740266 - crash [@ JSRuntime::onOwnerThread] with own build, gcc 4.7 (-O3 -march=corei7-avx)

Status: RESOLVED DUPLICATE of bug 680547

(Core :: General, defect)

Description

[u209627]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:11.0) Gecko/20120329 Firefox/11.0
Build ID: 20120329031336

Steps to reproduce:

I compiled Firefox 11 source code with gcc 4.7 and the following optimization:

-O3 -march=corei7-avx (for Sandy Bridge)

If i use just -march=corei7 it runs fine. Gcc bug?


Actual results:

It compiled fine, but it segfaults:

#0  0x00007f6e37521360 in ?? () from /usr/local/lib/firefox-11.0/libxul.so
#1  0x00007f6e3752d099 in ?? () from /usr/local/lib/firefox-11.0/libxul.so
#2  0x00007f6e3753e3fa in ?? () from /usr/local/lib/firefox-11.0/libxul.so
#3  0x00007f6e3753a073 in ?? () from /usr/local/lib/firefox-11.0/libxul.so
#4  0x00007f6e37874bdf in ?? () from /usr/local/lib/firefox-11.0/libxul.so
#5  0x00007f6e378740db in ?? () from /usr/local/lib/firefox-11.0/libxul.so
#6  0x00007f6e285fb3c0 in ?? ()
#7  0x0000000000000003 in ?? ()
#8  0x00007f6e1dc35da0 in ?? ()
#9  0x00007f6e1f0c3fd0 in ?? ()
#10 0x00007f6e1f31df30 in ?? ()
#11 0x00007f6e1e6e3e90 in ?? ()
#12 0xff00000000000000 in ?? ()
#13 0x00ffffffffffffff in ?? ()
#14 0x00444949534a736e in ?? ()
#15 0x726567616e614d79 in ?? ()
#16 0x32850f003a0074f4 in ?? ()
#17 0x777c810000004085 in ?? ()
#18 0x00000e850f003f00 in ?? ()
#19 0x83c35d5b04718901 in ?? ()
#20 0x0000000000000019 in ?? ()
#21 0x00007f6e37174c38 in ?? () from /usr/local/lib/firefox-11.0/libxul.so
#22 0x00007f6e371749f9 in ?? () from /usr/local/lib/firefox-11.0/libxul.so
#23 0x00007f6e37874014 in NS_InvokeByIndex_P () from /usr/local/lib/firefox-11.0/libxul.so
#24 0x00007f6e375437c7 in ?? () from /usr/local/lib/firefox-11.0/libxul.so
#25 0x00007f6e37548940 in ?? () from /usr/local/lib/firefox-11.0/libxul.so
#26 0x00007f6e37ad7d53 in ?? () from /usr/local/lib/firefox-11.0/libxul.so
#27 0x00007f6e37ac765c in ?? () from /usr/local/lib/firefox-11.0/libxul.so
#28 0x00007f6e37ad7d14 in ?? () from /usr/local/lib/firefox-11.0/libxul.so
#29 0x00007f6e37ad8562 in ?? () from /usr/local/lib/firefox-11.0/libxul.so
#30 0x00007f6e37a4b3d7 in JS_CallFunctionValue () from /usr/local/lib/firefox-11.0/libxul.so
#31 0x00007f6e3753e727 in ?? () from /usr/local/lib/firefox-11.0/libxul.so
#32 0x00007f6e3753a073 in ?? () from /usr/local/lib/firefox-11.0/libxul.so
#33 0x00007f6e37874bdf in ?? () from /usr/local/lib/firefox-11.0/libxul.so
#34 0x00007f6e378740db in ?? () from /usr/local/lib/firefox-11.0/libxul.so
#35 0x00007f6e23861700 in ?? ()
#36 0x00007f6e1dc32280 in ?? ()
#37 0x00007f6e23861700 in ?? ()
#38 0x00007f6e24aeb110 in ?? ()
#39 0x00007f6e24aeb110 in ?? ()
#40 0x0000000000000002 in ?? ()
#41 0x0000000000000000 in ?? ()



Expected results:

It should run without segfaulting ;)

Comment 1

[u209627]

I have a core i7 2700k processor.

Comment 2

[u209627]

Here it's a better backtrace:

[New Thread 139808722073408 (LWP 23395)]
nsStringStats
 => mAllocCount:              1
 => mReallocCount:            0
 => mFreeCount:               1
 => mShareCount:              0
 => mAdoptCount:              0
 => mAdoptFreeCount:          0
[New Thread 139808524986112 (LWP 23399)]
[New Thread 139808508339968 (LWP 23400)]
[New Thread 139808499947264 (LWP 23401)]
[New Thread 139808487765760 (LWP 23403)]
[New Thread 139808461412096 (LWP 23404)]
[New Thread 139808450914048 (LWP 23405)]
[New Thread 139808442521344 (LWP 23406)]
WARNING: 1 sort operation has occurred for the SQL statement '0x7f27c0166010'.  See https://developer.mozilla.org/En/Storage/Warnings details.: file /home/fraga/src/mozilla/storage/src/mozStoragePrivateHelpers.cpp, line 144
[New Thread 139808411809536 (LWP 23407)]

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 139808722073408 (LWP 23395)]
0x00007f27bd707fc9 in JSRuntime::onOwnerThread () from /usr/local/lib/firefox-11.0/libxul.so
(gdb) bt
#0  0x00007f27bd707fc9 in JSRuntime::onOwnerThread () from /usr/local/lib/firefox-11.0/libxul.so
#1  0x00007f27bd71412e in JS_ValueToObject () from /usr/local/lib/firefox-11.0/libxul.so
#2  0x00007f27bd08de23 in ?? () from /usr/local/lib/firefox-11.0/libxul.so
#3  0x00007f27bd545abc in NS_InvokeByIndex_P () from /usr/local/lib/firefox-11.0/libxul.so
#4  0x00007f27bd0b1036 in ?? () from /usr/local/lib/firefox-11.0/libxul.so
#5  0x00007f27bd0b618f in ?? () from /usr/local/lib/firefox-11.0/libxul.so
#6  0x00007f27bd0b67e3 in ?? () from /usr/local/lib/firefox-11.0/libxul.so
#7  0x00007f27bd0bab60 in ?? () from /usr/local/lib/firefox-11.0/libxul.so
#8  0x00007f27bd82826a in ?? () from /usr/local/lib/firefox-11.0/libxul.so
#9  0x00007f27bd8262d9 in ?? () from /usr/local/lib/firefox-11.0/libxul.so
#10 0x00007f27bd812b69 in ?? () from /usr/local/lib/firefox-11.0/libxul.so
#11 0x00007f27bd826483 in ?? () from /usr/local/lib/firefox-11.0/libxul.so
#12 0x0000000000000000 in ?? ()

Comment 3

[u209627]

The checkCompatibility 1.3 extension was causing this. Nevermind. Thanks.

Comment 4

[u209627]

Well, I replied too soon... it keeps crashing.

The problem is that it will segfault only when I compile WITHOUT
--enable-debug...

Now it sometimes gives the following error:

ACR (Component): component init
isalloc_validate called with invalid pointer. Crashing...
Segmentation fault

***

I'm unable to get this with --enable-debug, so it's a problem...

I'll try with firefox 12 beta...

Comment 5

[u209627]

Ok, now a decent and complete backtrace. I hope it helps:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 140149652981568 (LWP 28284)]
0x00007f771e8156f9 in JSRuntime::onOwnerThread (this=0x1a0080) at /home/fraga/src/mozilla/js/src/jsval.h:852
852         JS_ASSERT((objBits >> JSVAL_TAG_SHIFT) == 0);
(gdb) bt
#0  0x00007f771e8156f9 in JSRuntime::onOwnerThread (this=0x1a0080) at /home/fraga/src/mozilla/js/src/jsval.h:852
#1  0x00007f771e82185e in JS_ValueToObject (cx=0x7fffad2c7630, v=
        {data = {asBits = 18445617585292306240, debugView = {payload47 = 140148977952576, tag = JSVAL_TAG_OBJECT}, s = {payload = {i32 = -99883200, u32 = 4195084096, why = 4195084096}}, asDouble = -nan(0xbff76fa0be740), asPtr = 0xfffbff76fa0be740, asWord = 18445617585292306240}}, objp=0x7fffad2c7538) at /home/fraga/src/mozilla/js/src/jsval.h:852
#2  0x00007f771e19dd83 in nsXPCComponents_Utils::EvalInSandbox (this=Unhandled dwarf expression opcode 0xf3
) at /home/fraga/src/mozilla/js/xpconnect/src/xpcprivate.h:4165
#3  0x00007f771e652fea in NS_InvokeByIndex_P (that=Unhandled dwarf expression opcode 0xf3
) at /home/fraga/src/mozilla/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_x86_64_unix.cpp:195
#4  0x00007f771e1c0f78 in CallMethodHelper::Invoke (this=0x7fffad2c77e8) from /usr/local/lib/firefox-11.0/libxul.so
#5  0x00007f771e1c60d1 in CallMethodHelper::Call (this=0x7fffad2c77e8) from /usr/local/lib/firefox-11.0/libxul.so
#6  0x00007f771e1c6725 in XPCWrappedNative::CallMethod (ccx=@0x7fffad2c7960, mode=Unhandled dwarf expression opcode 0xf3
) from /usr/local/lib/firefox-11.0/libxul.so
#7  0x00007f771e1caaa2 in XPC_WN_CallMethod (cx=0x7f77212aea30, argc=2, vp=Unhandled dwarf expression opcode 0x9f
) at /home/fraga/src/mozilla/js/xpconnect/src/xpcprivate.h:4165
#8  0x00007f771e93555a in js::CallJSNative (cx=0x7f77212aea30, native=0x7f771e1ca956 <XPC_WN_CallMethod(JSContext*, unsigned int, JS::Value*)>, args=@0x7fffad2c7c00)
    at ./../../dist/include/js/HashTable.h:129
#9  0x00007f771e9335c9 in js::InvokeKernel (cx=0x7f77212aea30, args={<js::CallReceiver> = {usedRval_ = false, argv_ = 0x7f7710dd9208}, argc_ = 2}, construct=js::NO_CONSTRUCT)
    at /home/fraga/src/mozilla/js/src/jsval.h:771
#10 0x00007f771e91fe59 in js::Interpret (cx=0x7f77212aea30, entryFrame=0x7f7710dd9038, interpMode=<value optimized out>) at /home/fraga/src/mozilla/js/src/jsval.h:771
#11 0x00007f771e933773 in js::InvokeKernel (cx=0x7f77212aea30, args={<js::CallReceiver> = {usedRval_ = false, argv_ = 0x7f7710dd9030}, argc_ = 1}, construct=Unhandled dwarf expression opcode 0xf3
)
    at /home/fraga/src/mozilla/js/src/jsval.h:771
#12 0x0000000000000000 in ?? ()

Comment 6

[Ronny Perinke]

dup of bug #680547?

Comment 7

[u209627]

(In reply to Ronny Perinke from comment #6)
> dup of bug #680547?

Yes. I'll mark it as a dupplicate.