Closed Bug 485424 Opened 11 years ago Closed 10 years ago

Crash [@ js_RecordTree]

Categories

(Core :: JavaScript Engine, defect, critical)

x86
macOS
defect
Not set
critical

Tracking

()

RESOLVED WORKSFORME
Tracking Status
status1.9.1 --- wanted

People

(Reporter: sdwilsh, Unassigned)

References

()

Details

(Keywords: crash, intermittent-failure)

Crash Data

Attachments

(1 file)

Attached file backtrace
Seen on tinderbox.
According to Waldo this is sporadic.

According to shaver this may trigger it:

make mochitest-plain 
TEST_PATH=dom/tests/mochitest/ajax/offline/test_offlineMode.html
Whiteboard: [orange]
3286 JS_REQUIRES_STACK bool
3287 js_RecordTree(JSContext* cx, JSTraceMonitor* tm, Fragment* f, jsbytecode* outer,
3288               uint32 globalShape, SlotList* globalSlots)
3289 {
3290     JS_ASSERT(f->root == f);
3291 
3292     /* Make sure the global type map didn't change on us. */
3293     JSObject* globalObj = JS_GetGlobalForObject(cx, cx->fp->scopeChain);
3294     if (!js_CheckGlobalObjectShape(cx, tm, globalObj)) {
3295         js_FlushJITCache(cx);
3296         return false;
3297     }
3298 
3299     AUDIT(recorderStarted);
3300 
3301     /* Try to find an unused peer fragment, or allocate a new one. */
3302     while (f->code() && f->peer)
3303         f = f->peer;
3304     if (f->code())
3305         f = getAnchor(&JS_TRACE_MONITOR(cx), f->root->ip, globalShape);

f->root->ip is null maybe?  JS_TRACE_MONITOR seems much less plausible, not that either is particularly so.
(Crash is on 3305 according to stack.)
Are you sure the line numbers are in sync?
Yes, the build failure log said it was revision 1197710c68e7, and <http://hg.mozilla.org/mozilla-central/file/1197710c68e7/js/src/jstracer.cpp> confirms.
Blocks: 438871
Severity: normal → critical
Keywords: crash
Summary: Crash @js_RecordTree → Crash [@ js_RecordTree]
Flags: wanted1.9.1.x?
Flags: wanted1.9.1.x?
Since Andreas couldn't make sense of the stack, and this hasn't been seen since, I'm marking this bug as worksforme.
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → WORKSFORME
Crash Signature: [@ js_RecordTree]
Whiteboard: [orange]
You need to log in before you can comment on or make changes to this bug.