Closed Bug 715815 Opened 13 years ago Closed 12 years ago

Intermittent crash [@ JSCompartment::sweepInitialShapeTable] in (at least) browser_bug435788.js, ecma/Date/15.9.5.23-15.js, test_httpsuspend.js, regress-104584.js

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86_64
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: philor, Unassigned)

References

Details

(Keywords: crash, intermittent-failure)

Crash Data

We've got to stop meeting like this. https://tbpl.mozilla.org/php/getParsedLog.php?id=8365307&tree=Mozilla-Inbound Rev4 MacOSX Snow Leopard 10.6 mozilla-inbound debug test mochitest-other on 2012-01-05 18:38:01 PST for push 91a8e4c55adb TEST-UNEXPECTED-FAIL | chrome://mochitests/content/browser/toolkit/mozapps/plugins/tests/browser_bug435788.js | Exited with code 1 during test run INFO | automation.py | Application ran for: 0:35:12.439888 INFO | automation.py | Reading PID log: /var/folders/Hs/HsDn6a9SG8idoIya6p9mtE+++TI/-Tmp-/tmpU3EqtTpidlog PROCESS-CRASH | chrome://mochitests/content/browser/toolkit/mozapps/plugins/tests/browser_bug435788.js | application crashed (minidump found) Crash dump filename: /var/folders/Hs/HsDn6a9SG8idoIya6p9mtE+++TI/-Tmp-/tmptBoYyt/minidumps/F7CC8183-A73D-47A5-A523-38A14E41E82C.dmp Operating system: Mac OS X 10.6.8 10K549 CPU: amd64 family 6 model 23 stepping 10 2 CPUs Crash reason: EXC_BAD_ACCESS / 0x0000000d Crash address: 0x0 Thread 0 (crashed) 0 XUL!JSCompartment::sweepInitialShapeTable [jsgc.h:91a8e4c55adb : 954 + 0x6] rbx = 0x28eb5d08 r12 = 0x4d81e0a8 r13 = 0x0000ffca r14 = 0x1b100000 r15 = 0x00000000 rip = 0x039cc64c rsp = 0x5fbfc250 rbp = 0x5fbfc2f0 Found by: given as instruction pointer in context 1 XUL!JSCompartment::sweep [jscompartment.cpp:91a8e4c55adb : 470 + 0xe] rbx = 0x4981c600 r12 = 0x4981c600 r13 = 0x00a0e5f8 r14 = 0x4981c590 r15 = 0x0015f630 rip = 0x03861ae4 rsp = 0x5fbfc300 rbp = 0x5fbfc450 Found by: call frame info 2 XUL!SweepPhase [jsgc.cpp:91a8e4c55adb : 2763 + 0xe] rbx = 0x2435a810 r12 = 0x2435a810 r13 = 0x2435a880 r14 = 0x00000000 r15 = 0x0015f630 rip = 0x038bee1b rsp = 0x5fbfc460 rbp = 0x5fbfc4c0 Found by: call frame info 3 XUL!GCCycle [jsgc.cpp:91a8e4c55adb : 2867 + 0x18] rbx = 0x02aefd00 r12 = 0x23359200 r13 = 0x05183000 r14 = 0x00000000 r15 = 0x2dd7ca01 rip = 0x038c0172 rsp = 0x5fbfc4d0 rbp = 0x5fbfc670 Found by: call frame info 4 XUL!js_GC [jsgc.cpp:91a8e4c55adb : 3163 + 0xe] rbx = 0x05183000 r12 = 0x0015f630 r13 = 0x5fbfc6a0 r14 = 0x00000000 r15 = 0x2dd7ca01 rip = 0x038c0def rsp = 0x5fbfc680 rbp = 0x5fbfc6f0 Found by: call frame info 5 XUL!nsXPConnect::Collect [nsXPConnect.cpp:91a8e4c55adb : 412 + 0x7] rbx = 0x174d2000 r12 = 0x0015f630 r13 = 0x5fbfc720 r14 = 0x00000000 r15 = 0x2dd7cab3 rip = 0x02abbf9d rsp = 0x5fbfc700 rbp = 0x5fbfc820 Found by: call frame info 6 XUL!nsXPConnect::GarbageCollect [nsXPConnect.cpp:91a8e4c55adb : 420 + 0xc] rbx = 0x01016400 r12 = 0x00000000 r13 = 0x024617f0 r14 = 0x00000000 r15 = 0x2dd7cab3 rip = 0x02ab7db1 rsp = 0x5fbfc830 rbp = 0x5fbfc830 Found by: call frame info 7 XUL!nsJSContext::GarbageCollectNow [nsJSEnvironment.cpp:91a8e4c55adb : 3243 + 0xc] rbx = 0x01016400 r12 = 0x00000000 r13 = 0x024617f0 r14 = 0x00000000 r15 = 0x2dd7cab3 rip = 0x0246172d rsp = 0x5fbfc840 rbp = 0x5fbfc850 Found by: call frame info 8 XUL!nsTimerImpl::Fire [nsTimerImpl.cpp:91a8e4c55adb : 428 + 0xa] rbx = 0x00000002 r12 = 0x50192450 r13 = 0x024617f0 r14 = 0x00000000 r15 = 0x2dd7cab3 rip = 0x034674eb rsp = 0x5fbfc860 rbp = 0x5fbfc8e0 Found by: call frame info (There's stuff above there in the log, but there's so much noise in any log that I don't know what might be signal.)
https://tbpl.mozilla.org/php/getParsedLog.php?id=8622152&tree=Mozilla-Inbound
Summary: Intermittent crash [@ JSCompartment::sweepInitialShapeTable] in (at least) browser_bug435788.js → Intermittent crash [@ JSCompartment::sweepInitialShapeTable] in (at least) browser_bug435788.js and ecma/Date/15.9.5.23-15.js
Made it a little further: https://tbpl.mozilla.org/php/getParsedLog.php?id=10734641&tree=Firefox Rev3 Fedora 12 mozilla-central pgo test xpcshell on 2012-04-08 00:56:19 PDT for push babbc38b7f52 PROCESS-CRASH | /home/cltbld/talos-slave/test/build/xpcshell/tests/netwerk/test/unit/test_httpsuspend.js | application crashed (minidump found) Crash dump filename: /home/cltbld/talos-slave/test/build/xpcshell/tests/netwerk/test/unit/27966db6-4429-726f-0d963406-5001efb8.dmp Operating system: Linux 0.0.0 Linux 2.6.31.5-127.fc12.i686.PAE #1 SMP Sat Nov 7 21:25:57 EST 2009 i686 CPU: x86 GenuineIntel family 6 model 23 stepping 10 2 CPUs Crash reason: SIGSEGV Crash address: 0x6000 Thread 0 (crashed) 0 xpcshell!free [jemalloc.c : 4478 + 0x0] eip = 0x0805b970 esp = 0xbf98ef00 ebp = 0xb4100000 ebx = 0x0805f490 esi = 0xb761e040 edi = 0x00006000 eax = 0x00000000 ecx = 0x00000003 edx = 0xb41d5000 efl = 0x00010206 Found by: given as instruction pointer in context 1 libxul.so!js::detail::HashTable<const js::InitialShapeEntry, js::HashSet<js::InitialShapeEntry, js::InitialShapeEntry, js::SystemAllocPolicy>::SetOps, js::SystemAllocPolicy>::changeTableSize [Utility.h : 190 + 0xb] eip = 0x01f7c42c esp = 0xbf98ef40 ebp = 0x00000019 ebx = 0x024296c8 esi = 0x00000100 edi = 0x0000007f Found by: call frame info 2 libxul.so!js::detail::HashTable<const js::InitialShapeEntry, js::HashSet<js::InitialShapeEntry, js::InitialShapeEntry, js::SystemAllocPolicy>::SetOps, js::SystemAllocPolicy>::checkUnderloaded [HashTable.h : 659 + 0xf] eip = 0x01f7c535 esp = 0xbf98ef90 ebp = 0x00008000 ebx = 0x024296c8 esi = 0xb41d5c00 edi = 0xbf98f00c Found by: call frame info 3 libxul.so!JSCompartment::sweepInitialShapeTable [jsscope.cpp:babbc38b7f52 : 1403 + 0xf] eip = 0x01f79bfd esp = 0xbf98efb0 ebp = 0x00008000 ebx = 0x024296c8 esi = 0xb41d5c00 edi = 0xbf98f00c Found by: call frame info 4 libxul.so!JSCompartment::sweep [jscompartment.cpp:babbc38b7f52 : 511 + 0xe] eip = 0x01ee6da2 esp = 0xbf98f040 ebp = 0xb419b000 ebx = 0x024296c8 esi = 0xb419b000 edi = 0xbf98f120 Found by: call frame info 5 libxul.so!SweepPhase [jsgc.cpp:babbc38b7f52 : 3151 + 0x15] eip = 0x01f06576 esp = 0xbf98f0e0 ebp = 0xb413d000 ebx = 0x024296c8 esi = 0xbf98f118 edi = 0xbf98f120 Found by: call frame info 6 libxul.so!GCCycle [jsgc.cpp:babbc38b7f52 : 3243 + 0xa] eip = 0x01f06b84 esp = 0xbf98f150 ebp = 0xb57f7b20 ebx = 0x024296c8 esi = 0xb413d000 edi = 0xb413d0e0 Found by: call frame info 7 libxul.so!Collect [jsgc.cpp:babbc38b7f52 : 3710 + 0x1b] eip = 0x01f0713f esp = 0xbf98f1e0 ebp = 0xbf98f21c ebx = 0x024296c8 esi = 0xb413d000 edi = 0xb413d158 Found by: call frame info 8 libxul.so!js::GC [jsgc.cpp:babbc38b7f52 : 3731 + 0x29] eip = 0x01f0729d esp = 0xbf98f240 ebp = 0xbf98f28c ebx = 0x024296c8 esi = 0xb57f7b20 edi = 0xb413d000 Found by: call frame info 9 libxul.so!js_DestroyContext [jscntxt.cpp:babbc38b7f52 : 285 + 0x17] eip = 0x01ee47a1 esp = 0xbf98f260 ebp = 0xbf98f28c ebx = 0x024296c8
Summary: Intermittent crash [@ JSCompartment::sweepInitialShapeTable] in (at least) browser_bug435788.js and ecma/Date/15.9.5.23-15.js → Intermittent crash [@ JSCompartment::sweepInitialShapeTable] in (at least) browser_bug435788.js, ecma/Date/15.9.5.23-15.js, test_httpsuspend.js
https://tbpl.mozilla.org/php/getParsedLog.php?id=11126999&tree=Mozilla-Inbound TEST-UNEXPECTED-FAIL | chrome://mochitests/content/browser/toolkit/mozapps/extensions/test/xpinstall/browser_bug540558.js | Exited with code 1 during test run
Crash Signature: [@ JSCompartment::sweepInitialShapeTable]
https://tbpl.mozilla.org/php/getParsedLog.php?id=12785684&tree=Mozilla-Aurora
Summary: Intermittent crash [@ JSCompartment::sweepInitialShapeTable] in (at least) browser_bug435788.js, ecma/Date/15.9.5.23-15.js, test_httpsuspend.js → Intermittent crash [@ JSCompartment::sweepInitialShapeTable] in (at least) browser_bug435788.js, ecma/Date/15.9.5.23-15.js, test_httpsuspend.js, regress-104584.js
Severity: normal → critical
Keywords: crash
https://tbpl.mozilla.org/php/getParsedLog.php?id=13325398&tree=Mozilla-Inbound TEST-UNEXPECTED-FAIL | /tests/dom/tests/mochitest/dom-level2-core/test_namespaceURI02.html | Exited with code 1 during test run Operating system: Mac OS X 10.6.8 10K549 CPU: amd64 family 6 model 23 stepping 10 2 CPUs Crash reason: EXC_BAD_ACCESS / KERN_INVALID_ADDRESS Crash address: 0x5aa67000 Thread 0 (crashed) 0 XUL!JSCompartment::sweepInitialShapeTable [Heap.h : 963 + 0x9] rbx = 0x77dd5570 r12 = 0x4af97488 r13 = 0x5aa45d30 r14 = 0x77ddb000 r15 = 0x031a7a80 rip = 0x0257da32 rsp = 0x5fbfb020 rbp = 0x5fbfb130 Found by: given as instruction pointer in context 1 XUL!JSCompartment::sweep [jscompartment.cpp : 480 + 0x7] rbx = 0x5a5a31c0 r12 = 0x4af97000 r13 = 0x5fbfb260 r14 = 0x00000000 r15 = 0x70100000 rip = 0x024becf2 rsp = 0x5fbfb140 rbp = 0x5fbfb200 Found by: call frame info 2 XUL!SweepPhase [jsgc.cpp : 3342 + 0xe] rbx = 0x5a5a31c0 r12 = 0x5a5a5730 r13 = 0x00000000 r14 = 0x00000002 r15 = 0x70100000 rip = 0x024e4ccf rsp = 0x5fbfb210 rbp = 0x5fbfb2a0 Found by: call frame info 3 XUL!GCCycle [jsgc.cpp : 3792 + 0x11] rbx = 0x05f80000 r12 = 0x75698500 r13 = 0x75698500 r14 = 0x5a5a5730 r15 = 0x70100000 rip = 0x024e87ca rsp = 0x5fbfb2b0 rbp = 0x5fbfb3a0 Found by: call frame info 4 XUL!Collect [jsgc.cpp : 3896 + 0x14] rbx = 0x05f80000 r12 = 0x05f80258 r13 = 0x00000019 r14 = 0x00000001 r15 = 0x00000000 rip = 0x024e896f rsp = 0x5fbfb3b0 rbp = 0x5fbfb3f0 Found by: call frame info 5 XUL!js::NotifyDidPaint [jsfriendapi.cpp : 780 + 0xe] rbx = 0x05f80000 r12 = 0x6ba38be8 r13 = 0x25dfe708 r14 = 0x00000004 r15 = 0x0a08cbf8 rip = 0x024da6de rsp = 0x5fbfb400 rbp = 0x5fbfb410 Found by: call frame info 6 XUL!nsXPConnect::NotifyDidPaint [nsXPConnect.cpp : 2790 + 0xf] rbx = 0xffffffff r12 = 0x6ba38be8 r13 = 0x25dfe708 r14 = 0x00000004 r15 = 0x0a08cbf8 rip = 0x01ae1de4 rsp = 0x5fbfb420 rbp = 0x5fbfb420 Found by: call frame info 7 XUL!PresShell::Paint [nsPresShell.cpp : 5196 + 0x8] rbx = 0xffffffff r12 = 0x6ba38be8 r13 = 0x25dfe708 r14 = 0x00000004 r15 = 0x0a08cbf8 rip = 0x0124a90a rsp = 0x5fbfb430 rbp = 0x5fbfb570 Found by: call frame info 8 XUL!nsViewManager::Refresh [nsViewManager.cpp : 339 + 0x1c] rbx = 0x08bfac90 r12 = 0x5fbfb590 r13 = 0x5fbfb8b8 r14 = 0x0a015900 r15 = 0x00000000 rip = 0x0171e513 rsp = 0x5fbfb580 rbp = 0x5fbfb620 Found by: call frame info 9 XUL!nsViewManager::DispatchEvent [nsViewManager.cpp : 768 + 0x1a] rbx = 0x0a015900 r12 = 0x5fbfb860 r13 = 0x08bfac90 r14 = 0x0a015900 r15 = 0x5fbfb860 rip = 0x0171f4a7 rsp = 0x5fbfb630 rbp = 0x5fbfb720
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → WORKSFORME
Whiteboard: [orange]
You need to log in before you can comment on or make changes to this bug.