1287334 - Crash in js::InternalBarrierMethods<T>::postBarrier

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Tom S [:evilpie]]

This bug was filed from the Socorro interface and is 
report bp-584dd11c-e6e3-447f-aedf-c539f2160717.
=============================================================

This seems to be caused by js::EnqueuePromiseReactionJob. Only 3-4 reports yet, but I pretty sure this is a real bug, I almost never get crashes.

Comment 1

[Till Schneidereit [:till]]

Attachment: Properly handle non-Promise objects as dependent promise objects in js::EnqueuePromiseReactionJob

Yeah, so this is all rather silly. I now at least understand why only evilpie saw this: the Kangax table is probably ~the only code on the web right now that could trigger this. test262 could, but there's no public web runner for that.

Comment 2

[Eric Faust [:efaust]]

Comment on attachment 8773035 [details] [diff] [review]
Properly handle non-Promise objects as dependent promise objects in js::EnqueuePromiseReactionJob

Review of attachment 8773035 [details] [diff] [review]:
-----------------------------------------------------------------

Whoops! Nice catch!

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/ff1ffc083571
Properly handle non-Promise objects as dependent promise objects in js::EnqueuePromiseReactionJob. r=efaust

Comment 4

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

SM builds started failing with https://treeherder.mozilla.org/logviewer.html#?job_id=32263542&repo=mozilla-inbound

Backed out in https://hg.mozilla.org/integration/mozilla-inbound/rev/8ccb505a1cfc

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/1e55eeb2395e
Properly handle non-Promise objects as dependent promise objects in js::EnqueuePromiseReactionJob. r=efaust

Comment 6

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/1e55eeb2395e

Comment 7

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'js::InternalBarrierMethods<T>::postBarrier':
 - nightly (version 50): 8 crashes from 2016-06-06.
 - aurora  (version 49): 33 crashes from 2016-06-07.
 - beta    (version 48): 73 crashes from 2016-06-06.
 - release (version 47): 476 crashes from 2016-05-31.
 - esr     (version 45): 0 crash from 2016-04-07.

Crash volume on the last weeks:
             Week N-1   Week N-2   Week N-3   Week N-4   Week N-5   Week N-6   Week N-7
 - nightly          1          6          0          0          0          0          0
 - aurora           3          6          4          4          3          8          0
 - beta             7         16          5         10         14         16          3
 - release         71         56         68         85         80         64         20
 - esr              0          0          0          0          0          0          0

Affected platforms: Windows, Mac OS X, Linux

Comment 9

[Andrei Vaida [:avaida]]

This is still reproducible on Fx50, based on the last 3 months of crash data.

  SIGNATURE   | js::InternalBarrierMethods<T>::postBarrier
  --------------------------------------------------------
  CRASH STATS | http://tinyurl.com/zrd7fbw
  --------------------------------------------------------
  OVERVIEW    | 0 crashes on nightly 52
	      | 10 crashes on nightly 51
	      | 1 crashes on aurora 51
	      | 8 crashes on nightly 50
	      | 62 crashes on aurora 50
	      | 51 crashes on beta 50
  --------------------------------------------------------
  LAST CRASH  | 2016-10-02 (on 50.0b1)