 - aurora  (version 50): 1 crash from 2016-08-01.
 - beta    (version 49): 51 crashes from 2016-08-02.
 - release (version 48): 32 crashes from 2016-07-25.
 - esr     (version 45): 7 crashes from 2016-05-02.

Crash volume on the last weeks (Week N is from 08-22 to 08-28):
            W. N-1  W. N-2  W. N-3
 - nightly       0       1       0
 - aurora        0       1       0
 - beta         21      11       6
 - release       9       6       9
 - esr           3       0       0

Affected platforms: Windows, Mac OS X, Linux

Crash rank on the last 7 days:
           Browser   Content     Plugin
 - nightly
 - aurora
 - beta    #673      #2540
 - release #1738     #313
 - esr     #4636

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Since the crash volume is low (less than 5 per week), the severity is downgraded to S3. Feel free to change it back if you think the bug is still critical.

For more information, please visit auto_nag documentation.

Comment 3

[Jan de Mooij [:jandem]]

ICStubCompiler is no more.