720086 - 64-bit crash [@ Atomize]

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Scoobidiver (away)]

It's a new crash signature that first appeared in 12.0a1/20120120 and happens exclusively with 64-bit builds so far.
It's currently #1 top crasher in this build.
The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=58e933465c36&tochange=5c2bc94d359c

Stacks are various:
Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	Atomize 	js/src/jsatom.cpp:519
1 	xul.dll 	js_AtomizeString 	js/src/jsatom.cpp:552
2 	xul.dll 	array_getGeneric 	js/src/jsarray.cpp:861
3 	xul.dll 	array_push1_dense 	js/src/jsarray.cpp:2280
4 	xul.dll 	js_ValueToAtom 	js/src/jsatominlines.h:68
5 	xul.dll 	js::ValueToId 	js/src/jsinterp.cpp:1014
6 	xul.dll 	js_IteratorMore 	js/src/jsiter.cpp:1089
7 	xul.dll 	js::GetPropertyOperation 	js/src/jsinterpinlines.h:282
8 	xul.dll 	CheckStackAndEnterMethodJIT 	js/src/methodjit/MethodJIT.cpp:1111
9 	xul.dll 	IteratorMore 	js/src/jsinterp.cpp:1337
10 	xul.dll 	js::Interpret 	js/src/jsinterp.cpp:2100

Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	Atomize 	js/src/jsatom.cpp:519
1 	xul.dll 	js::detail::HashTable<js::TaggedPointerEntry<JSAtom> const,js::HashSet<js::TaggedPointerEntry<JSAtom>,js::AtomHasher,js::SystemAllocPolicy>::SetOps,js::SystemAllocPolicy>::lookup 	obj-firefox/dist/include/js/HashTable.h:495
2 	xul.dll 	js_AtomizeString 	js/src/jsatom.cpp:552
3 	xul.dll 	js_ValueToAtom 	js/src/jsatominlines.h:68
4 	xul.dll 	js::ValueToId 	js/src/jsinterp.cpp:1014
5 	xul.dll 	js_IteratorMore 	js/src/jsiter.cpp:1089
6 	xul.dll 	js_ValueToAtom 	js/src/jsatominlines.h:68
7 	xul.dll 	IteratorMore 	js/src/jsinterp.cpp:1337
8 	xul.dll 	js::Interpret 	js/src/jsinterp.cpp:2100

Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	Atomize 	js/src/jsatom.cpp:519
1 	xul.dll 	js_AtomizeString 	js/src/jsatom.cpp:552
2 	xul.dll 	js_ValueToAtom 	js/src/jsatominlines.h:68
3 	xul.dll 	js::Interpret 	js/src/jsinterp.cpp:2873
4 	xul.dll 	js::AutoCompartment::~AutoCompartment 	js/src/jswrapper.cpp:445
5 	xul.dll 	nsElementSH::PreCreate 	dom/base/nsDOMClassInfo.cpp:7680
6 	xul.dll 	xpc::WrapperFactory::PrepareForWrapping 	js/xpconnect/wrappers/WrapperFactory.cpp:243
...

Frame 	Module 	Signature [Expand] 	Source
0 	XUL 	Atomize 	js/src/jsatom.h:179
1 	XUL 	js_AtomizeString 	js/src/jsatom.cpp:552
2 	XUL 	js::Interpret 	js/src/jsatominlines.h:68
3 	XUL 	js::RunScript 	js/src/jsinterp.cpp:475
4 	XUL 	js::InvokeKernel 	js/src/jsinterp.cpp:538
5 	XUL 	js::Invoke 	js/src/jsinterp.h:157
6 	XUL 	JS_CallFunctionValue 	js/src/jsapi.cpp:5446
7 	XUL 	nsXPCWrappedJSClass::CallMethod 	js/xpconnect/src/XPCWrappedJSClass.cpp:1513
8 	XUL 	nsXPCWrappedJS::CallMethod 	js/xpconnect/src/XPCWrappedJS.cpp:611
9 	XUL 	PrepareAndDispatch 	xpcom/reflect/xptcall/src/md/unix/xptcstubs_x86_64_darwin.cpp:153
...

Frame 	Module 	Signature [Expand] 	Source
0 	XUL 	Atomize 	js/src/jsatom.h:179
1 	XUL 	js_AtomizeString 	js/src/jsatom.cpp:552
2 	XUL 	js::mjit::stubs::GetElem 	js/src/jsatominlines.h:68
3 		@0x11d711a16 	
4 	XUL 	js::mjit::EnterMethodJIT 	js/src/methodjit/MethodJIT.cpp:1052
5 	XUL 	js::mjit::JaegerShotAtSafePoint 	js/src/methodjit/MethodJIT.cpp:1111
6 	XUL 	js::Interpret 	js/src/jsinterp.cpp:1830
7 	XUL 	js::mjit::EnterMethodJIT 	js/src/methodjit/MethodJIT.cpp:1079
8 	XUL 	js::mjit::JaegerShot 	js/src/methodjit/MethodJIT.cpp:1111
...

Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	Atomize 	js/src/jsatom.cpp:519
1 	xul.dll 	str_indexOf 	js/src/jsstr.cpp:1165
2 	xul.dll 	js_AtomizeString 	js/src/jsatom.cpp:552
3 	xul.dll 	js_ValueToAtom 	js/src/jsatominlines.h:68
4 	xul.dll 	js::Interpret 	js/src/jsinterp.cpp:2873
5 	xul.dll 	js::AutoCompartment::~AutoCompartment 	js/src/jswrapper.cpp:445
6 	xul.dll 	nsHTMLPluginObjElementSH::PreCreate 	dom/base/nsDOMClassInfo.cpp:9695
7 	xul.dll 	DEBUG_CheckWrapperThreadSafety 	js/xpconnect/src/XPCWrappedNative.cpp:3557
8 	xul.dll 	xpc::WrapperFactory::PrepareForWrapping 	js/xpconnect/wrappers/WrapperFactory.cpp:243
9 	xul.dll 	SearchTable 	js/src/jsdhash.cpp:437
10 	xul.dll 	XPCWrappedNative::FindTearOff 	js/xpconnect/src/XPCWrappedNative.cpp:1835

More reports at:
https://crash-stats.mozilla.com/report/list?signature=Atomize

Comment 1

[Scoobidiver (away)]

It's currently #1 top crasher over the last 3 days in trunk builds.

Comment 2

[Robert Kaiser]

Is this different from bug 717497?

Comment 3

[Scoobidiver (away)]

(In reply to Robert Kaiser (:[e-mail]) from comment #2)
> Is this different from bug 717497?
Yes, because bug 645468 (see bug 717497 comment 2) doesn't belong to the regression range in comment 0.

Comment 4

[Scoobidiver (away)]

It seems to be fixed in 12.0a1/20120123.
The working range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=244711942710&tochange=758005504cab

Comment 5

[Scoobidiver (away)]

Let's close it.