494326 - intermittent talos crash @nanojit::LIns::oprnd1() soon after www.fanfiction.net

Status: RESOLVED WONTFIX

(Core :: JavaScript Engine, defect)

Description

[Karl Tomlinson (:karlt)]

Crash reason:  SIGSEGV
Crash address: 0xb713071e

Thread 0 (crashed)
 0  libmozjs.so!nanojit::LIns::oprnd1() const [LIR.h:a483a69e3096 : 329 + 0x0]
    eip = 0xb713071e   esp = 0xbfa9a338   ebp = 0xbfa9a338   ebx = 0xb7144954
    esi = 0x000001f8   edi = 0xad742eb4   eax = 0xab742ea4   ecx = 0xad742ea8
    edx = 0xab742ea4   efl = 0x00210282
 1  libmozjs.so!nanojit::Assembler::gen(nanojit::LirFilter*, avmplus::List<unsigned char*, (avmplus::ListElementType)0>&) [Assembler.cpp:a483a69e3096 : 1277 + 0x1b]
    eip = 0xb712cae4   esp = 0xbfa9a340   ebp = 0xbfa9a388
 2  libmozjs.so!nanojit::Assembler::assemble(nanojit::Fragment*, avmplus::List<unsigned char*, (avmplus::ListElementType)0>&) [Assembler.cpp:a483a69e3096 : 850 + 0x6]
    eip = 0xb712d03f   esp = 0xbfa9a390   ebp = 0xbfa9a428
 3  libmozjs.so!nanojit::compile(nanojit::Assembler*, nanojit::Fragment*) [LIR.cpp:a483a69e3096 : 2154 + 0xd]
    eip = 0xb712feb9   esp = 0xbfa9a430   ebp = 0xbfa9a488
 4  libmozjs.so!TraceRecorder::compile(JSTraceMonitor*) [jstracer.cpp:a483a69e3096 : 2844 + 0x19]
    eip = 0xb7121b01   esp = 0xbfa9a490   ebp = 0xbfa9a4b8
 5  libmozjs.so!TraceRecorder::closeLoop(JSTraceMonitor*, bool&) [jstracer.cpp:a483a69e3096 : 2978 + 0xc]
    eip = 0xb7122fce   esp = 0xbfa9a4c0   ebp = 0xbfa9a508
 6  libmozjs.so!TraceRecorder::checkTraceEnd(unsigned char*) [jstracer.cpp:a483a69e3096 : 3277 + 0x10]
    eip = 0xb7123104   esp = 0xbfa9a510   ebp = 0xbfa9a548
 7  libmozjs.so!TraceRecorder::ifop() [jstracer.cpp:a483a69e3096 : 5632 + 0xa]
    eip = 0xb7123ee1   esp = 0xbfa9a550   ebp = 0xbfa9a588
 8  libmozjs.so!TraceRecorder::monitorRecording(JSContext*, TraceRecorder*, JSOp) [jstracer.cpp:a483a69e3096 : 6899 + 0x8]
    eip = 0xb712965b   esp = 0xbfa9a590   ebp = 0xbfa9a5b8
 9  libmozjs.so!js_Interpret [jsinterp.cpp:a483a69e3096 : 3038 + 0x15]
    eip = 0xb70b95a1   esp = 0xbfa9a5c0   ebp = 0xbfa9a828
10  libmozjs.so!js_Execute [jsinterp.cpp:a483a69e3096 : 1622 + 0xa]
    eip = 0xb70c5f33   esp = 0xbfa9a830   ebp = 0xbfa9a8c8
11  libmozjs.so!JS_EvaluateUCScriptForPrincipals [jsapi.cpp:a483a69e3096 : 5149 + 0x12]
    eip = 0xb708b8fa   esp = 0xbfa9a8d0   ebp = 0xbfa9a908
12  libxul.so!nsJSContext::EvaluateString(nsAString_internal const&, void*, nsIPrincipal*, char const*, unsigned int, unsigned int, nsAString_internal*, int*) [nsJSEnvironment.cpp:a483a69e3096 : 1628 + 0x1d]
    eip = 0xb7717c34   esp = 0xbfa9a910   ebp = 0xbfa9a9a8

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox3.5/1242943769.1242946409.14828.gz

Comment 1

[Andreas Gal :gal]

Fun fun.

Comment 2

[Nick Thomas [:nthomas] (UTC+12)]

Is http://tinderbox.mozilla.org/showlog.cgi?log=Firefox3.5/1243063090.1243075998.16050.gz&fulltext=1 at all similar ? That's win xp, probably on www.msn.com.br

Comment 3

[Tom S [:evilpie]]

Tracer has been removed and doesn't show up crash stats.