Closed Bug 1491530 Opened 11 months ago Closed 11 months ago

Crash in js::TypeSet::addType

Categories

(Core :: JavaScript: GC, defect, critical)

64 Branch
Unspecified
All
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla64
Tracking Status
firefox-esr60 --- unaffected
firefox62 --- unaffected
firefox63 --- unaffected
firefox64 blocking fixed

People

(Reporter: calixte, Assigned: jonco)

References

(Blocks 1 open bug)

Details

(Keywords: crash, regression, topcrash, Whiteboard: [#jsapi:crashes-retriage])

Crash Data

This bug was filed from the Socorro interface and is
report bp-4eb860a8-aad3-45ca-baf6-b0c190180914.
=============================================================

Top 10 frames of crashing thread:

0 xul.dll js::TypeSet::addType js/src/vm/TypeInference.cpp:720
1 xul.dll js::ConstraintTypeSet::addType js/src/vm/TypeInference.cpp:794
2 xul.dll js::AddTypePropertyId js/src/vm/TypeInference.cpp:3124
3 xul.dll js::UnboxedLayout::makeNativeGroup js/src/vm/UnboxedObject.cpp:692
4 xul.dll js::UnboxedPlainObject::convertToNative js/src/vm/UnboxedObject.cpp:734
5 xul.dll js::TypeNewScript::rollbackPartiallyInitializedObjects js/src/vm/TypeInference.cpp:4423
6 xul.dll js::ObjectGroup::clearNewScript js/src/vm/TypeInference.cpp:3388
7 xul.dll js::UnboxedLayout::makeNativeGroup js/src/vm/UnboxedObject.cpp:624
8 xul.dll js::UnboxedPlainObject::convertToNative js/src/vm/UnboxedObject.cpp:734
9 xul.dll js::UnboxedPlainObject::obj_setProperty js/src/vm/UnboxedObject.cpp:1070

=============================================================

There are 99 crashes (from 89 installations) in nightly 64 starting with buildid 20180913222046. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1490042.

[1] https://hg.mozilla.org/mozilla-central/rev?node=aa3c5d257b1e
Flags: needinfo?(jcoppeard)
Crash Signature: [@ js::TypeSet::addType] → [@ js::TypeSet::addType] [@ <name omitted> | js::ConstraintTypeSet::addType]
OS: Windows 10 → All
Whiteboard: [#jsapi:crashes-retriage]
I can confirm that bug 1490042 caused this.
Assignee: nobody → jcoppeard
Flags: needinfo?(jcoppeard)
Bug 1490042 has been backed out to stop the crashes while this bug is being investigated.
https://hg.mozilla.org/integration/autoland/rev/2b3acad1d831076f4936382ba4216c1c9d43ff63
Status: NEW → RESOLVED
Closed: 11 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla64
Duplicate of this bug: 1492103
You need to log in before you can comment on or make changes to this bug.