Closed Bug 715815 Opened 13 years ago Closed 12 years ago

Intermittent crash [@ JSCompartment::sweepInitialShapeTable] in (at least) browser_bug435788.js, ecma/Date/15.9.5.23-15.js, test_httpsuspend.js, regress-104584.js

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86_64
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: philor, Unassigned)

References

Details

(Keywords: crash, intermittent-failure)

Crash Data

We've got to stop meeting like this.

https://tbpl.mozilla.org/php/getParsedLog.php?id=8365307&tree=Mozilla-Inbound
Rev4 MacOSX Snow Leopard 10.6 mozilla-inbound debug test mochitest-other on 2012-01-05 18:38:01 PST for push 91a8e4c55adb

TEST-UNEXPECTED-FAIL | chrome://mochitests/content/browser/toolkit/mozapps/plugins/tests/browser_bug435788.js | Exited with code 1 during test run
INFO | automation.py | Application ran for: 0:35:12.439888
INFO | automation.py | Reading PID log: /var/folders/Hs/HsDn6a9SG8idoIya6p9mtE+++TI/-Tmp-/tmpU3EqtTpidlog
PROCESS-CRASH | chrome://mochitests/content/browser/toolkit/mozapps/plugins/tests/browser_bug435788.js | application crashed (minidump found)
Crash dump filename: /var/folders/Hs/HsDn6a9SG8idoIya6p9mtE+++TI/-Tmp-/tmptBoYyt/minidumps/F7CC8183-A73D-47A5-A523-38A14E41E82C.dmp
Operating system: Mac OS X
                  10.6.8 10K549
CPU: amd64
     family 6 model 23 stepping 10
     2 CPUs

Crash reason:  EXC_BAD_ACCESS / 0x0000000d
Crash address: 0x0

Thread 0 (crashed)
 0  XUL!JSCompartment::sweepInitialShapeTable [jsgc.h:91a8e4c55adb : 954 + 0x6]
    rbx = 0x28eb5d08   r12 = 0x4d81e0a8   r13 = 0x0000ffca   r14 = 0x1b100000
    r15 = 0x00000000   rip = 0x039cc64c   rsp = 0x5fbfc250   rbp = 0x5fbfc2f0
    Found by: given as instruction pointer in context
 1  XUL!JSCompartment::sweep [jscompartment.cpp:91a8e4c55adb : 470 + 0xe]
    rbx = 0x4981c600   r12 = 0x4981c600   r13 = 0x00a0e5f8   r14 = 0x4981c590
    r15 = 0x0015f630   rip = 0x03861ae4   rsp = 0x5fbfc300   rbp = 0x5fbfc450
    Found by: call frame info
 2  XUL!SweepPhase [jsgc.cpp:91a8e4c55adb : 2763 + 0xe]
    rbx = 0x2435a810   r12 = 0x2435a810   r13 = 0x2435a880   r14 = 0x00000000
    r15 = 0x0015f630   rip = 0x038bee1b   rsp = 0x5fbfc460   rbp = 0x5fbfc4c0
    Found by: call frame info
 3  XUL!GCCycle [jsgc.cpp:91a8e4c55adb : 2867 + 0x18]
    rbx = 0x02aefd00   r12 = 0x23359200   r13 = 0x05183000   r14 = 0x00000000
    r15 = 0x2dd7ca01   rip = 0x038c0172   rsp = 0x5fbfc4d0   rbp = 0x5fbfc670
    Found by: call frame info
 4  XUL!js_GC [jsgc.cpp:91a8e4c55adb : 3163 + 0xe]
    rbx = 0x05183000   r12 = 0x0015f630   r13 = 0x5fbfc6a0   r14 = 0x00000000
    r15 = 0x2dd7ca01   rip = 0x038c0def   rsp = 0x5fbfc680   rbp = 0x5fbfc6f0
    Found by: call frame info
 5  XUL!nsXPConnect::Collect [nsXPConnect.cpp:91a8e4c55adb : 412 + 0x7]
    rbx = 0x174d2000   r12 = 0x0015f630   r13 = 0x5fbfc720   r14 = 0x00000000
    r15 = 0x2dd7cab3   rip = 0x02abbf9d   rsp = 0x5fbfc700   rbp = 0x5fbfc820
    Found by: call frame info
 6  XUL!nsXPConnect::GarbageCollect [nsXPConnect.cpp:91a8e4c55adb : 420 + 0xc]
    rbx = 0x01016400   r12 = 0x00000000   r13 = 0x024617f0   r14 = 0x00000000
    r15 = 0x2dd7cab3   rip = 0x02ab7db1   rsp = 0x5fbfc830   rbp = 0x5fbfc830
    Found by: call frame info
 7  XUL!nsJSContext::GarbageCollectNow [nsJSEnvironment.cpp:91a8e4c55adb : 3243 + 0xc]
    rbx = 0x01016400   r12 = 0x00000000   r13 = 0x024617f0   r14 = 0x00000000
    r15 = 0x2dd7cab3   rip = 0x0246172d   rsp = 0x5fbfc840   rbp = 0x5fbfc850
    Found by: call frame info
 8  XUL!nsTimerImpl::Fire [nsTimerImpl.cpp:91a8e4c55adb : 428 + 0xa]
    rbx = 0x00000002   r12 = 0x50192450   r13 = 0x024617f0   r14 = 0x00000000
    r15 = 0x2dd7cab3   rip = 0x034674eb   rsp = 0x5fbfc860   rbp = 0x5fbfc8e0
    Found by: call frame info

(There's stuff above there in the log, but there's so much noise in any log that I don't know what might be signal.)
https://tbpl.mozilla.org/php/getParsedLog.php?id=8622152&tree=Mozilla-Inbound
Summary: Intermittent crash [@ JSCompartment::sweepInitialShapeTable] in (at least) browser_bug435788.js → Intermittent crash [@ JSCompartment::sweepInitialShapeTable] in (at least) browser_bug435788.js and ecma/Date/15.9.5.23-15.js
Made it a little further:

https://tbpl.mozilla.org/php/getParsedLog.php?id=10734641&tree=Firefox
Rev3 Fedora 12 mozilla-central pgo test xpcshell on 2012-04-08 00:56:19 PDT for push babbc38b7f52

PROCESS-CRASH | /home/cltbld/talos-slave/test/build/xpcshell/tests/netwerk/test/unit/test_httpsuspend.js | application crashed (minidump found)
Crash dump filename: /home/cltbld/talos-slave/test/build/xpcshell/tests/netwerk/test/unit/27966db6-4429-726f-0d963406-5001efb8.dmp
Operating system: Linux
                  0.0.0 Linux 2.6.31.5-127.fc12.i686.PAE #1 SMP Sat Nov 7 21:25:57 EST 2009 i686
CPU: x86
     GenuineIntel family 6 model 23 stepping 10
     2 CPUs

Crash reason:  SIGSEGV
Crash address: 0x6000

Thread 0 (crashed)
 0  xpcshell!free [jemalloc.c : 4478 + 0x0]
    eip = 0x0805b970   esp = 0xbf98ef00   ebp = 0xb4100000   ebx = 0x0805f490
    esi = 0xb761e040   edi = 0x00006000   eax = 0x00000000   ecx = 0x00000003
    edx = 0xb41d5000   efl = 0x00010206
    Found by: given as instruction pointer in context
 1  libxul.so!js::detail::HashTable<const js::InitialShapeEntry, js::HashSet<js::InitialShapeEntry, js::InitialShapeEntry, js::SystemAllocPolicy>::SetOps, js::SystemAllocPolicy>::changeTableSize [Utility.h : 190 + 0xb]
    eip = 0x01f7c42c   esp = 0xbf98ef40   ebp = 0x00000019   ebx = 0x024296c8
    esi = 0x00000100   edi = 0x0000007f
    Found by: call frame info
 2  libxul.so!js::detail::HashTable<const js::InitialShapeEntry, js::HashSet<js::InitialShapeEntry, js::InitialShapeEntry, js::SystemAllocPolicy>::SetOps, js::SystemAllocPolicy>::checkUnderloaded [HashTable.h : 659 + 0xf]
    eip = 0x01f7c535   esp = 0xbf98ef90   ebp = 0x00008000   ebx = 0x024296c8
    esi = 0xb41d5c00   edi = 0xbf98f00c
    Found by: call frame info
 3  libxul.so!JSCompartment::sweepInitialShapeTable [jsscope.cpp:babbc38b7f52 : 1403 + 0xf]
    eip = 0x01f79bfd   esp = 0xbf98efb0   ebp = 0x00008000   ebx = 0x024296c8
    esi = 0xb41d5c00   edi = 0xbf98f00c
    Found by: call frame info
 4  libxul.so!JSCompartment::sweep [jscompartment.cpp:babbc38b7f52 : 511 + 0xe]
    eip = 0x01ee6da2   esp = 0xbf98f040   ebp = 0xb419b000   ebx = 0x024296c8
    esi = 0xb419b000   edi = 0xbf98f120
    Found by: call frame info
 5  libxul.so!SweepPhase [jsgc.cpp:babbc38b7f52 : 3151 + 0x15]
    eip = 0x01f06576   esp = 0xbf98f0e0   ebp = 0xb413d000   ebx = 0x024296c8
    esi = 0xbf98f118   edi = 0xbf98f120
    Found by: call frame info
 6  libxul.so!GCCycle [jsgc.cpp:babbc38b7f52 : 3243 + 0xa]
    eip = 0x01f06b84   esp = 0xbf98f150   ebp = 0xb57f7b20   ebx = 0x024296c8
    esi = 0xb413d000   edi = 0xb413d0e0
    Found by: call frame info
 7  libxul.so!Collect [jsgc.cpp:babbc38b7f52 : 3710 + 0x1b]
    eip = 0x01f0713f   esp = 0xbf98f1e0   ebp = 0xbf98f21c   ebx = 0x024296c8
    esi = 0xb413d000   edi = 0xb413d158
    Found by: call frame info
 8  libxul.so!js::GC [jsgc.cpp:babbc38b7f52 : 3731 + 0x29]
    eip = 0x01f0729d   esp = 0xbf98f240   ebp = 0xbf98f28c   ebx = 0x024296c8
    esi = 0xb57f7b20   edi = 0xb413d000
    Found by: call frame info
 9  libxul.so!js_DestroyContext [jscntxt.cpp:babbc38b7f52 : 285 + 0x17]
    eip = 0x01ee47a1   esp = 0xbf98f260   ebp = 0xbf98f28c   ebx = 0x024296c8
Summary: Intermittent crash [@ JSCompartment::sweepInitialShapeTable] in (at least) browser_bug435788.js and ecma/Date/15.9.5.23-15.js → Intermittent crash [@ JSCompartment::sweepInitialShapeTable] in (at least) browser_bug435788.js, ecma/Date/15.9.5.23-15.js, test_httpsuspend.js
https://tbpl.mozilla.org/php/getParsedLog.php?id=11126999&tree=Mozilla-Inbound
TEST-UNEXPECTED-FAIL | chrome://mochitests/content/browser/toolkit/mozapps/extensions/test/xpinstall/browser_bug540558.js | Exited with code 1 during test run
Crash Signature: [@ JSCompartment::sweepInitialShapeTable]
https://tbpl.mozilla.org/php/getParsedLog.php?id=12785684&tree=Mozilla-Aurora
Summary: Intermittent crash [@ JSCompartment::sweepInitialShapeTable] in (at least) browser_bug435788.js, ecma/Date/15.9.5.23-15.js, test_httpsuspend.js → Intermittent crash [@ JSCompartment::sweepInitialShapeTable] in (at least) browser_bug435788.js, ecma/Date/15.9.5.23-15.js, test_httpsuspend.js, regress-104584.js
Severity: normal → critical
Keywords: crash
https://tbpl.mozilla.org/php/getParsedLog.php?id=13325398&tree=Mozilla-Inbound

TEST-UNEXPECTED-FAIL | /tests/dom/tests/mochitest/dom-level2-core/test_namespaceURI02.html | Exited with code 1 during test run


Operating system: Mac OS X
                  10.6.8 10K549
CPU: amd64
     family 6 model 23 stepping 10
     2 CPUs

Crash reason:  EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
Crash address: 0x5aa67000

Thread 0 (crashed)
 0  XUL!JSCompartment::sweepInitialShapeTable [Heap.h : 963 + 0x9]
    rbx = 0x77dd5570   r12 = 0x4af97488   r13 = 0x5aa45d30   r14 = 0x77ddb000
    r15 = 0x031a7a80   rip = 0x0257da32   rsp = 0x5fbfb020   rbp = 0x5fbfb130
    Found by: given as instruction pointer in context
 1  XUL!JSCompartment::sweep [jscompartment.cpp : 480 + 0x7]
    rbx = 0x5a5a31c0   r12 = 0x4af97000   r13 = 0x5fbfb260   r14 = 0x00000000
    r15 = 0x70100000   rip = 0x024becf2   rsp = 0x5fbfb140   rbp = 0x5fbfb200
    Found by: call frame info
 2  XUL!SweepPhase [jsgc.cpp : 3342 + 0xe]
    rbx = 0x5a5a31c0   r12 = 0x5a5a5730   r13 = 0x00000000   r14 = 0x00000002
    r15 = 0x70100000   rip = 0x024e4ccf   rsp = 0x5fbfb210   rbp = 0x5fbfb2a0
    Found by: call frame info
 3  XUL!GCCycle [jsgc.cpp : 3792 + 0x11]
    rbx = 0x05f80000   r12 = 0x75698500   r13 = 0x75698500   r14 = 0x5a5a5730
    r15 = 0x70100000   rip = 0x024e87ca   rsp = 0x5fbfb2b0   rbp = 0x5fbfb3a0
    Found by: call frame info
 4  XUL!Collect [jsgc.cpp : 3896 + 0x14]
    rbx = 0x05f80000   r12 = 0x05f80258   r13 = 0x00000019   r14 = 0x00000001
    r15 = 0x00000000   rip = 0x024e896f   rsp = 0x5fbfb3b0   rbp = 0x5fbfb3f0
    Found by: call frame info
 5  XUL!js::NotifyDidPaint [jsfriendapi.cpp : 780 + 0xe]
    rbx = 0x05f80000   r12 = 0x6ba38be8   r13 = 0x25dfe708   r14 = 0x00000004
    r15 = 0x0a08cbf8   rip = 0x024da6de   rsp = 0x5fbfb400   rbp = 0x5fbfb410
    Found by: call frame info
 6  XUL!nsXPConnect::NotifyDidPaint [nsXPConnect.cpp : 2790 + 0xf]
    rbx = 0xffffffff   r12 = 0x6ba38be8   r13 = 0x25dfe708   r14 = 0x00000004
    r15 = 0x0a08cbf8   rip = 0x01ae1de4   rsp = 0x5fbfb420   rbp = 0x5fbfb420
    Found by: call frame info
 7  XUL!PresShell::Paint [nsPresShell.cpp : 5196 + 0x8]
    rbx = 0xffffffff   r12 = 0x6ba38be8   r13 = 0x25dfe708   r14 = 0x00000004
    r15 = 0x0a08cbf8   rip = 0x0124a90a   rsp = 0x5fbfb430   rbp = 0x5fbfb570
    Found by: call frame info
 8  XUL!nsViewManager::Refresh [nsViewManager.cpp : 339 + 0x1c]
    rbx = 0x08bfac90   r12 = 0x5fbfb590   r13 = 0x5fbfb8b8   r14 = 0x0a015900
    r15 = 0x00000000   rip = 0x0171e513   rsp = 0x5fbfb580   rbp = 0x5fbfb620
    Found by: call frame info
 9  XUL!nsViewManager::DispatchEvent [nsViewManager.cpp : 768 + 0x1a]
    rbx = 0x0a015900   r12 = 0x5fbfb860   r13 = 0x08bfac90   r14 = 0x0a015900
    r15 = 0x5fbfb860   rip = 0x0171f4a7   rsp = 0x5fbfb630   rbp = 0x5fbfb720
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → WORKSFORME
Whiteboard: [orange]
You need to log in before you can comment on or make changes to this bug.