606423 - crash [@ EnableTraceHintAt ]

Status: RESOLVED FIXED

(Firefox :: Extension Compatibility, defect)

Description

[Scoobidiver (away)]

Build: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0b8pre) Gecko/20101021 Firefox/4.0b8pre

It is a new crash signature that was introduced by 4.0b8pre/20101020 build.
It is #40 top crasher in 4.0b8pre/20101020 build.

Signature	EnableTraceHintAt
UUID	27f7cf2e-95d3-4da1-be90-a7eb52101021
Time 	2010-10-21 19:57:19.534828
Uptime	544
Last Crash	97359 seconds (1.1 days) before submission
Install Age	98456 seconds (1.1 days) since version was first installed.
Product	Firefox
Version	4.0b8pre
Build ID	20101020120347
Branch	2.0
OS	Windows NT
OS Version	5.1.2600 Service Pack 3
CPU	x86
CPU Info	GenuineIntel family 15 model 2 stepping 9
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x0
App Notes 	AdapterVendorID: 1002, AdapterDeviceID: 4150

Frame 	Module 	Signature [Expand] 	Source
0 	mozjs.dll 	EnableTraceHintAt 	js/src/methodjit/InvokeHelpers.cpp:897
1 	mozjs.dll 	js::AttemptCompilation 	js/src/jstracer.cpp:1617
2 	mozjs.dll 	js::TraceRecorder::closeLoop 	js/src/jstracer.cpp:5122
3 	mozjs.dll 	js::TraceRecorder::closeLoop 	js/src/jstracer.cpp:4985
4 	mozjs.dll 	js::TraceRecorder::checkTraceEnd 	js/src/jstracer.cpp:5630
5 	mozjs.dll 	js::TraceRecorder::record_JSOP_MOREITER 	js/src/jstracer.cpp:14725
6 	mozjs.dll 	js::TraceRecorder::monitorRecording 	js/src/jsopcode.tbl:221
7 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:2607
8 	mozjs.dll 	js::MonitorTracePoint 	js/src/jstracer.cpp:16731
9 	mozjs.dll 	RunTracer 	js/src/methodjit/InvokeHelpers.cpp:944
10 	mozjs.dll 	js::mjit::stubs::InvokeTracer 	js/src/methodjit/InvokeHelpers.cpp:1034
11 	mozjs.dll 	js::mjit::EnterMethodJIT 	js/src/methodjit/MethodJIT.cpp:742
12 	mozjs.dll 	CheckStackAndEnterMethodJIT 	js/src/methodjit/MethodJIT.cpp:767
13 	mozjs.dll 	js::mjit::JaegerShot 	js/src/methodjit/MethodJIT.cpp:784
14 	mozjs.dll 	js::RunScript 	js/src/jsinterp.cpp:634
15 	mozjs.dll 	js::Invoke 	js/src/jsinterp.cpp:740
16 	mozjs.dll 	js_fun_call 	js/src/jsfun.cpp:2248
17 		@0x4ac12bc 	
18 	mozjs.dll 	js::mjit::EnterMethodJIT 	js/src/methodjit/MethodJIT.cpp:742
19 	mozjs.dll 	CheckStackAndEnterMethodJIT 	js/src/methodjit/MethodJIT.cpp:767
20 	mozjs.dll 	js::mjit::JaegerShot 	js/src/methodjit/MethodJIT.cpp:784
21 	mozjs.dll 	js::RunScript 	js/src/jsinterp.cpp:634
22 	mozjs.dll 	js::Invoke 	js/src/jsinterp.cpp:740
23 	mozjs.dll 	js_fun_call 	js/src/jsfun.cpp:2248
24 	mozjs.dll 	CallCompiler::generateNativeStub 	js/src/methodjit/MonoIC.cpp:635
25 	mozjs.dll 	js::mjit::ic::NativeCall 	js/src/methodjit/MonoIC.cpp:859
26 		@0x4ad8393 	
27 	mozjs.dll 	js::mjit::EnterMethodJIT 	js/src/methodjit/MethodJIT.cpp:742
28 	mozjs.dll 	CheckStackAndEnterMethodJIT 	js/src/methodjit/MethodJIT.cpp:767
29 	mozjs.dll 	js::mjit::JaegerShot 	js/src/methodjit/MethodJIT.cpp:784
30 	mozjs.dll 	js::RunScript 	js/src/jsinterp.cpp:634
31 	mozjs.dll 	js::Invoke 	js/src/jsinterp.cpp:740
32 	mozjs.dll 	js::ExternalInvoke 	js/src/jsinterp.cpp:855
33 	mozjs.dll 	JS_CallFunctionValue 	js/src/jsapi.cpp:4960
34 	xul.dll 	nsXPCWrappedJSClass::CallMethod 	js/src/xpconnect/src/xpcwrappedjsclass.cpp:1694
35 	xul.dll 	nsXPCWrappedJS::CallMethod 	js/src/xpconnect/src/xpcwrappedjs.cpp:571
36 	xul.dll 	PrepareAndDispatch 	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:114
37 	xul.dll 	SharedStub 	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:141
38 	xul.dll 	nsEventListenerManager::HandleEventSubType 	content/events/src/nsEventListenerManager.cpp:1112

The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=c9df0c5cbf8c&tochange=7aa9763e9d41

More reports at:
http://crash-stats.mozilla.com/report/list?product=Firefox&query_search=signature&query_type=exact&query=&range_value=4&range_unit=weeks&hang_type=any&process_type=any&plugin_field=&plugin_query_type=&plugin_query=&do_query=1&admin=&signature=EnableTraceHintAt

Comment 1

[Marcia Knous [:marcia]]

Heavy correlation in Beta 8 to LastPass, https://addons.mozilla.org/addon/8542). 89% of crashers had that extension. Maybe this one needs to move to extension compatibility?

Comment 2

[David Mandelin [:dmandelin]]

(In reply to comment #1)
> Heavy correlation in Beta 8 to LastPass,
> https://addons.mozilla.org/addon/8542). 89% of crashers had that extension.
> Maybe this one needs to move to extension compatibility?

Seems right to me.

Comment 3

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Attachment: trial patch

I looked over the EnableTraceHintAt code again, and it seems buggy to me now. As far as I can tell, jumpAndTrace isn't called on all loops, so some trace ICs are uninitialized. This code just checks that the trace IC we're using in EnableTraceHintAt actually exists and is valid.

I'd like to try landing this patch on m-c and seeing if the problem goes away over the weekend.

Comment 4

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Dave, could you please set the blocking flag so I can land on m-c? It's a crash and a regression, so it meets the criteria.

Comment 5

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Thanks. Let's see what happens:
http://hg.mozilla.org/tracemonkey/rev/8dc385ffb820
http://hg.mozilla.org/mozilla-central/rev/5344d5110a0f

Comment 6

[Tomas]

And?

Comment 7

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

It looks like it's gone. We had been experiencing ~2 crashes/day, and there haven't been any since 12/30. Before 12/30, there wasn't a single day in the last two weeks without any crashes. So it's pretty unlikely that this is random chance.

It's also possible that this just converted to some other crash. If so, I guess we'll see that in crash-stats and deal with it.

Comment 8

[LegNeato]

As per today's meeting, beta 9 will be a time-based release. Marking these all betaN+. Please move it back to beta9+ if you believe it MUST be in the next beta (ie: trunk is in an unshippable state without this)