Closed Bug 659785 Opened 13 years ago Closed 7 years ago

Crash in js::ValueToNumberSlow [@ js::DefaultValue(JSContext*, JSObject*, JSType, js::Value*) ] (Specific to volume regression)

Categories

(Core :: JavaScript Engine, defect)

5 Branch
x86
Windows 7
defect
Not set
critical

Tracking

()

RESOLVED WORKSFORME
Tracking Status
blocking2.0 --- -
status2.0 --- wanted

People

(Reporter: marcia, Unassigned)

References

Details

(Keywords: crash, regression)

Crash Data

+++ This bug was initially created as a clone of Bug #605033 +++

Same signature has had a dramatic increase in Firefox 5. This is a Residual crash that had some work that was done. Crash volume was low for 4.0.
Now starting in May an uptick on 5.0 and it is pretty volume regression. Needs more investigation.
this is a definite volume 5.0 regression on the same older signature mentioned in the comment 0 clone bug.

on may 10 5.0 crashes with this signature started higher than 4.0.1.

        js::DefaultValue.JSContext...JSObject...JSType,.js::Value..
date     total    breakdown by build
         crashes  count build, count build, ...

20110509 40  	20 4.0.12011041322, 
        		5 5.02011042714, 	3 4.0b112011020314, 
        		3 4.02011031805, 	2 5.0a22011050804, 
        		2 4.0b122011022221, 	1 6.0a12011050903, 
        		1 6.0a12011050803, 	1 4.0b82010121417, 
        		1 4.0b72010110414, 	1 4.0b62010091408, 
20110510 44  	15 5.02011042714, 
        		11 4.0.12011041322, 	6 5.0a22011050904, 
        		2 4.0b72010110414, 	2 4.02011031805, 
        		1 6.0a12011051003, 	1 6.0a12011050903, 
        		1 6.0a12011042203, 	1 6.0a12011041703, 
        		1 4.0b82010121417, 	1 4.0b32010080519, 
        		1 4.0b122011022221, 	1 4.0b112011020314, 


yesterday 5.0 crash volume shows significantly higher with over 100 crashes per day.

20110524 170  	124 5.02011051719, 
        		21 4.0.12011041322, 	7 5.0a22011052304, 
        		4 5.02011042714, 	3 6.0a12011052303, 
        		3 5.0a22011052404, 	2 4.0b102011012116, 
        		1 6.0a12011052403, 	1 6.0a12011052203, 
        		1 5.0a22011052204, 	1 5.0a22011051704, 
        		1 4.0b72010110414, 	1 4.0b62010091408, 

needs to block 5.0.
Version: Trunk → 5 Branch
Summary: Crash in js::ValueToNumberSlow [@ js::DefaultValue(JSContext*, JSObject*, JSType, js::Value*) ] → Crash in js::ValueToNumberSlow [@ js::DefaultValue(JSContext*, JSObject*, JSType, js::Value*) ] (Specific to volume regression)
Turning off PGO seems to have gotten rid of this issue but the underlying crash is still there and likely showing up as EnterMethodJIT.
Crash Signature: [@ js::DefaultValue(JSContext*, JSObject*, JSType, js::Value*) ]
Assignee: general → nobody
Crash Signature: [@ js::DefaultValue(JSContext*, JSObject*, JSType, js::Value*) ] → [@ js::DefaultValue(JSContext*, JSObject*, JSType, js::Value*) ] [@ js::DefaultValue ]
I'm marking this bug as WORKSFORME as bug crashlog signature didn't appear from a long time (over half year) in Firefox (except some obsolete Fx <38).
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.