677368 - crash [@ js_EmitTree ]

Status: RESOLVED INCOMPLETE

(Core :: JavaScript Engine, defect)

Description

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

This bug was filed from the Socorro interface and is 
report bp-2c4cabf9-43f8-4064-81a6-acb0a2110805 .
============================================================= 
Frame 	Module 	Signature [Expand] 	Source
0 	libmozalloc.so 	mozalloc_abort 	memory/mozalloc/mozalloc_abort.cpp:66
1 	libc-2.5.so 	libc-2.5.so@0x5fcaf 	
2 	libxul.so 	js_EmitTree 	js/src/jshashtable.h:79
3 		@0x44b32d1f 	
4 	libxul.so 	nsLayoutUtils::DrawImage 	layout/base/nsLayoutUtils.cpp:3573
5 	libxul.so 	ImageRenderer::Draw 	layout/base/nsCSSRendering.cpp:3950
6 	libxul.so 	nsCSSRendering::PaintBackgroundWithSC 	layout/base/nsCSSRendering.cpp:2209
7 	libxul.so 	mozilla::layers::BasicShadowableThebesLayer::CreateBuffer 	gfx/layers/basic/BasicLayers.cpp:2132
8 	libxul.so 	mozilla::layers::BasicThebesLayerBuffer::CreateBuffer 	gfx/layers/basic/BasicLayers.cpp:786
9 	libxul.so 	mozilla::layers::ThebesLayerBuffer::BeginPaint 	gfx/layers/ThebesLayerBuffer.cpp:273
10 	libxul.so 	mozilla::layers::BasicThebesLayer::PaintThebes 	gfx/layers/basic/BasicLayers.cpp:706
11 	libxul.so 	mozilla::layers::BasicLayerManager::PaintLayer 	gfx/layers/basic/BasicLayers.cpp:1703
12 	libxul.so 	mozilla::layers::BasicLayerManager::PaintLayer 	gfx/layers/basic/BasicLayers.cpp:1715
13 	libxul.so 	mozilla::layers::BasicLayerManager::PaintLayer 	gfx/layers/basic/BasicLayers.cpp:1715
14 	libxul.so 	mozilla::layers::BasicLayerManager::EndTransactionInternal 	gfx/layers/basic/BasicLayers.cpp:1576
15 	libxul.so 	mozilla::layers::BasicLayerManager::EndTransaction 	gfx/layers/basic/BasicLayers.cpp:1528
16 	libxul.so 	mozilla::layers::BasicShadowLayerManager::EndTransaction 	gfx/layers/basic/BasicLayers.cpp:3054
17 	libxul.so 	nsDisplayList::PaintForFrame 	layout/base/nsDisplayList.cpp:630
18 	libxul.so 	nsDisplayList::PaintRoot 	layout/base/nsDisplayList.cpp:541
19 	libxul.so 	nsLayoutUtils::PaintFrame 	layout/base/nsLayoutUtils.cpp:1638
20 	libxul.so 	PresShell::Paint 	layout/base/nsPresShell.cpp:6157
21 	libxul.so 	nsViewManager::RenderViews 	view/src/nsViewManager.cpp:416
22 	libxul.so 	nsViewManager::Refresh 	view/src/nsViewManager.cpp:391
23 	libxul.so 	nsViewManager::DispatchEvent 	view/src/nsViewManager.cpp:894
24 	libxul.so 	HandleEvent 	view/src/nsView.cpp:159
25 	libxul.so 	mozilla::widget::PuppetWidget::DispatchEvent 	widget/src/xpwidgets/PuppetWidget.cpp:323
26 	libxul.so 	mozilla::widget::PuppetWidget::DispatchPaintEvent 	widget/src/xpwidgets/PuppetWidget.cpp:544
27 	libxul.so 	mozilla::widget::PuppetWidget::PaintTask::Run 	widget/src/xpwidgets/PuppetWidget.cpp:583
28 	libxul.so 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:631
29 	libxul.so 	NS_ProcessNextEvent_P 	obj-firefox/xpcom/build/nsThreadUtils.cpp:245
30 	libxul.so 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:110
31 	libxul.so 	mozilla::ipc::MessagePumpForChildProcess::Run 	ipc/glue/MessagePump.cpp:229
32 	libxul.so 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:221
33 	libxul.so 	nsBaseAppShell::Run 	widget/src/xpwidgets/nsBaseAppShell.cpp:189
34 	libxul.so 	XRE_RunAppShell 	toolkit/xre/nsEmbedFunctions.cpp:673
35 	libxul.so 	mozilla::ipc::MessagePumpForChildProcess::Run 	ipc/glue/MessagePump.cpp:215
36 	libxul.so 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:221
37 	libxul.so 	XRE_InitChildProcess 	toolkit/xre/nsEmbedFunctions.cpp:512
38 	plugin-container 	main 	ipc/app/MozillaRuntimeMain.cpp:81
39 	libc-2.5.so 	libc-2.5.so@0x14973 	
40 	libc-2.5.so 	libc-2.5.so@0x120fff 	
41 	plugin-container 	plugin-container@0x1017 	
42 	libc-2.5.so 	libc-2.5.so@0x14927 	
43 	libc-2.5.so 	libc-2.5.so@0x2d473 	
44 	libc-2.5.so 	libc-2.5.so@0x14e9f 	
45 	libxul.so 	__static_initialization_and_destruction_0 	js/src/jstracer.cpp:601
46 	ld-2.5.so 	ld-2.5.so@0xd8ab 	
47 	libc-2.5.so 	libc-2.5.so@0xb23b 	
48 	ld-2.5.so 	ld-2.5.so@0xe247

More Reports: 
https://crash-stats.mozilla.com/report/list?range_value=7&range_unit=days&date=2011-08-08%2002%3A00%3A00&signature=mozalloc_abort%20%7C%20libc-2.5.so%400x5fcaf&version=Fennec%3A8.0a1

Comment 1

[Martijn Wargers (dead)]

I asked on irc, if this was an oom crash.
I got this reply from azakai:
[00:33]	<azakai>	mw22: not necessarily
[00:34]	<mw22>	ok
[00:34]	<mw22>	azakai, this crash then? https://crash-stats.mozilla.com/report/index/2c4cabf9-43f8-4064-81a6-acb0a2110805
[00:36]	<azakai>	mw22: it's hard to tell since we are missing frames 1 and 3. and frame 2 doesn't make much sense actually
[00:37]	<mw22>	oh, ok. why are these frames missing?
[00:38]	<azakai>	there are several reasons why we get bad stack traces on android, one is that there are no debug symbols for the system libraries (frame 1), and that leads to confusion in other frames as well
[00:38]	<azakai>	there is some discussion in bug 662936 and its dependencies

Comment 2

[Terrence Cole [:terrence]]

This stack is missing more than a couple frames: I've no idea how you could possibly get from DrawImage to js parsing. There are no STR here and EmitTree appears to not even exist anymore. Please re-open if this is still an issue.