1320358 - Crash in js::SetLengthProperty

Status: RESOLVED DUPLICATE of bug 1308800

(Core :: JavaScript Engine, defect, P1)

Description

[Marcia Knous [:marcia]]

This bug was filed from the Socorro interface and is 
report bp-0d80fead-7ca8-453a-8c48-7e86a2161125.
=============================================================

Seen while looking at Beta crash stats: http://bit.ly/2fMYhLj. Much higher concentration of crashes in Beta 2 than FF 49 or 50. Currently #15 top browser crash in Beta 2.

Comment 1

[Milan Sreckovic [:milan] (needinfo for best results)]

Jason, should we take a look at this, being #15 crash in beta 2?

Comment 2

[Gerry Chang [:gchang]]

Hi Naveed,
Can you help find someone to take a look at this one if Jason isn't available right now?

Comment 3

[[:philipp]]

this is spiking up and down during the beta cycle.

51.0b1: unaffected (1 crash)
51.0b2: affected (371 crashes)
51.0b3: affected (412 crashes)
51.0b4: unaffected (no crashes)
51.0b5: unaffected (6 crashes)
51.0b6: unaffected (2 crashes)
51.0b7: affected (155 crashes)
51.0b8: unaffected (no crashes)
51.0b9: affected (202 crashes)
51.0b10: affected (596 crashes)

i'm not aware of any patches for a component that would have the same in/out pattern on the beta channel, so it may be a signature related to pgo. it doesn't appear to be related to a specific cpu configuration like we have seen in the past with similar patterns though...

Correlations for Firefox Beta
(96.61% in signature vs 11.95% overall) address = 0x0
(99.76% in signature vs 36.88% overall) reason = EXCEPTION_ACCESS_VIOLATION_READ
(90.31% in signature vs 59.58% overall) Module "mozavcodec.dll" = true
(90.31% in signature vs 59.58% overall) Module "mozavutil.dll" = true
(76.03% in signature vs 46.18% overall) Module "d3d11.dll" = true
(85.47% in signature vs 57.26% overall) Module "msmpeg2vdec.dll" = true
(77.48% in signature vs 49.23% overall) Module "dxgi.dll" = true
(85.71% in signature vs 58.14% overall) Module "evr.dll" = true
(85.71% in signature vs 58.15% overall) Module "mf.dll" = true
(85.71% in signature vs 58.40% overall) Module "dxva2.dll" = true
(85.71% in signature vs 58.77% overall) Module "mfplat.dll" = true
(81.84% in signature vs 55.37% overall) Module "avrt.dll" = true
(91.04% in signature vs 66.00% overall) Module "pnrpnsp.dll" = true
(91.04% in signature vs 66.10% overall) Module "NapiNSP.dll" = true
(91.04% in signature vs 66.13% overall) Module "nlaapi.dll" = true
(100.0% in signature vs 78.43% overall) Module "winrnr.dll" = true
(89.83% in signature vs 65.95% overall) Module "softokn3.dll" = true
(89.83% in signature vs 66.78% overall) Module "freebl3.dll" = true
(56.90% in signature vs 33.08% overall) os_arch = amd64
(74.33% in signature vs 51.50% overall) Module "netutils.dll" = true
(61.26% in signature vs 38.78% overall) Module "srvcli.dll" = true
(100.0% in signature vs 82.05% overall) shutdown_progress = null
(93.70% in signature vs 73.80% overall) build_id = 20161222080852
(76.27% in signature vs 54.93% overall) Module "Wpc.dll" = true
(47.46% in signature vs 26.24% overall) Module "d3d9.dll" = true
(34.38% in signature vs 14.11% overall) Module "igd10iumd32.dll" = true
(34.14% in signature vs 14.71% overall) "DXVA2D3D9?" in app_notes = true
(35.11% in signature vs 16.25% overall) Module "ncrypt.dll" = true
(37.29% in signature vs 18.69% overall) Module "wkscli.dll" = true
(29.78% in signature vs 12.37% overall) "DXVA2D3D9+" in app_notes = true
(30.27% in signature vs 13.09% overall) Module "igdusc32.dll" = true

Top words: stac, responding, works, say, sometim, sudden, freez, stop, get

Comment 4

[Astley Chen (inactive)]

[Tracking Requested - why for this release]: Elevate to P1 based on comment 3.

Comment 6

[Gerry Chang [:gchang]]

Track 51- as bug 1308800 is tracked in 51.

Comment 7

[Jan de Mooij [:jandem]]

See bug 1308800 comment 53.

It's a bogus signature. This is actually a crash in JIT code that confuses the stack walker. That also explains the spikes in comment 3.