Closed Bug 1220385 Opened 7 years ago Closed 6 years ago
crash in js::Constraint
This bug was filed from the Socorro interface and is report bp-b8b9082b-7497-45c6-93b5-d78b42151031. ============================================================= 0 @0x17db6ce40 1 XUL js::ConstraintTypeSet::sweep(JS::Zone*, js::AutoClearTypeInferenceStateOnOOM&) js/src/vm/TypeInference.cpp 2 XUL JSScript::maybeSweepTypes(js::AutoClearTypeInferenceStateOnOOM*) js/src/vm/TypeInference.cpp 3 XUL js::gc::GCRuntime::sweepPhase(js::SliceBudget&) js/src/jsgc.cpp 4 XUL js::gc::GCRuntime::incrementalCollectSlice(js::SliceBudget&, JS::gcreason::Reason) js/src/jsgc.cpp 5 XUL js::gc::GCRuntime::gcCycle(bool, js::SliceBudget&, JS::gcreason::Reason) js/src/jsgc.cpp 6 XUL js::gc::GCRuntime::collect(bool, js::SliceBudget, JS::gcreason::Reason) js/src/jsgc.cpp 7 XUL js::gc::GCRuntime::notifyDidPaint() js/src/jsgc.cpp 8 XUL nsXPConnect::NotifyDidPaint() js/xpconnect/src/nsXPConnect.cpp 9 XUL nsRefreshDriver::Tick(long long, mozilla::TimeStamp) layout/base/nsRefreshDriver.cpp 10 XUL mozilla::RefreshDriverTimer::Tick(long long, mozilla::TimeStamp) layout/base/nsRefreshDriver.cpp 11 XUL nsRunnableMethodImpl<void (mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::*)(mozilla::TimeStamp), true, mozilla::TimeStamp>::Run xpcom/glue/nsThreadUtils.h 12 XUL nsThread::ProcessNextEvent(bool, bool*) xpcom/threads/nsThread.cpp 13 XUL NS_ProcessPendingEvents(nsIThread*, unsigned int) xpcom/glue/nsThreadUtils.cpp 14 XUL nsBaseAppShell::NativeEventCallback() widget/nsBaseAppShell.cpp 15 XUL nsAppShell::ProcessGeckoEvents(void*) widget/cocoa/nsAppShell.mm 16 CoreFoundation __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ 17 CoreFoundation __CFRunLoopDoSources0 18 CoreFoundation __CFRunLoopRun 19 CoreFoundation CFRunLoopRunSpecific 20 HIToolbox RunCurrentEventLoopInMode 21 HIToolbox ReceiveNextEventCommon 22 HIToolbox _BlockUntilNextEventMatchingListInModeWithFilter 23 AppKit _DPSNextEvent 24 AppKit -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] 25 XUL -[GeckoNSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] widget/cocoa/nsAppShell.mm 26 AppKit -[NSApplication run] 27 XUL nsAppShell::Run() widget/cocoa/nsAppShell.mm 28 XUL nsAppStartup::Run() toolkit/components/startup/nsAppStartup.cpp 29 XUL XREMain::XRE_mainRun() toolkit/xre/nsAppRunner.cpp 30 XUL XREMain::XRE_main(int, char**, nsXREAppData const*) toolkit/xre/nsAppRunner.cpp 31 XUL XRE_main toolkit/xre/nsAppRunner.cpp 32 firefox main browser/app/nsBrowserApp.cpp 33 firefox start
Ioana, is this something you can reproduce?
Product: Firefox → Core
Also seen on Linux. Filing from Sumo: https://support.mozilla.org/en-US/questions/1115516 bp-bab24358-80d4-4b70-a7aa-bbec02160323 Sorry no STR. Noted as a random crash. Other signatures also seen.
This crash affects mainly beta and spiked the 2016-04-22: https://crash-stats.mozilla.com/signature/?date=%3E%3D2016-04-19T13%3A24%3A21.115917&date=%3C2016-04-26T13%3A24%3A21.115917&product=Firefox&release_channel=beta&signature=js%3A%3AConstraintTypeSet%3A%3Asweep#graphs
Unfortunately - I am getting so so many crashes lately that if I did not add the steps then, I can't tell now. So sorry :(
(In reply to Ioana Chiorean from comment #4) > Unfortunately - I am getting so so many crashes lately You do ineed ad1acd36-1006-4c20-b012-399912160426 2016-04-26 18:47:36 303e5cb1-ab0d-4c03-abe2-4998a2160425 2016-04-25 19:56:16 f4b891a9-18ff-49e5-b9c0-8b3972160425 2016-04-25 19:52:57 c2de7658-4740-4c6d-8e91-519ee2160425 2016-04-25 19:50:55 23bd2b62-061d-49db-995f-2a4d12160424 2016-04-24 20:37:04 d04de37e-ff34-4047-8bbd-cef092160424 2016-04-24 20:32:29 910fe4a0-70d3-4d83-8088-5e8592160423 2016-04-23 07:37:41 Have you considered the possibility that you have a hardware issue?
Well not really as I am getting them both on my Mac machine but also on my linux one. Can you be more specific?
(In reply to Ioana Chiorean from comment #6) > Well not really as I am getting them both on my Mac machine but also on my > linux one. I'm seeing only Mac crash reports. Are you able to create mozilla crash reports or backgraces for the linux crashes? >> Have you considered the possibility that you have a hardware issue? > Can you be more specific? since you are also crashing linux, let's consider first potentially more likely causes. Do you have the same mail accounts defined to both Mac and linux? Can you try an experiment of disabling half your addons on Mac, and the *other* half onlinux?
This is now #15 top crasher on Firefox 46.
Sorry - I missed to reply here. I am not encountering the crashes anymore. I am always using nightly so probably one of the updates fixed it.
Crash volume for signature 'js::ConstraintTypeSet::sweep': - nightly (version 51): 41 crashes from 2016-08-01. - aurora (version 50): 138 crashes from 2016-08-01. - beta (version 49): 1292 crashes from 2016-08-02. - release (version 48): 215 crashes from 2016-07-25. - esr (version 45): 132 crashes from 2016-05-02. Crash volume on the last weeks (Week N is from 08-22 to 08-28): W. N-1 W. N-2 W. N-3 - nightly 11 13 8 - aurora 40 55 23 - beta 410 435 177 - release 76 49 26 - esr 10 22 15 Affected platforms: Windows, Mac OS X, Linux Crash rank on the last 7 days: Browser Content Plugin - nightly #147 #56 - aurora #51 #33 - beta #36 #18 - release #240 - esr #688
[Tracking Requested - why for this release]: this signature starts noticeably increasing since 49.0b builds: https://crash-stats.mozilla.com/signature/?release_channel=beta&product=Firefox&date=%3E2016-04-01&signature=js%3A%3AConstraintTypeSet%3A%3Asweep#graphs
Flags: needinfo?(continuation) → needinfo?(terrence)
This spiked in beta 8 but looks much better for beta 10. We can keep an eye on it but a fix for 49 is unlikely at this point as we are hoping to build RC2 today and release next week.
Naveed, this bug may need a new owner... Can you help find someone to work on it at least for the 50 timeframe? Thanks!
Jon please take a look. Thanks.
Assignee: nobody → jcoppeard
Flags: needinfo?(nihsanullah) → needinfo?(jcoppeard)
The crashes seem to be at a variety of addresses, including addresses containing the free poison pattern. I'm going to work on bug 1294767 which will add assertions that may shed light on this.
Crash volume for signature 'js::ConstraintTypeSet::sweep': - nightly (version 52): 55 crashes from 2016-09-19. - aurora (version 51): 19 crashes from 2016-09-19. - beta (version 50): 663 crashes from 2016-09-20. - release (version 49): 5029 crashes from 2016-09-05. - esr (version 45): 171 crashes from 2016-06-01. Crash volume on the last weeks (Week N is from 10-03 to 10-09): W. N-1 W. N-2 - nightly 21 34 - aurora 16 3 - beta 572 91 - release 4002 1026 - esr 10 14 Affected platforms: Windows, Mac OS X, Linux Crash rank on the last 7 days: Browser Content Plugin - nightly #216 #68 - aurora #147 #111 - beta #23 #16 - release #10 #5 - esr #788
The volume of crashes for 49.0.1 is 10291 (it was 636 in 49.0).
Unassigning myself because I'm not actively working on this. I added some assertions in bug 1314299 but they haven't shown up anything. Jan, off the top of your head do you have any idea how we could track this down?
Assignee: jcoppeard → nobody
Crash volume for signature 'js::ConstraintTypeSet::sweep': - nightly (version 53): 177 crashes from 2016-11-14. - aurora (version 52): 113 crashes from 2016-11-14. - beta (version 51): 6775 crashes from 2016-11-14. - release (version 50): 14894 crashes from 2016-11-01. - esr (version 45): 587 crashes from 2016-07-06. Crash volume on the last weeks (Week N is from 01-02 to 01-08): W. N-1 W. N-2 W. N-3 W. N-4 W. N-5 W. N-6 W. N-7 - nightly 19 13 38 40 27 17 13 - aurora 17 20 12 26 22 11 0 - beta 1295 1415 998 452 675 851 681 - release 1257 1329 1378 1420 3142 4295 1715 - esr 11 19 15 34 101 111 72 Affected platforms: Windows, Mac OS X, Linux Crash rank on the last 7 days: Browser Content Plugin - nightly #137 #42 - aurora #288 #75 - beta #14 #8 - release #29 #17 - esr #411
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 1112741
You need to log in before you can comment on or make changes to this bug.