587117 - JM: domJQueryBasicFilters in Peacekeeper crashes

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[nemo]

Testing Jägermonkey build:
changeset:   51123:6b4c316095c7
tag:         tip

Crashed running Peacekeeper - narrowed it down in test harness to this test which only crashes if javascript.options.methodjit.content is set to true.

bt for that thread was garbage even though I had a debug build
#0  0x00007fffdb577c4e in ?? ()
... more addresses in 7fff ...
#5  0x0000000000000000 in ?? ()

other threads had symbols.

Once again filing in wrong product due to a relatively recent bugzilla flaw with non-javascript browsers (w3m in this case)

Comment 1

[nemo]

Appears to have been fixed.
Possibly ef8903b263d3 since I think I'd tried abca9f5c49d1 and it was still crashing then.

Comment 2

[David Mandelin [:dmandelin]]

(In reply to comment #1)
> Appears to have been fixed.
> Possibly ef8903b263d3 since I think I'd tried abca9f5c49d1 and it was still
> crashing then.

I think you are right. That was a bad bug where the fix had been accidentally backed out. I'm going to WFM this, but of course reopen if it recurs.

Comment 3

[tomorrow]

Hi.Peacekeeper still crashes on me with todays build on Windows 7 x64 with javascript.options.methodjit.content set to true.

AdapterDeviceID: 0193
AdapterVendorID: 10de
Add-ons: {972ce4c6-7e08-4474-a285-3208198ce6fd}:4.0b6pre
BuildID: 20100911044632
CrashTime: 1284217688
EMCheckCompatibility: true
Email: <removed>
FramePoisonBase: 00000000f0de0000
FramePoisonSize: 65536
InstallTime: 1284217641
Notes: AdapterVendorID: 10de, AdapterDeviceID: 0193

ProductName: Firefox
ReleaseChannel: nightly-tracemonkey
SecondsSinceLastCrash: 66687
StartupTime: 1284217641
Theme: classic/1.0
Throttleable: 1
URL: http://service.futuremark.com/peacekeeper/runTest.action?_=0.1277142416644621
Vendor: Mozilla
Version: 4.0b6pre

This report also contains technical information about the state of the application when it crashed.

Comment 4

[thewolf86]

http://crash-stats.mozilla.com/report/index/bp-79462e1a-4f8d-48a3-84a9-823942100911

Comment 5

[David Mandelin [:dmandelin]]

This is probably x64-only.

Comment 6

[nemo]

Ok, I'm not totally sure why this was reopened.

I *am* getting a crash in peacekeeper, but it seems quite different from the one before.
Also, is in a completely different part of the test.

The crasher I'm now getting is in renderGrid01. 

Program received signal SIGSEGV, Segmentation fault.
js::mjit::ic::GetProp (f=..., index=3496511568)
    at /home/nemo/hg/jaegermonkey/js/src/jsobj.h:1041
1041            js::PropertyIdOp op = getOps()->getProperty;
(gdb) bt
#0  js::mjit::ic::GetProp (f=..., index=3496511568)
    at /home/nemo/hg/jaegermonkey/js/src/jsobj.h:1041
#1  0x00007fffde5f0e70 in ?? ()
#2  0x00007fffe3528f78 in ?? ()
#3  0x0000000000000000 in ?? ()

(gdb) print f
$2 = (VMFrame &) @0x7fffffffd110: {u = {x = {ptr = 0x7fffe3528f78, 
      ptr2 = 0x0, ptr3 = 0x7fffffffd3d8}}, previous = 0x0, 
  unused = 0x7fffca958800, regs = {sp = 0x7fffe49fd260, 
    pc = 0x7fffd12de2b1 "\270", fp = 0x7fffe49fd1e0}, cx = 0x7fffca958800, 
  stackLimit = 0x7fffe4aacd28, entryFp = 0x7fffe49fd048, 
  savedRBX = 0x7fffca958800, savedR15 = 0x0, savedR14 = 0x7fffffffd1e0, 
  savedR13 = 0x0, savedR12 = 0x0, savedRBP = 0x7fffffffd200, 
  savedRIP = 0x7ffff6e57202}

Comment 7

[David Mandelin [:dmandelin]]

(In reply to comment #6)
> Ok, I'm not totally sure why this was reopened.

I think that was a mistake. The new crash you observed is bug 595604. It seems to run fine in current TM nightly, so closing again.

If anyone does see this in a new build, please reopen and post OS, processor type, and STR.