Closed Bug 523423 Opened 15 years ago Closed 13 years ago

Mac topcrash [@ JS_CallTracer ]

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: dbaron, Unassigned)

References

Details

(Keywords: crash, topcrash, Whiteboard: [#12 Mac crash for Firefox 3.5.3])

Crash Data

Crashes in JS_CallTracer (mostly inside of cycle collection-triggered GC) are the #58 topcrash for 3.5.3, but #12 on Mac.  There are some extension correlations.  It's possible this is related to the random crash in bug 514734.
Common locations may be different on Windows and Mac; let's make this about the Mac one.

Most common crash line appears to be:
http://hg.mozilla.org/releases/mozilla-1.9.1/annotate/0da982f65d37/js/src/jsgc.cpp#l2701
OS: All → Mac OS X
Hardware: All → x86
Summary: topcrash [@JS_CallTracer ] → Mac topcrash [@JS_CallTracer ]
Whiteboard: [#12 Mac crash for Firefox 3.5.3]
There are some pretty old crashes (Aug 2008 builds) with signature JS_CallTracer:

http://crash-stats.mozilla.com/report/index/d2fd6f8c-6418-11dd-947a-001321b13766
http://crash-stats.mozilla.com/report/index/75811226-6384-11dd-b5e9-001321b13766
http://crash-stats.mozilla.com/report/index/8ec68205-bc74-4e91-9c76-620212081211

but there are no examples with post-Sep builds until December, when it became common again. 

First Windows crashes (starts with 12-02 build):
http://crash-stats.mozilla.com/report/index/ab12e2c5-99b0-40af-85b9-7b8322081202
http://crash-stats.mozilla.com/report/index/2e78a957-7b3f-4276-9d43-21bee2081204

First Mac crashes (12-06, 12-07 builds):
http://crash-stats.mozilla.com/report/index/4692c575-a356-4c69-82f7-dd6362081206
http://crash-stats.mozilla.com/report/index/c421deb7-89aa-459e-9b90-f81172081208

On 12/02, the crash started happening about every other day. Then, on 12/12, it started happening many times a day. In terms of builds, the crash started happening every build or 2, then all builds from 12/11 on.

If we assume 12/1 is the date of interest (and going back up to 3 days or so), then there is only one JS changeset in that range: bug 454142.

If we think 12/10 had changesets that made the problem worse, then we're probably looking at this merge that happened at 3:23 on 12/11:

http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=eb568873736e&tochange=0492e9f0f973

There's nothing obviously GC-related there. I'm inclined to think the increased frequency was either (a) a function of more users getting the nightlies or (b) a change that somehow further exposed the original bug.
Bug 454142 seems unlikely as the cause of a crash, because all it does is refrain from pushing a NULL GC root in JSScope::add. I looked at the last 3 crash reports on trunk, and they all seem to be crashing trying to deref 'thing' in

  JS_CallTracer(JSTracer *trc, void *thing, uint32 kind)

The Windows crash addresses seem pretty random. My first guess would be that we are tracing objects that have been GC'd (incorrectly) or perhaps objects that have been corrupted. I'll have to see if we have any minidumps, although to date I only know that they can be used on Windows, and we are seeing more of this on Mac.
I experience this crash quite often. E.g. http://crash-stats.mozilla.com/report/index/bp-2a802070-ff8e-42d1-88ac-3c3b42091129

It seems to happen most often when I resume the computer from "deep sleep", i.e. complete hibernation, not the default stand-by mode. (I use http://deepsleep.free.fr/ to easily go into hibernation.) I have a few tabs open, some with Flash. I have the latest Flash version.

Is there anything I can do to help? I am now on the latest Firefox release: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-GB; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5
(In reply to comment #4)
> Is there anything I can do to help? I am now on the latest Firefox release:
> Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-GB; rv:1.9.1.5)
> Gecko/20091102 Firefox/3.5.5

I think this might be a dup of bug 523947. That bug was fixed by a patch that went in on 11/29. If you're interested, you could try a nightly from that date or later (http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/latest-mozilla-central/ should always be later than 10/29 at this point) and see if the problem goes away.
> see if the problem goes away.
Hard to tell. I'm now experiencing Flash crashes (bp-287037c3-ad88-4c50-b43a-3ce322091206) when restoring the session. Maybe that is good news, after all.
The Flash crash from comment 6 went away after rebooting, and the crash from this bug has not come back yet. FWIW.
Blocks: 568405
(In reply to comment #5)

> 
> I think this might be a dup of bug 523947. That bug was fixed by a patch that
> went in on 11/29/09. 

are we still thinking that?  should we close this bug out?

There still are a lot of JS_CallTracer crashes, but I've got a better breakdown of the distribution of the stacks listed in bug 568405.
Summary: Mac topcrash [@JS_CallTracer ] → Mac topcrash [@ JS_CallTracer ]
JS_CallTracer is still #9 crash for Macs in FF 3.6.8
JS_CallTracer is #6 crash overall for TB 3.1.2 (mostly windows), cause TBD

does bug 568405 really offer some hope?
Blocks: 537011
Crash Signature: [@ JS_CallTracer ]
This seems to be completely gone from any new version. Only 1 crash appearing in 5.0.1 in the past 4 weeks. Resolving as works for me since we can assume it's gone.
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.