1259689 - Random crash [@ JSScript::traceChildren]

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Common User Network Terminal]

User Agent: Mozilla/5.0 (Windows NT 5.1; rv:41.0) Gecko/20100101 Firefox/41.0
Build ID: 20150917150946

Steps to reproduce:

Tried to browse internet


Actual results:

it crashed


Expected results:

Browser should work and not crash, and bugs such as Bug 1214006 should not be marked as 'resolved' and 'fixed' when the defects clearly are not.

Comment 1

[Common User Network Terminal]

https://crash-stats.mozilla.com/report/list?product=Firefox&signature=JSScript%3A%3AtraceChildren#tab-reports
2,767 Results.

This defect still appears in v48.0a1 

This defect (a 'feature') was introduced in v40.0.

Comment 2

[Henrik Skupin [:whimboo][⌚️UTC+1]]

I have seen this crash over the weekend once with a 53.0 Nightly builds. Here the crash report: bp-b3865065-40cb-4407-bc05-360392161125.

Comment 3

[Henrik Skupin [:whimboo][⌚️UTC+1]]

First 10 frames from the crashing thread:

0 	XUL 	JSScript::traceChildren(JSTracer*) 	js/src/jsscript.h:1072
1 	XUL 	js::GCMarker::processMarkStackTop(js::SliceBudget&) 	js/src/gc/Marking.cpp:1663
2 	XUL 	js::GCMarker::drainMarkStack(js::SliceBudget&) 	js/src/gc/Marking.cpp:1555
3 	XUL 	js::gc::GCRuntime::incrementalCollectSlice(js::SliceBudget&, JS::gcreason::Reason, js::AutoLockForExclusiveAccess&) 	js/src/jsgc.cpp:5270
4 	XUL 	js::gc::GCRuntime::gcCycle(bool, js::SliceBudget&, JS::gcreason::Reason) 	js/src/jsgc.cpp:6206
5 	XUL 	js::gc::GCRuntime::collect(bool, js::SliceBudget, JS::gcreason::Reason) 	js/src/jsgc.cpp:6360
6 	XUL 	JS::IncrementalGCSlice(JSContext*, JS::gcreason::Reason, long long) 	js/src/jsgc.cpp:6440
7 	XUL 	nsJSContext::GarbageCollectNow(JS::gcreason::Reason, nsJSContext::IsIncremental, nsJSContext::IsShrinking, long long) 	dom/base/nsJSEnvironment.cpp:1201
8 	XUL 	nsTimerImpl::Fire() 	xpcom/threads/nsTimerImpl.cpp:477
9 	XUL 	nsTimerEvent::Run() 	xpcom/threads/TimerThread.cpp:289
10 	XUL 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp:1213

Comment 4

[Henrik Skupin [:whimboo][⌚️UTC+1]]

https://crash-stats.mozilla.com/search/?signature=~JSScript%3A%3AtraceChildren&date=%3E%3D2016-11-21T12%3A55%3A00.000Z&date=%3C2016-11-28T12%3A55%3A00.000Z&_sort=-date&_facets=signature&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#facet-signature

* About 15% report a slowdownhang which caused this crash
* Mac OS X and Windows are mostly affected with about 2250 crashes report in the last 7 days

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'JSScript::traceChildren':
 - nightly (version 53): 35 crashes from 2016-11-14.
 - aurora  (version 52): 98 crashes from 2016-11-14.
 - beta    (version 51): 1647 crashes from 2016-11-14.
 - release (version 50): 6822 crashes from 2016-11-01.
 - esr     (version 45): 5287 crashes from 2016-07-06.

Crash volume on the last weeks (Week N is from 01-02 to 01-08):
            W. N-1  W. N-2  W. N-3  W. N-4  W. N-5  W. N-6  W. N-7
 - nightly       4       5       4       6       3       2       7
 - aurora       18      15      19      16      13       9       0
 - beta        251     233     258     242     243     224     109
 - release    1688    1508    1171     697     649     493     140
 - esr         211     242     300     306     298     288     282

Affected platforms: Windows, Mac OS X, Linux

Crash rank on the last 7 days:
           Browser   Content   Plugin
 - nightly #203      #178
 - aurora  #179      #93
 - beta    #60       #58
 - release #71       #58
 - esr     #60

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'JSScript::traceChildren':
 - nightly (version 54): 11 crashes from 2017-01-23.
 - aurora  (version 53): 6 crashes from 2017-01-23.
 - beta    (version 52): 166 crashes from 2017-01-23.
 - release (version 51): 667 crashes from 2017-01-16.
 - esr     (version 45): 5680 crashes from 2016-08-03.

Crash volume on the last weeks (Week N is from 01-30 to 02-05):
            W. N-1  W. N-2  W. N-3  W. N-4  W. N-5  W. N-6  W. N-7
 - nightly      10
 - aurora        1
 - beta        106
 - release     310       0
 - esr         276     306     278     241     211     242     300

Affected platforms: Windows, Mac OS X, Linux

Crash rank on the last 7 days:
           Browser   Content   Plugin
 - nightly #81       #123
 - aurora  #100      #98
 - beta    #61       #52
 - release #54       #37
 - esr     #56

Comment 7

[Josh Matthews [:jdm]]

I can reproduce this crash consistently when loading https://www.dropbox.com/s/ic2jzcr9q7rksvq/Screenshot%202017-01-06%2016.38.27.png?dl=0 on OS X 10.9.5 when using the latest try build from bug 1331683.

Comment 8

[Josh Matthews [:jdm]]

https://crash-stats.mozilla.com/report/index/c1d4007e-720c-4461-aec0-47b142170201

Comment 9

[Julien Cristau [:jcristau] (back April 22)]

Too late for firefox 52, mass-wontfix.

Comment 10

[Pablo]

Hi Josh.

Im trying to reproduce old bugs to see if we can resolve some. Im unable to reproduce this crash since there are no steps, the crash report links are not working anymore, the dropbox link that you shared is not working anymore either.

Im wondering if you can share it again or if we can just resolve the issue.

thanks
Pablo

Comment 11

[Josh Matthews [:jdm]]

I no longer have any idea what file that was, and I am not in a position to resolve this bug one way or another.

Comment 12

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.