623935 - Fennec crash [@ js::TraceRecorder::~TraceRecorder ] on armv6

Status: RESOLVED WONTFIX

(Core :: JavaScript Engine, defect)

Description

[Scoobidiver (away)]

It is a new crash signature that first appeared in Fennec 4.0b4pre/20110105.
It is #5 top crasher in Fennec 4.0b4pre for the last week.

Signature	js::TraceRecorder::~TraceRecorder
UUID	37e89885-6ee3-4521-8b6d-769212110107
Time 	2011-01-07 00:32:34.477157
Uptime	157
Install Age	154 seconds since version was first installed.
Product	Fennec
Version	4.0b4pre
Build ID	20110106042357
Branch	2.0
OS	Linux
OS Version	0.0.0 Linux 2.6.29 #31 Sun Nov 7 00:01:53 MSK 2010 armv6l
CPU	arm
Crash Reason	SIGILL
Crash Address	0x428d3dc8
App Notes 	nothumb Build
SAMSUNG GT-I5700
/passion/passion/mahimahi:2.2/FRF91/43546:user/release-keys

Frame 	Module 	Signature [Expand] 	Source
0 		@0x428d3dc8 	
1 	libxul.so 	js::TraceRecorder::~TraceRecorder 	js/src/jsutil.h:221
2 		@0x497f9fff 	
3 	libxul.so 	js::FindVMCompatiblePeer 	js/src/jstracer.cpp:6288
4 	libxul.so 	js::RecordLoopEdge 	js/src/jstracer.cpp:7098
5 	libxul.so 	js::Interpret 	js/src/jsinterp.cpp:2929
6 	libxul.so 	js::Invoke 	js/src/jsinterp.cpp:657
7 	libxul.so 	js::ExternalInvoke 	js/src/jsinterp.cpp:858
8 	libxul.so 	JS_CallFunctionValue 	js/src/jsinterp.h:961
9 	libxul.so 	nsXPCWrappedJSClass::CallQueryInterfaceOnJSObject 	js/src/xpconnect/src/xpcwrappedjsclass.cpp:312
10 	libxul.so 	nsXPCWrappedJSClass::DelegatedQueryInterface 	js/src/xpconnect/src/xpcwrappedjsclass.cpp:798
11 	libxul.so 	nsXPCWrappedJS::QueryInterface 	js/src/xpconnect/src/xpcwrappedjs.cpp:187
12 	libxul.so 	nsXPTCStubBase::QueryInterface 	xpcom/reflect/xptcall/src/xptcall.cpp:53
13 	libxul.so 	nsQueryInterface::operator 	nsCOMPtr.cpp:47
14 	libxul.so 	nsCOMPtr_base::assign_from_qi 	nsCOMPtr.cpp:96
15 	libxul.so 	XPCWrappedNative::GetNewOrUsed 	nsCOMPtr.h:681
16 	libxul.so 	XPCConvert::NativeInterface2JSObject 	js/src/xpconnect/src/xpcconvert.cpp:1307
17 	libxul.so 	NativeInterface2JSObject 	js/src/xpconnect/src/nsXPConnect.cpp:1212
18 	libxul.so 	nsXPConnect::WrapNative 	js/src/xpconnect/src/nsXPConnect.cpp:1246
19 	libxul.so 	nsJSCID::GetService 	js/src/xpconnect/src/xpcjsid.cpp:847
20 	libxul.so 	NS_InvokeByIndex_P 	xpcom/reflect/xptcall/src/md/unix/xptcinvoke_arm.cpp:198
21 	libxul.so 	XPCWrappedNative::CallMethod 	js/src/xpconnect/src/xpcwrappednative.cpp:3064
22 	libxul.so 	XPC_WN_CallMethod 	js/src/xpconnect/src/xpcwrappednativejsops.cpp:1588
23 	libxul.so 	js::Interpret 	js/src/jscntxtinlines.h:685
24 	libxul.so 	js::Invoke 	js/src/jsinterp.cpp:657
25 	libxul.so 	js::ExternalInvoke 	js/src/jsinterp.cpp:858
26 	libxul.so 	JS_CallFunctionValue 	js/src/jsinterp.h:961
27 	libxul.so 	nsJSContext::CallEventHandler 	dom/base/nsJSEnvironment.cpp:2194
28 	libxul.so 	nsJSEventListener::HandleEvent 	dom/src/events/nsJSEventListener.cpp:228
29 	libxul.so 	nsEventListenerManager::HandleEventSubType 	content/events/src/nsEventListenerManager.cpp:1114
30 	libxul.so 	nsEventListenerManager::HandleEventInternal 	content/events/src/nsEventListenerManager.cpp:1209
31 	libxul.so 	nsEventTargetChainItem::HandleEvent 	content/events/src/nsEventListenerManager.h:146
32 	libxul.so 	nsEventTargetChainItem::HandleEventTargetChain 	content/events/src/nsEventDispatcher.cpp:341
33 	libxul.so 	nsEventDispatcher::Dispatch 	content/events/src/nsEventDispatcher.cpp:628
34 	libxul.so 	DocumentViewerImpl::LoadComplete 	layout/base/nsDocumentViewer.cpp:1034
35 	libxul.so 	nsDocShell::EndPageLoad 	docshell/base/nsDocShell.cpp:6040
36 	libxul.so 	nsDocShell::OnStateChange 	docshell/base/nsDocShell.cpp:5894
37 	libxul.so 	nsDocLoader::FireOnStateChange 	uriloader/base/nsDocLoader.cpp:1334
38 	libxul.so 	nsDocLoader::doStopDocumentLoad 	uriloader/base/nsDocLoader.cpp:942
39 	libxul.so 	nsDocLoader::DocLoaderIsEmpty 	uriloader/base/nsDocLoader.cpp:818
40 	libxul.so 	nsDocLoader::OnStopRequest 	uriloader/base/nsDocLoader.cpp:702
41 	libxul.so 	nsLoadGroup::RemoveRequest 	netwerk/base/src/nsLoadGroup.cpp:680
42 	libxul.so 	imgRequestProxy::RemoveFromLoadGroup 	modules/libpr0n/src/imgRequestProxy.cpp:222
43 	libxul.so 	imgRequestProxy::OnStopRequest 	modules/libpr0n/src/imgRequestProxy.cpp:718
44 	libxul.so 	imgRequest::OnStopRequest 	modules/libpr0n/src/imgRequest.cpp:960
45 	libxul.so 	ProxyListener::OnStopRequest 	modules/libpr0n/src/imgLoader.cpp:2008
46 	libxul.so 	nsJARChannel::OnStopRequest 	modules/libjar/nsJARChannel.cpp:906
47 	libxul.so 	nsInputStreamPump::OnStateStop 	netwerk/base/src/nsInputStreamPump.cpp:578
48 	libxul.so 	nsInputStreamPump::OnInputStreamReady 	netwerk/base/src/nsInputStreamPump.cpp:403
49 	libxul.so 	nsInputStreamReadyEvent::Run 	xpcom/io/nsStreamUtils.cpp:112
50 	libxul.so 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:633
51 	libxul.so 	NS_ProcessNextEvent_P 	nsThreadUtils.cpp:250
52 	libxul.so 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:110
53 	libxul.so 	MessageLoop::RunInternal 	ipc/chromium/src/base/message_loop.cc:219
54 	libxul.so 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:202
55 	libxul.so 	nsBaseAppShell::Run 	widget/src/xpwidgets/nsBaseAppShell.cpp:192
56 	libxul.so 	nsAppStartup::Run 	toolkit/components/startup/src/nsAppStartup.cpp:191
57 	libxul.so 	XRE_main 	toolkit/xre/nsAppRunner.cpp:3695
58 	libxul.so 	GeckoStart 	toolkit/xre/nsAndroidStartup.cpp:131
59 	libc.so 	libc.so@0x1159b 	
60 	libc.so 	libc.so@0x1107b 	

The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=7f2b60765d01&tochange=c957eb894714

More reports at:
http://crash-stats.mozilla.com/report/list?range_value=4&range_unit=weeks&signature=js%3A%3ATraceRecorder%3A%3A~TraceRecorder

Comment 1

[Josh Matthews [:jdm]]

Every observed crash is armv6.  I recommend not blocking.

Comment 2

[Nicholas Nethercote [inactive]]

(In reply to comment #1)
> Every observed crash is armv6.  I recommend not blocking.

I concur!  We've had a series of weird armv6 crashes in Nanojit that don't make much sense:  bug 612553, bug 591053, bug 612099.  Please see the comments towards the end of bug 612099 that recommend filtering out armv6 crash results, because we're not shipping on that platform.

Comment 3

[Tom S. (please needinfo tschuster)]

Tracer has been removed.