536795 - trunk topcrashes [@ GetPropertyTreeChild] and [@ js_MatchScopeProperty]

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

There are two trunk topcrashes related to the JS property tree; since they regressed on the same day I'm going to assume they're the same underlying problem and file a single bug for both.

There have been a decent number of trunk crash reports lately in js_MatchScopeProperty and GetPropertyTreeChild.  For crash reports, see:

http://crash-stats.mozilla.com/report/list?range_value=31&range_unit=days&signature=js_MatchScopeProperty&version=Firefox%3A3.7a1pre

http://crash-stats.mozilla.com/report/list?range_value=31&range_unit=days&signature=GetPropertyTreeChild&version=Firefox%3A3.7a1pre


It looks like these started happening as a result of a regression that first showed up in mozilla-central nightlies on 2009-12-05.  From 2009-12-05 nightlies to the present, we've been generally seeing 5-20 crashes per nightly build at js_MatchScopeProperty and 5-12 crashes per nightly build in GetPropertyTreeChild.  (There were 2 crashes in GetPropertyTreeChild prior to those nightlies but occurring since November 25; one was on a 2009-12-04 nightly and one on a 2009-11-30 nightly; I'll assume that's just a different bug, though.)

The exact pushlog range for those Windows nightlies is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=65c1582465ef&tochange=d040e38c4107
which is almost entirely a tracemonkey merge.

Comment 1

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

And this looks like the range in which bug 473228 landed on mozilla-central.

Comment 2

[David Mandelin [:dmandelin]]

Looks like a regression from bug 473228 to me too.

Comment 3

[Tanner M. Young [:tmyoung]]

For what it's worth, this frequently happens when I open GMail or a message in GMail (though it doesn't always do it).

http://crash-stats.mozilla.com/report/index/bp-c7be84be-c214-4548-b1bc-fc5aa2100113

Comment 4

[Jason Orendorff [:jorendorff]]

This is most likely bug 533876, which is fixed-in-tracemonkey. But there is a follow-up bug, bug 539829, which I'll prioritize now, having seen this.

Comment 5

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Looks like this might have gone away based on the tracemonkey merge yesterday, but I'll give it another day to be sure.

Comment 6

[Tanner M. Young [:tmyoung]]

(In reply to comment #5)
> Looks like this might have gone away based on the tracemonkey merge yesterday,
> but I'll give it another day to be sure.

I haven't seen anything new since that time, and I had this crash regularly with GMail...

Comment 7

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

So, it looks like the js_MatchScopeProperty crashes were fixed but the GetPropertyTreeChild crashes were NOT fixed.

Comment 8

[Damon Sicore (:damons)]

Can we get an owner here, please?

Comment 9

[chris hofmann]

looks like these are still around in 3.6.x, but fixed by work on the trunk.  At least we don't see any reports with 700k user now running 4.0b6.  removing the betaN+ approval.  renominate if this doesn't look right or someone spots something different.

date     tl crashes at, count build, count build, ...
         GetPropertyTreeChild
20101001 48  34 3.6.102010091412, 
	     3 3.6.82010072215, 2 3.6.62010062523, 
	     2 3.62010011514, 2 3.5.132010091413, 
	     1 3.6.92010082415, 1 3.6.42010061114, 
	     1 3.5.22009072922, 1 3.1b22008120108, 
	     1 3.02008052906, 
20101002 64  46 3.6.102010091412, 
	     4 3.6.82010072215, 3 3.0.192010031422, 
	     2 3.6.42010061114, 1 3.6.62010062523, 
	     1 3.6.32010040108, 1 3.6.22010031607, 
	     1 3.62010011514, 1 3.5b42009042320, 
	     1 3.5.132010091413, 1 3.5.102010050409, 
	     1 3.0b22007121120, 1 3.0.102009042316, 
20101003 65  47 3.6.102010091412, 
	     4 3.5.132010091413, 3 3.6.32010040108, 
	     2 3.6b42009112421, 2 3.6.92010082415, 
	     2 3.0.192010031422, 1 3.6.82010072215, 
	     1 3.6.62010062523, 1 3.62010011514, 
	     1 3.52009062402, 1 3.0.82009032609, 


date     tl crashes at, count build, count build, ...
         js_MatchScopeProperty
20101001 29  20 3.6.102010091412, 
	     2 3.6.82010072215, 2 3.6.62010062522, 
	     2 3.5.132010091413, 1 3.6.92010082414, 
	     1 3.5.112010070101, 1 3.0.192010031422, 
20101002 22  16 3.6.102010091412, 
	     3 3.6.32010040108, 1 3.6b42009112421, 
	     1 3.6.102010091518, 1 3.5.132010091413, 
20101003 26  18 3.6.102010091412, 
	     2 3.5.132010091413, 1 3.6.92010082415, 
	     1 3.6.82010072215, 1 3.6.62010062522, 
	     1 3.6.42010061114, 1 3.5.62009120122, 
	     1 3.0.192010031422,

Comment 10

[Daniel Veditz [:dveditz]]

A top crash fix is nice, and having a potential existing fix is great. We'll take the dependent bug but if it doesn't fix this bug it's not a "blocker".

Comment 11

[Wayne Mery (:wsmwk)]

tomcat, possible for you to hook up a firefox crash reporter to test, via socorro reports or some other source?

I'm checking to see if thunderbird reporter in http://getsatisfaction.com/mozilla_messaging/topics/thunderbird_crashing_on_mac can test trunk. But I have no other leads on people to test.

Comment 12

[Sheila Mooney]

These appear to be all in 3.6. Resolving as works for me.