Closed Bug 1287087 Opened 8 years ago Closed 3 years ago

Crash in js::jit::MBasicBlock::add

Categories

(Core :: JavaScript Engine, defect, P3)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
Windows 7
Type:
defect

Tracking

()

Status:
RESOLVED WORKSFORME
Tracking Flags:
Tracking Status
firefox47 --- affected
firefox48 --- affected
firefox49 --- affected
firefox-esr45 --- affected
firefox50 --- affected

People

(Reporter: baffclan, Unassigned)

References

Details

(5 keywords)

Crash Data

Attachments

(1 file)

Turn on Javascript
35 bytes, text/plain
brittanyaguirre9141
: data-review+
Details
This bug was filed from the Socorro interface and is report bp-3afe081d-cb51-4a26-a330-94b192160715. ============================================================= Crashing Thread (0) Frame Module Signature Source 0 xul.dll js::jit::MBasicBlock::add(js::jit::MInstruction*) js/src/jit/MIRGraph.cpp:1094 1 @0x33890f 2 xul.dll js::jit::IonBuilder::inspectOpcode(JSOp) js/src/jit/IonBuilder.cpp:1671 3 xul.dll js::jit::IonBuilder::traverseBytecode() js/src/jit/IonBuilder.cpp:1540 4 xul.dll js::jit::IonBuilder::buildInline(js::jit::IonBuilder*, js::jit::MResumePoint*, js::jit::CallInfo&) js/src/jit/IonBuilder.cpp:1096 5 xul.dll js::jit::IonBuilder::inlineScriptedCall(js::jit::CallInfo&, JSFunction*) js/src/jit/IonBuilder.cpp:5228 6 xul.dll js::jit::IonBuilder::inlineSingleCall(js::jit::CallInfo&, JSObject*) js/src/jit/IonBuilder.cpp:5736 7 xul.dll js::jit::IonBuilder::inlineCallsite(mozilla::Vector<JSObject*, 4, js::jit::JitAllocPolicy> const&, js::jit::CallInfo&) js/src/jit/IonBuilder.cpp:5792 8 xul.dll js::jit::IonBuilder::jsop_call(unsigned int, bool) js/src/jit/IonBuilder.cpp:6733 9 xul.dll js::jit::IonBuilder::inspectOpcode(JSOp) js/src/jit/IonBuilder.cpp:1923 10 xul.dll js::jit::IonBuilder::traverseBytecode() js/src/jit/IonBuilder.cpp:1540 11 xul.dll js::jit::IonBuilder::build() js/src/jit/IonBuilder.cpp:924 12 xul.dll js::jit::IonCompile js/src/jit/Ion.cpp:2222 13 xul.dll js::jit::Compile js/src/jit/Ion.cpp:2453 14 xul.dll BaselineCanEnterAtBranch js/src/jit/Ion.cpp:2640 15 xul.dll js::jit::IonCompileScriptForBaseline(JSContext*, js::jit::BaselineFrame*, unsigned char*) js/src/jit/Ion.cpp:2699 16 xul.dll js::jit::DoWarmUpCounterFallbackOSR js/src/jit/BaselineIC.cpp:143 17 @0x6ce1583535 Application Basics Name Firefox Version 50.0a1 Build ID 20160714030208 Update Channel nightly User Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:50.0) Gecko/20100101 Firefox/50.0 OS Windows_NT 6.1
Crash volume for signature 'js::jit::MBasicBlock::add': - nightly (version 50): 1 crash from 2016-06-06. - aurora (version 49): 1 crash from 2016-06-07. - beta (version 48): 20 crashes from 2016-06-06. - release (version 47): 11 crashes from 2016-05-31. - esr (version 45): 1 crash from 2016-04-07. Crash volume on the last weeks: Week N-1 Week N-2 Week N-3 Week N-4 Week N-5 Week N-6 Week N-7 - nightly 0 1 0 0 0 0 0 - aurora 0 0 1 0 0 0 0 - beta 0 4 1 1 5 7 2 - release 1 0 2 3 1 0 0 - esr 0 0 0 0 0 1 0 Affected platform: Windows
status-firefox47: --- → affected
status-firefox48: --- → affected
status-firefox49: --- → affected
status-firefox-esr45: --- → affected
This is an AMD CPU bug (all the reports with these signatures have AuthenticAMD family 20 model 1 or AuthenticAMD family 20 model 2).
Crash Signature: [@ js::jit::MBasicBlock::add] → [@ js::jit::MBasicBlock::add] [@ js::jit::IonBuilder::inspectOpcode] [@ js::jit::IonBuilder::patchInlinedReturns] [@ js::jit::IonBuilder::inlineNativeCall]
Crash Signature: [@ js::jit::MBasicBlock::add] [@ js::jit::IonBuilder::inspectOpcode] [@ js::jit::IonBuilder::patchInlinedReturns] [@ js::jit::IonBuilder::inlineNativeCall] → [@ js::jit::MBasicBlock::add] [@ js::jit::IonBuilder::inspectOpcode] [@ @0x0 | js::jit::IonBuilder::inspectOpcode] [@ js::jit::IonBuilder::patchInlinedReturns] [@ js::jit::IonBuilder::inlineNativeCall]
Crash Signature: [@ js::jit::MBasicBlock::add] [@ js::jit::IonBuilder::inspectOpcode] [@ @0x0 | js::jit::IonBuilder::inspectOpcode] [@ js::jit::IonBuilder::patchInlinedReturns] [@ js::jit::IonBuilder::inlineNativeCall] → [@ js::jit::MBasicBlock::add] [@ js::jit::IonBuilder::inspectOpcode] [@ @0x0 | js::jit::IonBuilder::inspectOpcode] [@ js::jit::IonBuilder::patchInlinedReturns] [@ js::jit::IonBuilder::inlineNativeCall] [@ js::jit::IonBuilder::resume] [@ js::jit::Ion…
Keywords: top50, topcrash, topcrash-win
Crash Signature: [@ js::jit::MBasicBlock::add] [@ js::jit::IonBuilder::inspectOpcode] [@ @0x0 | js::jit::IonBuilder::inspectOpcode] [@ js::jit::IonBuilder::patchInlinedReturns] [@ js::jit::IonBuilder::inlineNativeCall] [@ js::jit::IonBuilder::resume] [@ js::jit::Ion… → [@ js::jit::MBasicBlock::add] [@ @0x0 | js::jit::MBasicBlock::add] [@ js::jit::IonBuilder::inspectOpcode] [@ @0x0 | js::jit::IonBuilder::inspectOpcode] [@ js::jit::IonBuilder::patchInlinedReturns] [@ js::jit::IonBuilder::inlineNativeCall] [@ js::jit…
Crash Signature: js::jit::IonBuilder::resume] [@ js::jit::IonBuilder::getPropTryConstant] [@ js::jit::IonBuilder::jsop_getprop] [@ jit | CORRUPT_CODE] → js::jit::IonBuilder::resume] [@ js::jit::IonBuilder::getPropTryConstant] [@ js::jit::IonBuilder::jsop_getprop]
See Also: → 1312270
Keywords: triage-deferred
Priority: -- → P3
Attached file Turn on Javascript —

http://www.enable-javascript.com/no

Flags: needinfo?(sdetar)
Attachment #9222043 - Flags: data-review+
Flags: needinfo?(sdetar)

Closing this issue as Resolved > Worksforme since no crashes with this Signature were reported in the last 6 months.

Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: