711262 - Intermittent talos v8 crash [@ js::gc::ScanRope]

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Phil Ringnalda (:philor)]

+++ This bug was initially created as a clone of Bug #710965 +++

https://tbpl.mozilla.org/php/getParsedLog.php?id=7962135&tree=Mozilla-Inbound
Rev4 MacOSX Lion 10.7 mozilla-inbound talos v8 on 2011-12-15 13:43:02 PST for push 3fb1a1208df6

NOISE: Cycle 2: loaded file:///Users/cltbld/talos-slave/talos-data/talos/page_load_test/v8/run-regexp.html (next: file:///Users/cltbld/talos-slave/talos-data/talos/page_load_test/v8/run-splay.html)
NOISE: 
NOISE: __FAILbrowser non-zero return code (256)__FAIL
NOISE: Found crashdump: /var/folders/qd/srwd5f710sj0fcl9z464lkj00000gn/T/tmp_gBhJf/profile/minidumps/E56E03CA-92F8-464B-BC83-AE0DB83E506C.dmp
Operating system: Mac OS X
                  10.7.2 11C74
CPU: amd64
     family 6 model 23 stepping 10
     2 CPUs

Crash reason:  EXC_BAD_ACCESS / KERN_PROTECTION_FAILURE
Crash address: 0x88fc0c8

Thread 0 (crashed)
 0  XUL!js::gc::ScanRope [jsgc.h:3fb1a1208df6 : 643 + 0x3]
    rbx = 0x3366fa60   r12 = 0x057024e8   r13 = 0x336da400   r14 = 0x00000002
    r15 = 0xffffffff   rip = 0x022059c3   rsp = 0x5fbfc130   rbp = 0x5fbfc1f0
 1  XUL!js::GCMarker::drainMarkStack [jsgcmark.cpp:3fb1a1208df6 : 796 + 0x7]
    rbx = 0x3366fa60   r12 = 0x3366fa60   r13 = 0x336da400   r14 = 0x00000002
    r15 = 0xffffffff   rip = 0x02206c15   rsp = 0x5fbfc150   rbp = 0x5fbfc1f0
 2  XUL!GCCycle [jsgc.cpp:3fb1a1208df6 : 2676 + 0x7]
    rbx = 0x0a24b2a0   r12 = 0x0a24b2a8   r13 = 0x05702000   r14 = 0x12ef8000
    r15 = 0x00000001   rip = 0x022031bf   rsp = 0x5fbfc1a0   rbp = 0x5fbfc1f0
 3  XUL!js_GC [jsgc.cpp:3fb1a1208df6 : 2977 + 0xd]
    rbx = 0x05702000   r12 = 0x00000000   r13 = 0x00000001   r14 = 0x12ef8000
    r15 = 0x00000001   rip = 0x0220406e   rsp = 0x5fbfc2d0   rbp = 0x11cd65d0
 4  XUL!nsJSContext::ScriptEvaluated [nsJSEnvironment.cpp:3fb1a1208df6 : 3116 + 0xd]
    rbx = 0x11cd65d0   r12 = 0x00000000   r13 = 0x00000000   r14 = 0x081591a0
    r15 = 0x003cc000   rip = 0x016c23cf   rsp = 0x5fbfc320   rbp = 0x11e79ca0
 5  XUL!nsJSContext::EvaluateString [nsJSEnvironment.cpp:3fb1a1208df6 : 1522 + 0x11]
    rbx = 0x11cd65d0   r12 = 0x5fbfc3a0   r13 = 0x00000000   r14 = 0x081591a0
    r15 = 0x003cc000   rip = 0x016c3e0e   rsp = 0x5fbfc340   rbp = 0x11e79ca0
 6  XUL!nsScriptLoader::EvaluateScript [nsScriptLoader.cpp:3fb1a1208df6 : 901 + 0x3b]
    rbx = 0x090a11a0   r12 = 0x00000000   r13 = 0x5fbfc530   r14 = 0x5fbfc620
    r15 = 0x7dbf4f60   rip = 0x014b7c43   rsp = 0x5fbfc4a0   rbp = 0x04c9f510
 7  XUL!nsScriptLoader::ProcessRequest [nsScriptLoader.cpp:3fb1a1208df6 : 795 + 0xf]
    rbx = 0x5fbfc720   r12 = 0x02c32c20   r13 = 0x04c9f510   r14 = 0x00000000
    r15 = 0x00000001   rip = 0x014b8f28   rsp = 0x5fbfc5f0   rbp = 0x089e1100
 8  XUL!nsScriptLoader::ProcessScriptElement [nsScriptLoader.cpp:3fb1a1208df6 : 741 + 0xf]
    rbx = 0x089e1100   r12 = 0x00000000   r13 = 0x04c9f510   r14 = 0x11adeff8
    r15 = 0x5fbfcda0   rip = 0x014b9ec6   rsp = 0x5fbfc7a0   rbp = 0x7dbf4f60
 9  XUL!nsScriptElement::MaybeProcessScript [nsScriptElement.cpp:3fb1a1208df6 : 182 + 0xa]
    rbx = 0x11adeff8   r12 = 0x04c9f510   r13 = 0x05787800   r14 = 0x5fbfcd20
    r15 = 0x5fbfcda0   rip = 0x014b711d   rsp = 0x5fbfcd00   rbp = 0x5fbfcd50
10  XUL!nsHtml5TreeOpExecutor::RunScript [mozilla-inbound:ement.h:3fb1a1208df6 : 230 + 0x8]
    rbx = 0x11adeff8   r12 = 0x5fbfcdb0   r13 = 0x0b3f7f78   r14 = 0x5fbfce48
    r15 = 0x5fbfcda0   rip = 0x0180f1e7   rsp = 0x5fbfcd90   rbp = 0x1226f540
11  XUL!nsHtml5TreeOpExecutor::RunFlushLoop [nsHtml5TreeOpExecutor.cpp:3fb1a1208df6 : 565 + 0x7]
    rbx = 0x00000006   r12 = 0x1226f540   r13 = 0x0b3f7f78   r14 = 0x5fbfce48
    r15 = 0x1226f620   rip = 0x018109a9   rsp = 0x5fbfce00   rbp = 0x0b3f7f78
12  XUL!nsHtml5ExecutorReflusher::Run [nsHtml5TreeOpExecutor.cpp:3fb1a1208df6 : 94 + 0x8]
    rbx = 0x00331b60   r12 = 0x00000000   r13 = 0x5fbfcee0   r14 = 0x5fbfcf4f
    r15 = 0x00307601   rip = 0x018115fd   rsp = 0x5fbfceb0   rbp = 0x8000ffff

Comment 1

[Ed Morley [:emorley]]

Mass marking whiteboard:[orange] bugs WFM (to clean up TBPL bug suggestions) that:
* Haven't changed in > 6months
* Whose whiteboard contains none of the strings: {disabled,marked,random,fuzzy,todo,fails,failing,annotated,leave open,time-bomb}
* Passed a (quick) manual inspection of bug summary/whiteboard to ensure they weren't a false positive.

I've also gone through and searched for cases where the whiteboard wasn't labelled correctly after test disabling, by using attachment description & basic comment searches. However if the test for which this bug was about has in fact been disabled/annotated/..., please accept my apologies & reopen/mark the whiteboard appropriately so this doesn't get re-closed in the future (and please ping me via IRC or email so I can try to tweak the saved searches to avoid more edge cases).

Sorry for the spam! Filter on: #FFA500