Crash in [@ js::Shape::trace ] while running Tp4 on Linux64

RESOLVED WORKSFORME

Status

()

defect
--
critical
RESOLVED WORKSFORME
9 years ago
7 years ago

People

(Reporter: joe, Unassigned)

Tracking

({intermittent-failure})

Trunk
x86_64
Linux
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1285814457.1285815167.3122.gz

NOISE: Cycle 5: loaded http://localhost/page_load_test/tp4/www.teacup.com/www.teacup.com/index.html (next: http://localhost/page_load_test/tp4/www.expedia.com/www.expedia.com/index.html)
NOISE: Cycle 5: loaded http://localhost/page_load_test/tp4/www.expedia.com/www.expedia.com/index.html (next: http://localhost/page_load_test/tp4/www.forumfree.net/www.forumfree.net/index.html)
NOISE: 
NOISE: __FAILbrowser non-zero return code (256)__FAIL
NOISE: Found crashdump: /tmp/tmpUau0Ie/profile/minidumps/441b898e-9c37-85b1-5ca58859-2a09299e.dmp
Operating system: Linux
                  0.0.0 Linux 2.6.31.5-127.fc12.x86_64 #1 SMP Sat Nov 7 21:11:14 EST 2009 x86_64
CPU: amd64
     family 6 model 23 stepping 10
     2 CPUs

Crash reason:  SIGSEGV
Crash address: 0x302c00000000

Thread 0 (crashed)
 0  libxul.so!js::Shape::trace [jsstr.h:db37d1272fbf : 199 + 0x0]
    rbx = 0x56db35f0   r12 = 0xe6a27610   r13 = 0x52cbb000   r14 = 0xffffffff
    r15 = 0x00000000   rip = 0x65e72f98   rsp = 0xe6a27110   rbp = 0xe6a27610
 1  libxul.so!js_TraceObject [jsscopeinlines.h:db37d1272fbf : 137 + 0xa]
    rbx = 0x56db35f0   r12 = 0xe6a27610   r13 = 0x52cbb000   r14 = 0xffffffff
    r15 = 0x00000000   rip = 0x65e17fdb   rsp = 0xe6a27140   rbp = 0x56db3558
 2  libxul.so!js::gc::MarkChildren [jsgcinlines.h:db37d1272fbf : 199 + 0xc]
    rbx = 0xe6a27610   r12 = 0x00000001   r13 = 0x52cbb000   r14 = 0xffffffff
    r15 = 0x00000000   rip = 0x65e7298d   rsp = 0xe6a271a0   rbp = 0x56db3558
 3  libxul.so!js::Shape::trace [jsgcinlines.h:db37d1272fbf : 280 + 0x27]
    rbx = 0x53fee320   r12 = 0x00000001   r13 = 0x52cbb000   r14 = 0xffffffff
    r15 = 0x00000000   rip = 0x65e7335d   rsp = 0xe6a271d0   rbp = 0xe6a27610
 4  libxul.so!js_TraceObject [jsscopeinlines.h:db37d1272fbf : 137 + 0xa]
    rbx = 0x53fee320   r12 = 0xe6a27610   r13 = 0x52cbb000   r14 = 0xffffffff
    r15 = 0x00000000   rip = 0x65e17fdb   rsp = 0xe6a27200   rbp = 0x44fe8150
 5  libxul.so!js::gc::MarkChildren [jsgcinlines.h:db37d1272fbf : 199 + 0xf]
    rbx = 0xe6a27610   r12 = 0xe6a27610   r13 = 0x00000003   r14 = 0xffffffff
    r15 = 0x00000000   rip = 0x65e17d70   rsp = 0xe6a27260   rbp = 0x44fe8150
 6  libxul.so!js_TraceObject [jsgcinlines.h:db37d1272fbf : 280 + 0x7]
    rbx = 0x00000002   r12 = 0xe6a27610   r13 = 0x00000003   r14 = 0xffffffff
    r15 = 0x00000000   rip = 0x65e1859d   rsp = 0xe6a27290   rbp = 0x44fe82a0
 7  libxul.so!js::gc::MarkChildren [jsgcinlines.h:db37d1272fbf : 199 + 0xf]
    rbx = 0xe6a27610   r12 = 0xe6a27610   r13 = 0x000004c4   r14 = 0xffffffff
    r15 = 0x00000000   rip = 0x65e17d70   rsp = 0xe6a272f0   rbp = 0x44fe82a0
 8  libxul.so!js_TraceObject [jsgcinlines.h:db37d1272fbf : 280 + 0x7]
    rbx = 0x000004b7   r12 = 0xe6a27610   r13 = 0x000004c4   r14 = 0xffffffff
    r15 = 0x00000000   rip = 0x65e1859d   rsp = 0xe6a27320   rbp = 0x44f25af0
 9  libxul.so!js::gc::MarkObject [jsgcinlines.h:db37d1272fbf : 280 + 0x4]
    rbx = 0x00000001   r12 = 0xe6a27610   r13 = 0xe6a2751c   r14 = 0x6343b980
    r15 = 0xe6a2751c   rip = 0x65dee692   rsp = 0xe6a27380   rbp = 0x02000000
10  libxul.so!js::gc::MarkChildren [jsgcinlines.h:db37d1272fbf : 193 + 0xe]
    rbx = 0x44f25e00   r12 = 0xe6a27610   r13 = 0xe6a2751c   r14 = 0x6343b980
    r15 = 0xe6a2751c   rip = 0x65dee52f   rsp = 0xe6a273b0   rbp = 0xe6a27610
11  libxul.so!js::gc::MarkObject [jsgcinlines.h:db37d1272fbf : 280 + 0x4]
    rbx = 0x00000001   r12 = 0xe6a27610   r13 = 0xe6a2751c   r14 = 0x6343b980
    r15 = 0xe6a2751c   rip = 0x65dee692   rsp = 0xe6a273d0   rbp = 0x00000000
12  libxul.so!js::gc::MarkChildren [jsgcinlines.h:db37d1272fbf : 191 + 0xb]
    rbx = 0x44fc0a10   r12 = 0xe6a27610   r13 = 0xe6a2751c   r14 = 0x6343b980
    r15 = 0xe6a2751c   rip = 0x65dee517   rsp = 0xe6a27400   rbp = 0xe6a27610
13  libxul.so!js::gc::MarkObject [jsgcinlines.h:db37d1272fbf : 280 + 0x4]
    rbx = 0x00000001   r12 = 0xe6a27610   r13 = 0xe6a2751c   r14 = 0x6343b980
    r15 = 0xe6a2751c   rip = 0x65dee692   rsp = 0xe6a27420   rbp = 0x00000000
14  libxul.so!js::gc::MarkChildren [jsgcinlines.h:db37d1272fbf : 191 + 0xb]
    rbx = 0x4a9e79a0   r12 = 0xe6a27610   r13 = 0xe6a2751c   r14 = 0x6343b980
    r15 = 0xe6a2751c   rip = 0x65dee517   rsp = 0xe6a27450   rbp = 0xe6a27610
15  libxul.so!js::MarkIfGCThingWord [jsgcinlines.h:db37d1272fbf : 297 + 0x7]
    rbx = 0x00000000   r12 = 0xe6a27610   r13 = 0xe6a2751c   r14 = 0x6343b980
    r15 = 0xe6a2751c   rip = 0x65df5f4a   rsp = 0xe6a27470   rbp = 0x5a349058
16  libxul.so!js::MarkRuntime [jsgc.cpp:db37d1272fbf : 801 + 0x4]
    rbx = 0xe6a27660   r12 = 0xe6b27000   r13 = 0x5a395000   r14 = 0x6343b980
    r15 = 0xe6a2751c   rip = 0x65df2c84   rsp = 0xe6a274b0   rbp = 0x6343b920
17  libxul.so!js_GC [jsgc.cpp:db37d1272fbf : 2283 + 0x9]
    rbx = 0x63444600   r12 = 0x5a349018   r13 = 0x52cbb000   r14 = 0xffffffff
    r15 = 0x52cbb000   rip = 0x65df3f34   rsp = 0xe6a27560   rbp = 0x63444600
18  libxul.so!js_InvokeOperationCallback [jscntxt.cpp:db37d1272fbf : 1867 + 0x9]
    rbx = 0x5a395000   r12 = 0x44fed770   r13 = 0x52cbb000   r14 = 0xffffffff
    r15 = 0x44fed770   rip = 0x65db70c5   rsp = 0xe6a27700   rbp = 0x5a349000
19  libxul.so!js_HandleExecutionInterrupt [jscntxt.cpp:db37d1272fbf : 1904 + 0x4]
    rbx = 0xe6a27750   r12 = 0x44fed770   r13 = 0x00000000   r14 = 0xffffffff
    r15 = 0x44fed770   rip = 0x65db717c   rsp = 0xe6a27730   rbp = 0xe6a277d0
20  libxul.so!js::mjit::stubs::Interrupt [StubCalls.cpp:db37d1272fbf : 1372 + 0x8]
    rbx = 0xe6a27750   r12 = 0x44fed770   r13 = 0x00000000   r14 = 0xffffffff
    r15 = 0x44fed770   rip = 0x65fbc5ad   rsp = 0xe6a27740   rbp = 0xe6a277d0
21  0x7f8e57b0284b
    rbx = 0x581b78c8   r12 = 0x44fed770   r13 = 0x00000000   r14 = 0xffffffff
    r15 = 0x44fed770   rip = 0x57b0284c   rsp = 0xe6a27750   rbp = 0xe6a277d0
Blocks: 438871
No longer depends on: 438871
Summary: Crash in [@ js::Shape::Trace ] while running Tp4 on Linux64 → Crash in [@ js::Shape::trace ] while running Tp4 on Linux64
I got this crash a couple of times with a 20101031 build of Fennec on the N900. Not really sure what I did, when I got the crash, though.
Hasn't happened in over a year.
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → WORKSFORME
Whiteboard: [orange]
You need to log in before you can comment on or make changes to this bug.