487454 - [TM]jit crash while running Tunit

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect, P2)

Description

[Boris Zbarsky [:bzbarsky]]

This just happened on the Linux Tunit box on m-c.  Brief log:

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1239206850.1239211793.16530.gz

Full log:

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1239206850.1239211793.16530.gz&fulltext=1

Stack:

 0  libmozjs.so!nanojit::LIns::oprnd2() const [LIR.h:aa5fd79f36b6 : 329 + 0x0]
    eip = 0x40ebea94   esp = 0xbfd97a4c   ebp = 0xbfd97a4c   ebx = 0x40ed2d34
    esi = 0x00000030   edi = 0x412f6854   eax = 0x3f2f6604   ecx = 0x412f6608
    edx = 0x3f2f6604   efl = 0x00010202
 1  libmozjs.so!TraceRecorder::set(int*, nanojit::LIns*, bool) [jstracer.cpp:aa5fd79f36b6 : 1978 + 0x11]
    eip = 0x40eac15e   esp = 0xbfd97a54   ebp = 0xbfd97a7c
 2  libmozjs.so!TraceRecorder::getProp(JSObject*, nanojit::LIns*) [jstracer.cpp:aa5fd79f36b6 : 5091 + 0x17]
    eip = 0x40eb69c4   esp = 0xbfd97a84   ebp = 0xbfd97aac
 3  libmozjs.so!TraceRecorder::getProp(int&) [jstracer.cpp:aa5fd79f36b6 : 8343 + 0x18]
    eip = 0x40eb6c82   esp = 0xbfd97ab4   ebp = 0xbfd97acc
 4  libmozjs.so!TraceRecorder::monitorRecording(JSContext*, TraceRecorder*, JSOp) [jstracer.cpp:aa5fd79f36b6 : 7326 + 0x18]
    eip = 0x40eb7cc2   esp = 0xbfd97ad4   ebp = 0xbfd97afc
 5  libmozjs.so!js_Interpret [jsinterp.cpp:aa5fd79f36b6 : 2941 + 0x15]
    eip = 0x40e4a377   esp = 0xbfd97b04   ebp = 0xbfd97d6c
 6  libmozjs.so!js_Invoke [jsinterp.cpp:aa5fd79f36b6 : 1388 + 0xa]
    eip = 0x40e5778e   esp = 0xbfd97d74   ebp = 0xbfd97e2c
 7  libmozjs.so!js_fun_apply [jsfun.cpp:aa5fd79f36b6 : 1778 + 0xd]
    eip = 0x40e43cd1   esp = 0xbfd97e34   ebp = 0xbfd97e7c
 8  libmozjs.so!js_Interpret [jsinterp.cpp:aa5fd79f36b6 : 5078 + 0x16]
    eip = 0x40e52001   esp = 0xbfd97e84   ebp = 0xbfd980ec
 9  libmozjs.so!js_Invoke [jsinterp.cpp:aa5fd79f36b6 : 1388 + 0xa]
    eip = 0x40e5778e   esp = 0xbfd980f4   ebp = 0xbfd981ac
10  libmozjs.so!js_fun_apply [jsfun.cpp:aa5fd79f36b6 : 1778 + 0xd]
    eip = 0x40e43cd1   esp = 0xbfd981b4   ebp = 0xbfd981fc
11  libmozjs.so!js_Interpret [jsinterp.cpp:aa5fd79f36b6 : 5078 + 0x16]
    eip = 0x40e52001   esp = 0xbfd98204   ebp = 0xbfd9846c
12  libmozjs.so!js_Invoke [jsinterp.cpp:aa5fd79f36b6 : 1388 + 0xa]
    eip = 0x40e5778e   esp = 0xbfd98474   ebp = 0xbfd9852c
13  libmozjs.so!js_InternalInvoke [jsinterp.cpp:aa5fd79f36b6 : 1441 + 0xc]
    eip = 0x40e57aca   esp = 0xbfd98534   ebp = 0xbfd9857c
14  libmozjs.so!JS_CallFunctionValue [jsapi.cpp:aa5fd79f36b6 : 5224 + 0xd]
    eip = 0x40e1c846   esp = 0xbfd98584   ebp = 0xbfd985bc

The function is an event handler for the load event.

The last line in the log before the crash is:

  *** 6556 INFO TEST-PASS | /tests/content/base/test/test_bug401662.html | style content serialized in plaintext?

so this is crashing in mochitest, presumably while loading whatever comes after test_bug401662.html

The revision being tested was aa5fd79f36b6.

This doesn't seem to be reliably crashing; the previous cycle (testing revision ea23ed5288e6) was green, and nothing in between the two seems related to this.

Comment 1

[Jeff Walden [:Waldo]]

Has this happened more than just this once?

Comment 2

[Jeff Walden [:Waldo]]

No luck reproducing in a VM running Fedora 10; if no one else reports ability to reproduce by end of week I'll close as WFM.

Comment 3

[Andreas Gal :gal]

Potentially a dup of

https://bugzilla.mozilla.org/show_bug.cgi?id=491514

Comment 4

[Jeff Walden [:Waldo]]

WFM or perhaps a dup as noted above, either way not something we can really act on...