736830 - crash in js::types::TypeMonitorResult

Status: RESOLVED DUPLICATE of bug 737388

(Core :: JavaScript Engine, defect)

Description

[Scoobidiver (away)]

There's one crash in 14.0a1/20120316, but many crashes from 14.0a1/20120317 on Mac OS X and Linux.
The regression range for the spike is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=e5f6caa40409&tochange=ecaad3ae9964
It might be related to bug 736815 which is also specific to 64-bit builds.

The first frames of the stack look like:
Frame 	Module 	Signature 	Source
0 	libxul.so 	js::types::TypeMonitorResult 	js/src/gc/Barrier.h:212
1 		@0x7f6ca88e61f2 	
2 	libxul.so 	js::mjit::JaegerShot 	js/src/methodjit/MethodJIT.cpp:1052
3 	libxul.so 	js::Interpret 	js/src/jsinterp.cpp:2729

or
Frame 	Module 	Signature 	Source
0 	XUL 	js::types::TypeMonitorResult 	js/src/jsinferinlines.h:66
1 		@0x1149fadf6 	
2 	XUL 	js::mjit::EnterMethodJIT 	js/src/methodjit/MethodJIT.cpp:1052
3 	XUL 	js::mjit::JaegerShot 	js/src/methodjit/MethodJIT.cpp:1111
4 	XUL 	js::Interpret 	js/src/jsinterp.cpp:2729

More reports at:
https://crash-stats.mozilla.com/report/list?signature=js%3A%3Atypes%3A%3ATypeMonitorResult

Comment 1

[Scoobidiver (away)]

The Windows stack mainly looks like:
Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	js::types::TypeMonitorResult 	js/src/jsinfer.cpp:4941
1 	xul.dll 	js::mjit::stubs::TypeBarrierHelper 	js/src/methodjit/StubCalls.cpp:1650

Comment 2

[Tom S. (please needinfo tschuster)]

I can reproduce this on Ubuntu in the current Nightly when editing a page on MDN.

eg. bp-181a97b0-1628-41cd-aea9-f6cb32120319

Comment 3

[David Illsley]

This repros for me on OS X accessing the AWS management console:

0af17763-295b-4651-9279-36eff2120319
c885b35b-b415-4a02-b316-d674e2120319

Comment 4

[Scoobidiver (away)]

It's #7 top crasher in 14.0a1 over the last 3 days.

Comment 5

[Nickolay_Ponomarev]

I can reproduce on 20120321031151 OS X 10.7.3 from a clean profile:
1. open https://developer.mozilla.org/En/XPCOM+Interface+Reference/NsIDOMHTMLMediaElement
2. Click edit, sign in using browserid
3. You're redirected to the article, wait for a while while the editor loads
4. Click to the left of the "Method Overview" heading.

Comment 6

[David Mandelin [:dmandelin]]

Tom, David, Nickolay, do you think one of you could bisect this with nightly builds?

Comment 7

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

I am crashing on the "Hunger Games" url http://thecapitoltour.pn/

Comment 8

[Nickolay_Ponomarev]

The regression range for me matches the one in comment 0: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=e5f6caa40409&tochange=ecaad3ae9964
(i.e. doesn't crash in 2012-03-16-03-11-51-mozilla-central, crashes in 2012-03-17-03-11-50-mozilla-central)

Can no-one else reproduce using my STR?

Comment 9

[Luke Wagner [:luke]]

There is a good chance this was fixed by bug 737388.  Unfortunately, that fix is not yet on nightlies (should be on the next one).  Could you verify fixed on a trunk build?

linux: http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-central-linux/1332418159/firefox-14.0a1.en-US.linux-i686.tar.bz2

osx: http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-central-macosx64/1332418159/firefox-14.0a1.en-US.mac.dmg

win32: http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-central-win32/1332418159/firefox-14.0a1.en-US.win32.zip

Comment 10

[Tom S. (please needinfo tschuster)]

I just tested http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-central-linux64/1332435439/firefox-14.0a1.en-US.linux-x86_64.tar.bz2 and it didn't crash :)

Comment 11

[Jeff Balogh (:jbalogh)]

Yep, the trunk build fixed my crash on the aws console, which I still get on nightly.

Comment 12

[Luke Wagner [:luke]]

Excellent.  I'll resolve dup, but please feel free to reopen if anyone finds something that still crashes.