470892 - TM: Firefox 3.1 b2 crash [@ nanojit::LIns::deref(int)

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[chris hofmann]

This stack signature currently ranks #11 for 3.1b2

Might actually turn out to be several different bugs with the same stack signature, but all end up in a crash at nanojit::LIns::deref ( js/src/nanojit/LIR.cpp:233 )

here is an example of one of the stacks.

comment says: http://v8.googlecode.com/svn/data/benchmarks/v2/run.html

0  	js3250.dll  	nanojit::LIns::deref  	js/src/nanojit/LIR.cpp:233
1 	js3250.dll 	nanojit::LInsHashSet::hashcode 	js/src/nanojit/LIR.cpp:1235
2 	js3250.dll 	nanojit::LInsHashSet::grow 	js/src/nanojit/LIR.cpp:1295
3 	js3250.dll 	nanojit::CseFilter::insImm 	js/src/nanojit/LIR.cpp:1901
4 	js3250.dll 	TraceRecorder::prop 	js/src/jstracer.cpp:6576
5 	js3250.dll 	TraceRecorder::getProp 	js/src/jstracer.cpp:6681
6 	js3250.dll 	TraceRecorder::record_JSOP_GETPROP 	js/src/jstracer.cpp:6112
7 	js3250.dll 	js_Interpret 	js/src/jsopcode.tbl:170
8 	js3250.dll 	js_Invoke 	js/src/jsinterp.cpp:1331
9 	js3250.dll 	js_InternalInvoke 	js/src/jsinterp.cpp:1388
10 	js3250.dll 	JS_CallFunctionValue 	js/src/jsapi.cpp:5242
11 	xul.dll 	nsJSContext::CallEventHandler 	dom/src/base/nsJSEnvironment.cpp:1979
12 	xul.dll 	nsGlobalWindow::RunTimeout 	dom/src/base/nsGlobalWindow.cpp:7661
13 	xul.dll 	nsGlobalWindow::TimerCallback 	dom/src/base/nsGlobalWindow.cpp:7993
14 	xul.dll 	nsTimerImpl::Fire 	xpcom/threads/nsTimerImpl.cpp:420
15 	xul.dll 	nsTimerEvent::Run 	xpcom/threads/nsTimerImpl.cpp:512
16 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:510
17 	xul.dll 	nsBaseAppShell::Run 	widget/src/xpwidgets/nsBaseAppShell.cpp:170
18 	nspr4.dll 	PR_GetEnv 	
19 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:87
20 	firefox.exe 	firefox.exe@0x2197 	
21 	kernel32.dll 	kernel32.dll@0x17066

full list of these is at

http://crash-stats.mozilla.com/report/list?product=Firefox&version=Firefox%3A3.1b2&query_search=signature&query_type=contains&query=&date=&range_value=1&range_unit=weeks&do_query=1&signature=nanojit%3A%3ALIns%3A%3Aderef%28int%29

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

AFAIK, we see these stacks in out of memory situations. CCing dvander and gal.

Comment 2

[Andreas Gal :gal]

Yeah, this looks like out-of-lir condition. I think graydon's latest merge from adobe's nj repository fixes this.

Comment 3

[Robert Sayre]

(In reply to comment #2)
> Yeah, this looks like out-of-lir condition. I think graydon's latest merge from
> adobe's nj repository fixes this.

This WFM