659785 - Crash in js::ValueToNumberSlow [@ js::DefaultValue(JSContext*, JSObject*, JSType, js::Value*) ] (Specific to volume regression)

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Marcia Knous [:marcia]]

+++ This bug was initially created as a clone of Bug #605033 +++

Same signature has had a dramatic increase in Firefox 5. This is a Residual crash that had some work that was done. Crash volume was low for 4.0.
Now starting in May an uptick on 5.0 and it is pretty volume regression. Needs more investigation.

Comment 1

[chris hofmann]

this is a definite volume 5.0 regression on the same older signature mentioned in the comment 0 clone bug.

on may 10 5.0 crashes with this signature started higher than 4.0.1.

        js::DefaultValue.JSContext...JSObject...JSType,.js::Value..
date     total    breakdown by build
         crashes  count build, count build, ...

20110509 40  	20 4.0.12011041322, 
        		5 5.02011042714, 	3 4.0b112011020314, 
        		3 4.02011031805, 	2 5.0a22011050804, 
        		2 4.0b122011022221, 	1 6.0a12011050903, 
        		1 6.0a12011050803, 	1 4.0b82010121417, 
        		1 4.0b72010110414, 	1 4.0b62010091408, 
20110510 44  	15 5.02011042714, 
        		11 4.0.12011041322, 	6 5.0a22011050904, 
        		2 4.0b72010110414, 	2 4.02011031805, 
        		1 6.0a12011051003, 	1 6.0a12011050903, 
        		1 6.0a12011042203, 	1 6.0a12011041703, 
        		1 4.0b82010121417, 	1 4.0b32010080519, 
        		1 4.0b122011022221, 	1 4.0b112011020314, 


yesterday 5.0 crash volume shows significantly higher with over 100 crashes per day.

20110524 170  	124 5.02011051719, 
        		21 4.0.12011041322, 	7 5.0a22011052304, 
        		4 5.02011042714, 	3 6.0a12011052303, 
        		3 5.0a22011052404, 	2 4.0b102011012116, 
        		1 6.0a12011052403, 	1 6.0a12011052203, 
        		1 5.0a22011052204, 	1 5.0a22011051704, 
        		1 4.0b72010110414, 	1 4.0b62010091408, 

needs to block 5.0.

Comment 2

[Sheila Mooney]

Turning off PGO seems to have gotten rid of this issue but the underlying crash is still there and likely showing up as EnterMethodJIT.

Comment 3

[Virtual_ManPL [:Virtual] 🇵🇱 - (please needinfo? me - so I will see your comment/reply/question/etc.)]

I'm marking this bug as WORKSFORME as bug crashlog signature didn't appear from a long time (over half year) in Firefox (except some obsolete Fx <38).