702901 - Crash in js::types::TypeScriptNesting::~TypeScriptNesting()

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Scoobidiver (away)]

It's #33 top crasher in 9.0b1.
It first appeared in 9.0a1/20110908. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=09935ede3c77&tochange=b7d269a291b6

Stack traces look like:
Frame 	Module 	Signature [Expand] 	Source
0 	mozjs.dll 	js::types::TypeScriptNesting::~TypeScriptNesting 	js/src/jsinfer.cpp:5215
1 	mozjs.dll 	js::types::TypeScript::destroy 	js/src/jsinfer.cpp:6095
2 	mozjs.dll 	JSCompartment::sweep 	js/src/jscompartment.cpp:645
3 	mozjs.dll 	SweepPhase 	js/src/jsgc.cpp:2309
4 	mozjs.dll 	MarkAndSweep 	js/src/jsgc.cpp:2402
5 	mozjs.dll 	GCCycle 	js/src/jsgc.cpp:2645
6 	mozjs.dll 	js_GC 	js/src/jsgc.cpp:2731
7 	mozjs.dll 	JS_CompartmentGC 	js/src/jsapi.cpp:2616
8 	mozjs.dll 	JS_GC 	js/src/jsapi.cpp:2623
9 	xul.dll 	nsXPConnect::Collect 	js/src/xpconnect/src/nsXPConnect.cpp:414
10 	xul.dll 	nsXPConnect::GarbageCollect 	js/src/xpconnect/src/nsXPConnect.cpp:422
11 	xul.dll 	nsJSContext::GarbageCollectNow 	dom/base/nsJSEnvironment.cpp:3189
12 	xul.dll 	nsTimerImpl::Fire 	xpcom/threads/nsTimerImpl.cpp:424
13 	xul.dll 	nsTimerEvent::Run 	xpcom/threads/nsTimerImpl.cpp:520
14 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:631
15 	xul.dll 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:110
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=js%3A%3Atypes%3A%3ATypeScriptNesting%3A%3A~TypeScriptNesting%28%29

Comment 1

[Scoobidiver (away)]

It's now #20 top crasher in 9.0b2.

Comment 2

[Scoobidiver (away)]

It's now #15 top crasher in 9.0b4 and #73 in 10.0a2.

Here are some comments:
"i'am just creating gmail account"
"I was changing my Gmail Inbox Theme and then Firefox crashed."
"using my gmail account .."
"On Google Calendar, Clicking the dropdown submenu of my calendar caused this crash."

Comment 3

[Andreas Gal :gal]

A regression window would probably help here.

Comment 5

[Scoobidiver (away)]

(In reply to Andreas Gal :gal from comment #3)
> A regression window would probably help here.
See comment 0.

Comment 6

[Igor Bukanov]

IIRC correctly Google started to introduce its new look for GMail around August-September. So if the error reports are about GMail, then the bug in our code could be exposed by those changes and the regression range is not applicable for hunting the bug.

Comment 7

[Alex Keybl [:akeybl]]

QA - could we do some exploratory testing around Gmail? Thanks!

Comment 8

[Brian Hackett [Laid off!]]

It looks like this signature has gone way down in 9.0b5 (or I'm just confused).  In beta 4 there are 473 (out of 89k) crashes and in beta 5 there are 29 (out of 82k).  The regression range is right around the time the TypeScriptNesting stuff landed, so I doubt GMail changes are directly involved.

The TypeScriptNesting structures form a pretty straightforward N-ary tree threaded through a compartment's scripts.  When a script is destroyed its nesting info is destroyed and unlinked from its parent and children.  These crashes are due to state in either the script or the TypeScriptNesting being corrupted somewhere.

Comment 9

[David Mandelin [:dmandelin]]

(In reply to Brian Hackett (:bhackett) from comment #8)
> It looks like this signature has gone way down in 9.0b5 (or I'm just
> confused).  In beta 4 there are 473 (out of 89k) crashes and in beta 5 there
> are 29 (out of 82k).  The regression range is right around the time the
> TypeScriptNesting stuff landed, so I doubt GMail changes are directly
> involved.
> 
> The TypeScriptNesting structures form a pretty straightforward N-ary tree
> threaded through a compartment's scripts.  When a script is destroyed its
> nesting info is destroyed and unlinked from its parent and children.  These
> crashes are due to state in either the script or the TypeScriptNesting being
> corrupted somewhere.

Then this sounds similar to the script corruption we see in some of the GC crashes.

Comment 10

[Tim Taubert [:ttaubert] (inactive)]

https://crash-stats.mozilla.com/report/index/bp-e6295f4f-b753-497e-ac75-e5f342120505

Comment 11

[Mihai Morar, (:MihaiMorar)]

No crashes since FF 15 via Soccoro:

https://crash-stats.mozilla.com/report/list?signature=js%3A%3Atypes%3A%3ATypeScriptNesting%3A%3A~TypeScriptNesting%28%29&product=Firefox&query_type=contains&range_unit=weeks&process_type=any&hang_type=any&date=2013-07-31+11%3A00%3A00&range_value=1

Based on this I'm closing for now.