Closed Bug 1316022 Opened 8 years ago Closed 4 years ago

Crash in js::NativeObject::addPropertyInternal, AddOrChangeProperty... in 50.0rc2

Categories

(Core :: General, defect)

Product:
Core
Component:
General
Version:
50 Branch
Platform:
x86
Windows
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME
Tracking Flags:
Tracking Status
firefox50 - unaffected

People

(Reporter: philipp, Unassigned)

References

Details

(Keywords: crash)

Crash Data

This bug was filed from the Socorro interface and is 
report bp-a63d1059-4fee-4435-a97c-ff2b42161108.
=============================================================
Crashing Thread (0)
Frame 	Module 	Signature 	Source
0 		@0x1de040 	
1 	xul.dll 	AddOrChangeProperty 	js/src/vm/NativeObject.cpp:1164
2 	xul.dll 	js::NativeDefineProperty(js::ExclusiveContext*, JS::Handle<js::NativeObject*>, JS::Handle<jsid>, JS::Handle<JS::PropertyDescriptor>, JS::ObjectOpResult&) 	js/src/vm/NativeObject.cpp:1538
3 	xul.dll 	js::InitPropertyOperation(JSContext*, JSOp, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::Handle<JS::Value>) 	js/src/vm/Interpreter-inl.h:342
4 	xul.dll 	Interpret 	js/src/vm/Interpreter.cpp:3565
5 	xul.dll 	js::RunScript(JSContext*, js::RunState&) 	js/src/vm/Interpreter.cpp:399
6 	xul.dll 	js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value const&, js::AbstractFramePtr, JS::Value*) 	js/src/vm/Interpreter.cpp:679
7 	xul.dll 	js::Execute(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value*) 	js/src/vm/Interpreter.cpp:711

early crash data for 50.0rc2 shows there might be a js-specific crash pattern developing for our problematic "AuthenticAMD family 20" cpu model.
it may be a bit early to tell still what kind of impact this has on stability for this build over all...

i think the patch in bug 1281759 just landed on rc2 in an attempt to work around those issues.
Crash Signature: [@ AddOrChangeProperty] [@ js::NativeObject::addPropertyInternal] [@ js::NativeObject::putProperty] [@ AddOrChangeProperty] [@ nsCOMPtr_base::~nsCOMPtr_base | mozilla::dom::WriteOp::Init] → [@ js::NativeObject::addPropertyInternal] [@ js::NativeObject::putProperty] [@ AddOrChangeProperty] [@ nsCOMPtr_base::~nsCOMPtr_base | mozilla::dom::WriteOp::Init]
Crash Signature: [@ js::NativeObject::addPropertyInternal] [@ js::NativeObject::putProperty] [@ AddOrChangeProperty] [@ nsCOMPtr_base::~nsCOMPtr_base | mozilla::dom::WriteOp::Init] → [@ js::NativeObject::addPropertyInternal] [@ js::NativeObject::putProperty] [@ AddOrChangeProperty] [@ nsCOMPtr_base::~nsCOMPtr_base | mozilla::dom::WriteOp::Init] [@ @0x0 | js::NativeObject::addPropertyInternal] [@ @0x0 | js::NativeObject::putProper…
Crash Signature: js::NativeObject::putProperty] → js::NativeObject::putProperty] [@ js::jit::CallInfo::setImplicitlyUsedUnchecked]
this crash pattern was apparently build-specific and has gone in 50.0.1.
Status: NEW → RESOLVED
Closed: 8 years ago
status-firefox50: affected → unaffected
Resolution: --- → WORKSFORME
Depends on: 772330
The crash is here again for the first RC of 51.
Status: RESOLVED → REOPENED
Resolution: WORKSFORME → ---
See Also: → 1180844
Hi :milan,
This crash also hits 51 RC and it seems that this crash is related to AMD, do you have any ideas about how to progress with this?
Flags: needinfo?(milan)
I think in the past the thing that "resolved" these types of bugs were another build.  Maybe RC2 will take care of it?
Flags: needinfo?(milan)

Closing because no crashes reported for 12 weeks.

Status: REOPENED → RESOLVED
Closed: 8 years ago → 4 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.