486271 - crash in [@ js_LockGCThingRT] on 1.9.1 branch

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[John Daggett (:jtd)]

A set of TraceMonkey changes checked in by Sayrer appears to be causing periodic crashes on Windows.  The timestamp of the changes:

[e-mail] – Tue Mar 31 15:49:40 2009 -0700

Full build log:
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox3.5/1238566431.1238570904.10851.gz&fulltext=1

Error output (while running test_word_movement.html mochitest):

Operating system: Windows NT
                  5.2.3790 Service Pack 2
CPU: x86
     GenuineIntel family 6 model 15 stepping 8
     1 CPU

Crash reason:  EXCEPTION_ACCESS_VIOLATION
Crash address: 0xff0

Thread 0 (crashed)
 0  js3250.dll!js_LockGCThingRT [jsgc.cpp:7738ed51c333 : 2361 + 0x8]
    eip = 0x0032ba96   esp = 0x0012ee04   ebp = 0x0012ee24   ebx = 0x01024840
    esi = 0x0a7ffbf8   edi = 0x00000001   eax = 0x01024840   ecx = 0x00000fff
    edx = 0xbed52030   efl = 0x00010206
 1  js3250.dll!JS_LockGCThing [jsapi.cpp:7738ed51c333 : 2040 + 0x10]
    eip = 0x00303a59   esp = 0x0012ee0c   ebp = 0x0012ee24
 2  xul.dll!XPCNativeWrapper::GetNewOrUsed(JSContext *,XPCWrappedNative *,nsIPrincipal *) [XPCNativeWrapper.cpp:7738ed51c333 : 1250 + 0xe]
    eip = 0x1002909d   esp = 0x0012ee2c   ebp = 0x0012ee8c
 3  xul.dll!XPCConvert::NativeInterface2JSObject(XPCCallContext &,int *,nsIXPConnectJSObjectHolder * *,nsISupports *,nsID const *,XPCNativeInterface *,nsWrapperCache *,JSObject *,int,int,unsigned int *) [xpcconvert.cpp:7738ed51c333 : 1260 + 0xe]
    eip = 0x10024e58   esp = 0x0012ef00   ebp = 0x0012ef40   ebx = 0x032a0e20
 4  xul.dll!XPCConvert::NativeData2JS(XPCCallContext &,int *,void const *,nsXPTType const &,nsID const *,JSObject *,unsigned int *) [xpcconvert.cpp:7738ed51c333 : 472 + 0x18]
    eip = 0x100255fb   esp = 0x0012ef48   ebp = 0x0012ef84
 5  xul.dll!XPCWrappedNative::CallMethod(XPCCallContext &,XPCWrappedNative::CallMode) [xpcwrappednative.cpp:7738ed51c333 : 2543 + 0x1a]
    eip = 0x1002c00a   esp = 0x0012ef8c   ebp = 0x0012f0d8
 6  xul.dll!XPC_WN_GetterSetter(JSContext *,JSObject *,unsigned int,int *,int *) [xpcwrappednativejsops.cpp:7738ed51c333 : 1619 + 0xa]
    eip = 0x1002db0b   esp = 0x0012f150   ebp = 0x0012f1a8   ebx = 0x00000000
 7  js3250.dll!js_Invoke [jsinterp.cpp:7738ed51c333 : 1341 + 0x1c]
    eip = 0x0032f404   esp = 0x0012f214   ebp = 0x0012f2c0
 8  js3250.dll!js_InternalInvoke [jsinterp.cpp:7738ed51c333 : 1417 + 0xe]
    eip = 0x0032f586   esp = 0x0012f2c8   ebp = 0x0012f2ec
 9  js3250.dll!js_InternalGetOrSet [jsinterp.cpp:7738ed51c333 : 1480 + 0x15]
    eip = 0x0032f6b6   esp = 0x0012f2f4   ebp = 0x0012f320
10  js3250.dll!js_GetSprop [jsscope.h:7738ed51c333 : 358 + 0x11]
    eip = 0x0033e1fb   esp = 0x0012f328   ebp = 0xffffffff
11  js3250.dll!js_NativeGet [jsobj.cpp:7738ed51c333 : 4131 + 0x1e]
    eip = 0x00343d9e   esp = 0x0012f34c   ebp = 0xffffffff
12  js3250.dll!js_GetPropertyHelper [jsobj.cpp:7738ed51c333 : 4324 + 0x11]
    eip = 0x003442e2   esp = 0x0012f370   ebp = 0x0012f404
13  0x34
    eip = 0x00000035   esp = 0x0012f40c   ebp = 0x00000016

Comment 1

[Peter Van der Beken [:peterv]]

I'm going to back out the patch for bug 484692 to try to fix the orange, a bunch of the sporadic orange started after I landed that.

Comment 2

[John Daggett (:jtd)]

Attachment: set of stack traces for various tinderbox crashes

List of stack traces for crashes on 1.9.1 tinderbox machines, mostly Windows but merely because those were the ones I tracked down.  The changeset is the changeset associated with the build that crashed, this doesn't not imply that these changesets have anything to do with the crashes.

Comment 3

[John Daggett (:jtd)]

The JS_CallTracer bugs may be a separate problem.

Comment 4

[Peter Van der Beken [:peterv]]

This seems to have been fixed by backing out the patch for bug 484692.