Closed Bug 494326 Opened 11 years ago Closed 8 years ago

intermittent talos crash @nanojit::LIns::oprnd1() soon after www.fanfiction.net

Categories

(Core :: JavaScript Engine, defect)

1.9.1 Branch
x86
Linux
defect
Not set

Tracking

()

RESOLVED WONTFIX

People

(Reporter: karlt, Unassigned)

References

Details

(Keywords: crash, intermittent-failure)

Crash reason:  SIGSEGV
Crash address: 0xb713071e

Thread 0 (crashed)
 0  libmozjs.so!nanojit::LIns::oprnd1() const [LIR.h:a483a69e3096 : 329 + 0x0]
    eip = 0xb713071e   esp = 0xbfa9a338   ebp = 0xbfa9a338   ebx = 0xb7144954
    esi = 0x000001f8   edi = 0xad742eb4   eax = 0xab742ea4   ecx = 0xad742ea8
    edx = 0xab742ea4   efl = 0x00210282
 1  libmozjs.so!nanojit::Assembler::gen(nanojit::LirFilter*, avmplus::List<unsigned char*, (avmplus::ListElementType)0>&) [Assembler.cpp:a483a69e3096 : 1277 + 0x1b]
    eip = 0xb712cae4   esp = 0xbfa9a340   ebp = 0xbfa9a388
 2  libmozjs.so!nanojit::Assembler::assemble(nanojit::Fragment*, avmplus::List<unsigned char*, (avmplus::ListElementType)0>&) [Assembler.cpp:a483a69e3096 : 850 + 0x6]
    eip = 0xb712d03f   esp = 0xbfa9a390   ebp = 0xbfa9a428
 3  libmozjs.so!nanojit::compile(nanojit::Assembler*, nanojit::Fragment*) [LIR.cpp:a483a69e3096 : 2154 + 0xd]
    eip = 0xb712feb9   esp = 0xbfa9a430   ebp = 0xbfa9a488
 4  libmozjs.so!TraceRecorder::compile(JSTraceMonitor*) [jstracer.cpp:a483a69e3096 : 2844 + 0x19]
    eip = 0xb7121b01   esp = 0xbfa9a490   ebp = 0xbfa9a4b8
 5  libmozjs.so!TraceRecorder::closeLoop(JSTraceMonitor*, bool&) [jstracer.cpp:a483a69e3096 : 2978 + 0xc]
    eip = 0xb7122fce   esp = 0xbfa9a4c0   ebp = 0xbfa9a508
 6  libmozjs.so!TraceRecorder::checkTraceEnd(unsigned char*) [jstracer.cpp:a483a69e3096 : 3277 + 0x10]
    eip = 0xb7123104   esp = 0xbfa9a510   ebp = 0xbfa9a548
 7  libmozjs.so!TraceRecorder::ifop() [jstracer.cpp:a483a69e3096 : 5632 + 0xa]
    eip = 0xb7123ee1   esp = 0xbfa9a550   ebp = 0xbfa9a588
 8  libmozjs.so!TraceRecorder::monitorRecording(JSContext*, TraceRecorder*, JSOp) [jstracer.cpp:a483a69e3096 : 6899 + 0x8]
    eip = 0xb712965b   esp = 0xbfa9a590   ebp = 0xbfa9a5b8
 9  libmozjs.so!js_Interpret [jsinterp.cpp:a483a69e3096 : 3038 + 0x15]
    eip = 0xb70b95a1   esp = 0xbfa9a5c0   ebp = 0xbfa9a828
10  libmozjs.so!js_Execute [jsinterp.cpp:a483a69e3096 : 1622 + 0xa]
    eip = 0xb70c5f33   esp = 0xbfa9a830   ebp = 0xbfa9a8c8
11  libmozjs.so!JS_EvaluateUCScriptForPrincipals [jsapi.cpp:a483a69e3096 : 5149 + 0x12]
    eip = 0xb708b8fa   esp = 0xbfa9a8d0   ebp = 0xbfa9a908
12  libxul.so!nsJSContext::EvaluateString(nsAString_internal const&, void*, nsIPrincipal*, char const*, unsigned int, unsigned int, nsAString_internal*, int*) [nsJSEnvironment.cpp:a483a69e3096 : 1628 + 0x1d]
    eip = 0xb7717c34   esp = 0xbfa9a910   ebp = 0xbfa9a9a8

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox3.5/1242943769.1242946409.14828.gz
Fun fun.
Keywords: crash
Whiteboard: [orange]
Tracer has been removed and doesn't show up crash stats.
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → WONTFIX
Whiteboard: [orange]
You need to log in before you can comment on or make changes to this bug.