Closed Bug 683664 Opened 8 years ago Closed 4 years ago

crash @ js::types::TypeScript::Sweep

Categories

(Core :: JavaScript Engine, defect, critical)

9 Branch
defect
Not set
critical

Tracking

()

RESOLVED WORKSFORME
Tracking Status
firefox19 - affected

People

(Reporter: marcia, Unassigned)

References

Details

(Keywords: crash, regression, Whiteboard: [TI-regression][unactionable])

Crash Data

https://crash-stats.mozilla.com/report/list?signature=js::types::TypeScript::Sweep%28JSContext*,%20JSScript*%29. Low volume Windows only crash so far related to TI landing.

https://crash-stats.mozilla.com/report/index/b1731643-b462-48b2-9c77-cab0d2110831

Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	js::types::TypeScript::Sweep 	js/src/jsinfer.cpp:5553
1 	xul.dll 	js::mjit::ClearAllFrames 	js/src/methodjit/Retcon.cpp:373
2 	xul.dll 	JSCompartment::sweep 	js/src/jscompartment.cpp:636
3 	xul.dll 	SweepCrossCompartmentWrappers 	js/src/jsgc.cpp:2214
4 	xul.dll 	MarkAndSweep 	js/src/jsgc.cpp:2390
5 	xul.dll 	GCCycle 	js/src/jsgc.cpp:2685
6 	nspr4.dll 	PR_Lock 	nsprpub/pr/src/threads/combined/prulock.c:233
7 	xul.dll 	js_GC 	js/src/jsgc.cpp:2771
8 	xul.dll 	XPCCallContext::XPCCallContext 	js/src/xpconnect/src/xpccallcontext.cpp:63
9 	xul.dll 	JS_CompartmentGC 	js/src/jsapi.cpp:2603
10 	xul.dll 	nsXPConnect::Collect 	js/src/xpconnect/src/nsXPConnect.cpp:414
11 	xul.dll 	nsNavHistory::GetFrecencyTransitionBonus 	toolkit/components/places/nsNavHistory.h:587
12 	xul.dll 	xul.dll@0x2c11bf 	
13 	xul.dll 	nsDocument::DoNotifyPossibleTitleChange 	content/base/src/nsDocument.cpp:5285
14 	nspr4.dll 	MD_CURRENT_THREAD 	nsprpub/pr/src/md/windows/w95thred.c:308
15 	nspr4.dll 	PR_ExitMonitor 	nsprpub/pr/src/threads/prmon.c:132
16 	xul.dll 	nsNavHistory::GetFrecencyTransitionBonus 	toolkit/components/places/nsNavHistory.h:587
17 	xul.dll 	nsXPConnect::GarbageCollect 	js/src/xpconnect/src/nsXPConnect.cpp:422
18 	xul.dll 	nsThread::HasPendingEvents 	xpcom/threads/nsThread.cpp:516
19 	xul.dll 	nsJSContext::GarbageCollectNow 	dom/base/nsJSEnvironment.cpp:3182
20 	xul.dll 	nsNavHistory::GetFrecencyTransitionBonus 	toolkit/components/places/nsNavHistory.h:587
21 	xul.dll 	nsTimerImpl::Fire 	xpcom/threads/nsTimerImpl.cpp:424
22 	xul.dll 	nsTimerEvent::Run 	xpcom/threads/nsTimerImpl.cpp:520
23 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:631
24 	xul.dll 	xul.dll@0x13379f 	
25 	nspr4.dll 	MD_CURRENT_THREAD 	nsprpub/pr/src/md/windows/w95thred.c:308
26 	xul.dll 	MessageLoop::DoWork 	ipc/chromium/src/base/message_loop.cc:412
27 	xul.dll 	xul.dll@0x13379f 	
28 	xul.dll 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:134
29 	xul.dll 	nsCommandLine::EnumerateHandlers 	toolkit/components/commandlines/nsCommandLine.cpp:600
30 	xul.dll 	MessageLoop::RunHandler 	ipc/chromium/src/base/message_loop.cc:201
31 	nspr4.dll 	PR_GetThreadPrivate 	nsprpub/pr/src/threads/prtpd.c:232
32 	xul.dll 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:175
33 	msvcr90.dll 	getenv_helper_nolock 	
34 	xul.dll 	MessageLoop::current 	ipc/chromium/src/base/message_loop.cc:85
35 	xul.dll 	nsBaseAppShell::Run 	widget/src/xpwidgets/nsBaseAppShell.cpp:189
36 	xul.dll 	nsAppStartup::Run 	toolkit/components/startup/nsAppStartup.cpp:224
37 	xul.dll 	XRE_main 	toolkit/xre/nsAppRunner.cpp:3551
38 	kernel32.dll 	kernel32.dll@0x22f70
Crash Signature: [@ js::types::TypeScript::Sweep(JSContext*, JSScript*) ] → [@ js::types::TypeScript::Sweep(JSContext*, JSScript*)] [@ js::types::TypeScript::Sweep(js::FreeOp*, JSScript*)] [@ js::types::TypeScript::Sweep]
OS: Windows 7 → All
Hardware: x86 → All
Summary: Firefox 9.0a1 Crash [@ js::types::TypeScript::Sweep(JSContext*, JSScript*) ] → crash @ js::types::TypeScript::Sweep
Version: Trunk → 9 Branch
I was viewing pictures
19.0a1 (2012-10-18)
bp-74b1eb73-3a19-4279-9a4e-d5e232121021

0	mozjs.dll	js::types::TypeScript::Sweep	js/src/jsinfer.cpp:6303
1	mozjs.dll	JSCompartment::sweep	js/src/jscompartment.cpp:594
2	mozjs.dll	BeginSweepPhase	js/src/jsgc.cpp:3865
3	mozjs.dll	IncrementalCollectSlice	js/src/jsgc.cpp:4372
4	mozjs.dll	GCCycle	js/src/jsgc.cpp:4549
5	mozjs.dll	Collect	js/src/jsgc.cpp:4663
6	mozjs.dll	js::GCSlice	js/src/jsgc.cpp:4703
7	mozjs.dll	js::IncrementalGC	js/src/jsfriendapi.cpp:172
8	xul.dll	nsJSContext::GarbageCollectNow	dom/base/nsJSEnvironment.cpp:2921
9	xul.dll	InterSliceGCTimerFired	dom/base/nsJSEnvironment.cpp:3205
10	xul.dll	nsTimerImpl::Fire	xpcom/threads/nsTimerImpl.cpp:472
11	xul.dll	nsTimerEvent::Run	xpcom/threads/nsTimerImpl.cpp:555
12	xul.dll	nsThread::ProcessNextEvent	xpcom/threads/nsThread.cpp:612 

some other people's
bp-d9ff226d-a12a-4603-9a79-9f1fe2121019
bp-cde7ae19-25b2-43ec-92de-b1e942121020
bp-9361add0-4bfa-4fbd-b3d0-38bcf2121019
It started spiking from 19.0a1/20121014 and is #14 top crasher over the last week. The regression range for the spike is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=90857937b601&tochange=57304bbf9c0e

It's not correlated to an extension or a DLL.

More reports at:
https://crash-stats.mozilla.com/report/list?signature=js%3A%3Atypes%3A%3ATypeScript%3A%3ASweep%28js%3A%3AFreeOp*%2C+JSScript*%29
David/Naveed - can you find somebody to take a look at this JS regression?
bp-d5c80ed8-9e50-4781-9b8a-e42f62121030 19.0a1 (2012-10-18)
started to download a large file via web+local network from iprorecorder on iphone 
(two files downloaded successfully in previous few minutes)
There is no obvious culprit in the the regression range. Unfortunately without a reproducible test there isn't much we can do with this bug now other than continue to monitor it.
After 19.0a1/20121022, the crash volume decreased by 90%. The working range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=1c3e4cb1f754&tochange=48502b61a63e

It's now #52 top crasher over the last 3 days.
It's #42 top browser crasher in 19.0.2, #16 in 20.0b5, and #30 in 21.0a2.
Keywords: topcrash
While loading Deleting Borders (http://www.deletingborders.com/), I hit this bug or bug 854319 or indefinitely hangs.
Crash Signature: [@ js::types::TypeScript::Sweep(JSContext*, JSScript*)] [@ js::types::TypeScript::Sweep(js::FreeOp*, JSScript*)] [@ js::types::TypeScript::Sweep] → [@ js::types::TypeScript::Sweep(JSContext*, JSScript*)] [@ js::types::TypeScript::Sweep(js::FreeOp*, JSScript*)] [@ js::types::TypeScript::Sweep] [@ js::types::TypeSet::sweep(JS::Zone*) ]
Duplicate of this bug: 895530
2011-08-31 11:57:27 PDT 
You marked by bug as a dupe of this bug that was report almost 2 years ago and not fixed.

[url=https://bugzilla.mozilla.org/show_bug.cgi?id=895530]https://bugzilla.mozilla.org/show_bug.cgi?id=895530[/url]

This is not what I call working to fix anything.
(In reply to Gary King from comment #10)
> You marked by bug as a dupe of this bug that was report almost 2 years ago
> and not fixed.
See comment 5 if you want to get it fixed.
Whiteboard: [TI-regression] → [TI-regression][unactionable]
Current Rank (combined signatures):
 * Release: #44
 * Beta:    #32 
 * Aurora:  #42
 * Nightly: #89

This no longer qualifies as a topcrash.
Keywords: topcrash
Assignee: general → nobody
Crash Signature: [@ js::types::TypeScript::Sweep(JSContext*, JSScript*)] [@ js::types::TypeScript::Sweep(js::FreeOp*, JSScript*)] [@ js::types::TypeScript::Sweep] [@ js::types::TypeSet::sweep(JS::Zone*) ] → [@ js::types::TypeScript::Sweep(JSContext*, JSScript*)] [@ js::types::TypeScript::Sweep(js::FreeOp*, JSScript*)] [@ js::types::TypeScript::Sweep] [@ js::types::TypeSet::sweep(JS::Zone*) ] [@ js::types::TypeSet::sweep ]
looks like signature gone after version 27
Status: NEW → RESOLVED
Closed: 4 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.