490041 - random talos Tp crash [@ nanojit::StackFilter::read]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

http://tinderbox.mozilla.org/showlog.cgi?tree=Firefox&errorparser=unix&logfile=1240580216.1240587974.27571.gz&buildtime=1240580216&buildname=WINNT%205.1%20talos%20mozilla-central%20qm-pxp-trunk01&fulltext=1
WINNT 5.1 talos mozilla-central qm-pxp-trunk01 on 2009/04/24 06:36:56  

This tinderbox log contains a random crash.  The last talos output before the crash was:

NOISE: Cycle 3: loaded http://localhost/page_load_test/pages/www.yesky.com/www.yesky.com/index.html (next: http://localhost/page_load_test/pages/www.information.com/www.information.com/index.html)
NOISE: Cycle 3: loaded http://localhost/page_load_test/pages/www.information.com/www.information.com/index.html (next: http://localhost/page_load_test/pages/www.msn.com.br/br.msn.com/index.html)

(the second of these lines was actually split by the crash reporting output)

The stack on the crashing thread was:

Thread 0 (crashed)
 0  js3250.dll!nanojit::StackFilter::read() [LIR.cpp:6be4295f5ac9 : 1188 + 0x11]
    eip = 0x00343602   esp = 0x0012ef78   ebp = 0x0012f0e8   ebx = 0x0012f12c
    esi = 0x033622f8   edi = 0x03362370   eax = 0xff800000   ecx = 0x00000003
    edx = 0x0136236c   efl = 0x00010206
 1  js3250.dll!nanojit::StackFilter::read() [LIR.cpp:6be4295f5ac9 : 1179 + 0xf]
    eip = 0x00343400   esp = 0x0012ef90   ebp = 0x0012f100
 2  js3250.dll!nanojit::Assembler::gen(nanojit::LirFilter *,avmplus::List<unsigned char *,0> &) [Assembler.cpp:6be4295f5ac9 : 1076 + 0x17]
    eip = 0x00341ce8   esp = 0x0012efa8   ebp = 0x0012f12c
 3  js3250.dll!nanojit::Assembler::assemble(nanojit::Fragment *,avmplus::List<unsigned char *,0> &) [Assembler.cpp:6be4295f5ac9 : 850 + 0x33]
    eip = 0x0034b0c3   esp = 0x0012f0c4   ebp = 0x00000004
 4  js3250.dll!nanojit::compile(nanojit::Assembler *,nanojit::Fragment *) [LIR.cpp:6be4295f5ac9 : 2149 + 0xd]
    eip = 0x0034aa86   esp = 0x0012f15c   ebp = 0x007b7000
 5  js3250.dll!TraceRecorder::compile(JSTraceMonitor *) [jstracer.cpp:6be4295f5ac9 : 2674 + 0xc]
    eip = 0x0034b161   esp = 0x0012f1a8   ebp = 0x048e0ac0
 6  js3250.dll!TraceRecorder::closeLoop(JSTraceMonitor *,bool &) [jstracer.cpp:6be4295f5ac9 : 2806 + 0xc]
    eip = 0x0033e3e1   esp = 0x0012f1c0   ebp = 0x048e0ac0
 7  js3250.dll!TraceRecorder::checkTraceEnd(unsigned char *) [jstracer.cpp:6be4295f5ac9 : 3105 + 0x14]
    eip = 0x0033e8a3   esp = 0x0012f1e0   ebp = 0x0012f22c
 8  js3250.dll!TraceRecorder::monitorRecording(JSContext *,TraceRecorder *,JSOp) [jsopcode.tbl:6be4295f5ac9 : 120 + 0x15]
    eip = 0x0032489a   esp = 0x0012f200   ebp = 0x0012f22c
 9  js3250.dll!js_Interpret [jsinterp.cpp:6be4295f5ac9 : 3015 + 0x7]
    eip = 0x0031b84c   esp = 0x0012f234   ebp = 0x0012f41c
10  js3250.dll!js_Execute [jsinterp.cpp:6be4295f5ac9 : 1599 + 0x5]
    eip = 0x00300e33   esp = 0x0012f424   ebp = 0x00000000
11  js3250.dll!JS_EvaluateUCScriptForPrincipals [jsapi.cpp:6be4295f5ac9 : 5145 + 0x10]
    eip = 0x002eee21   esp = 0x0012f4a8   ebp = 0x0012f4cc
12  xul.dll!nsJSContext::EvaluateString(nsAString_internal const &,void *,nsIPrincipal *,char const *,unsigned int,unsigned int,nsAString_internal *,int *) [nsJSEnvironment.cpp:6be4295f5ac9 : 1603 + 0x45]
    eip = 0x10193e37   esp = 0x0012f4d4   ebp = 0x0012f540
13  xul.dll!nsScriptLoader::EvaluateScript(nsScriptLoadRequest *,nsString const &) [nsScriptLoader.cpp:6be4295f5ac9 : 686 + 0x3b]
    eip = 0x1006144e   esp = 0x0012f548   ebp = 0x0012f5f4
14  xul.dll!nsScriptLoader::ProcessRequest(nsScriptLoadRequest *) [nsScriptLoader.cpp:6be4295f5ac9 : 600 + 0x9]
    eip = 0x10016d25   esp = 0x0012f5fc   ebp = 0x0012f630
15  xul.dll!nsScriptLoader::ProcessScriptElement(nsIScriptElement *) [nsScriptLoader.cpp:6be4295f5ac9 : 554 + 0x7]
    eip = 0x10195c89   esp = 0x0012f6ac   ebp = 0x0012f630

Comment 1

[Shawn Wilsher :sdwilsh]

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1241696198.1241708996.16229.gz&fulltext=1
WINNT 6.0 talos mozilla-central nochrome qm-pvista-trunk04 on 2009/05/07 04:36:38

Comment 2

[Andreas Gal :gal]

Graydon has a patch that might help this. Its not in m-c yet I believe, but its in TM.

Comment 3

[Graydon Hoare :graydon]

Bug in question is 491514. There are a potentially a number of topcrashes and whatnot that are dying mid-LIR-read that it *may* be the cause of. Hard to tell. It's buffering error (hence orange) and is very dependent on input and environment.

Comment 4

[Nochum Sossonko [:Natch]]

Bug 491514 is fixed, has this been seen since then?