507901 - TM: additional crashes at [@ specializeTreesToMissingGlobals(JSContext*, TreeInfo*) ]

Status: RESOLVED INCOMPLETE

(Core :: JavaScript Engine, defect, P2)

Comment 1

[Andreas Gal :gal]

This bug was split off from 503144 to investigate still remaining crashes in specializeTreesToMissingGlobals.

Comment 2

[Andreas Gal :gal]

Report by juanb:

This morning I have been clicking away at url in comment #21, and I was able to
crash consistently on 3.5.1 (Mac) after several reloads (~20). However, I crash
on 3.5.2, although it took more than 60 reloads, sometimes more (up to 100
reloads), sometimes less, depending on how fast I reloaded the page.

http://crash-stats.mozilla.com/report/index/3d0ccfad-e4d1-4217-a20a-453d02090801

Andreas, David, could you take a look before I re-open this?

Comment 3

[Henrik Skupin [:whimboo][⌚️UTC+2]]

The URL Andreas mentioned is:
http://web.inter.nl.net/users/L.B.Kruijswijk/FFsolarcrash/solar.html

Comment 4

[Andreas Gal :gal]

Status: we can reproduce this on Tracemonkey tip (macosx, debug build).

Comment 5

[Daniel Veditz [:dveditz]]

assuming severity matches the bug this spun off from

Please capture a testcase in the bug so we're not hostage to that URL possibly going away on us.

Not blocking on a particular release (.3+) because I'm not sure you'll have a fix by next week's code freeze. But if you do please request approval.

Comment 6

[Samuel Sidler (old account; do not CC)]

Andreas: Can we get an updated status?

Comment 7

[Andreas Gal :gal]

I have to get back to this. This is P1.

Comment 8

[Andreas Gal :gal]

dvander was unable to reproduce this any more on a 64-bit linux debug build

I am unable to reproduce this with a 1.9.2 macosx opt build. I can't test debug since tinderboxes don't build debug builds and I can't build on snowleopard. I reloaded the link above 500 times in 5s intervals.

I think we will not be able to block on this since we are back to not having a stable test case / STR. I will set the QA flag. Maybe Juan can pull off another miracle.

Comment 9

[Nick Thomas [:nthomas] (UTC+12)]

We recently started publishing and keeping 24 hours of debug builds, eg
  http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-central-macosx/1254884194/
Unfortunately the opt and debug builds are mixed up together in the same mozilla-central-macosx/ dir but you can spot the debug builds by looking for a 12M dmg. (A fix for this will land sometime after the freeze). Just m-c at this point.

Comment 10

[Andreas Gal :gal]

Thanks nick. Thats awesome.

Comment 11

[Robert Sayre]

still not reproducible?

Comment 12

[Samuel Sidler (old account; do not CC)]

Any update here? 1.9.1.6 code freeze is scheduled for November 10 at 11:59pm PDT.

Comment 13

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Robert, there is are no more crash reports listed with this signature in the last weeks. I even don't have any change to crash Firefox. Whether with the simplified testcase nor the original website.

Comment 14

[Samuel Sidler (old account; do not CC)]

I guess it was premature to block a 1.9.1 release on this issue. Moving back to "needed".

Comment 15

[Tim Riley [:timr]]

juanb- Can you still reproduce this?  Andreas is looking for some help. 
whimboo- Did you have any success reproducing this with the URL mentioned in comment #3?

Comment 16

[Henrik Skupin [:whimboo][⌚️UTC+2]]

(In reply to comment #15)
> whimboo- Did you have any success reproducing this with the URL mentioned in
> comment #3?

No, that I meant with the testcase which doesn't crash Firefox. I've also used Mozmill to reload that page hundreds of times two weeks ago but no crash happened.

Comment 17

[Robert Sayre]

unblocking since we can't really reproduce and it is not regressing from 191

Comment 18

[Robert Sayre]

do we still have crashes here?

Comment 19

[Brandon Sterne (:bsterne)]

Barely.  30 total crash reports in the past week with this signature.  What can we do to move this bug forward or close it out?