Closed Bug 751057 Opened 12 years ago Closed 12 years ago

Intermittent "Assertion failure: dataEnd >= data, at ../../../js/src/jsscript.cpp:1460" and a crash [@ JSScript::finalize] in jsreftest.html?test=js1_5/Regress/regress-360969-06.js and js1_5/Regress/regress-276103.js

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86_64
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: philor, Unassigned)

References

Details

(Keywords: assertion, intermittent-failure, Whiteboard: [js:t]) 

https://tbpl.mozilla.org/php/getParsedLog.php?id=11379013&tree=Firefox&full=1
Rev4 MacOSX Snow Leopard 10.6 mozilla-central debug test jsreftest on 2012-05-01 22:09:03 PDT for push 5278ae9d6b1a

REFTEST TEST-START | file:///Users/cltbld/talos-slave/test/build/jsreftest/tests/jsreftest.html?test=js1_5/Regress/regress-360969-06.js | 2059 / 3407 (60%)
++DOMWINDOW == 11 (0x13d001998) [serial = 3908] [outer = 0x107e8fe40]
BUGNUMBER: 360969
STATUS: 2^17: global function
Assertion failure: dataEnd >= data, at ../../../js/src/jsscript.cpp:1460
TEST-UNEXPECTED-FAIL | file:///Users/cltbld/talos-slave/test/build/jsreftest/tests/jsreftest.html?test=js1_5/Regress/regress-360969-06.js | Exited with code 1 during test run
INFO | automation.py | Application ran for: 0:07:52.298309
INFO | automation.py | Reading PID log: /var/folders/Hs/HsDn6a9SG8idoIya6p9mtE+++TI/-Tmp-/tmpMTrP50pidlog
Downloading symbols from: http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-central-macosx64-debug/1335934652/firefox-15.0a1.en-US.mac64.crashreporter-symbols.zip
PROCESS-CRASH | file:///Users/cltbld/talos-slave/test/build/jsreftest/tests/jsreftest.html?test=js1_5/Regress/regress-360969-06.js | application crashed (minidump found)
Crash dump filename: /var/folders/Hs/HsDn6a9SG8idoIya6p9mtE+++TI/-Tmp-/tmplF3DRB/minidumps/41B1563E-7205-470F-A97B-FC92C57BB4F8.dmp
Operating system: Mac OS X
                  10.6.8 10K549
CPU: amd64
     family 6 model 23 stepping 10
     2 CPUs

Crash reason:  EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
Crash address: 0x0

Thread 0 (crashed)
 0  XUL!JSScript::finalize [jsscript.cpp : 1460 + 0x18]
    rbx = 0x97e4be82   r12 = 0x3dba9560   r13 = 0x97e4be81   r14 = 0x3dbfc0b8
    r15 = 0x00000001   rip = 0x03b80794   rsp = 0x5fbfa170   rbp = 0x5fbfa1b0
    Found by: given as instruction pointer in context
 1  XUL!js::gc::Arena::finalize<JSScript> [jsgc.cpp : 328 + 0xe]
    rbx = 0x0000054a   r12 = 0x3dba9560   r13 = 0x000152ac   r14 = 0x3dbfc0b8
    r15 = 0x000000a0   rip = 0x03a5893f   rsp = 0x5fbfa1c0   rbp = 0x5fbfa280
    Found by: call frame info
 2  XUL!js::gc::FinalizeArenas [jsgc.cpp : 375 + 0xf]
    rbx = 0x3dba9000   r12 = 0x0129fa10   r13 = 0x0000000c   r14 = 0x5fbfa340
    r15 = 0x0129fa10   rip = 0x03a47e38   rsp = 0x5fbfa290   rbp = 0x5fbfa2e0
    Found by: call frame info
 3  XUL!SweepPhase [jsgc.cpp : 1649 + 0xc]
    rbx = 0x0129f810   r12 = 0x5fbfa340   r13 = 0x00000000   r14 = 0x5fbfa330
    r15 = 0x28a2b000   rip = 0x03a49b83   rsp = 0x5fbfa2f0   rbp = 0x5fbfa3e0
    Found by: call frame info
 4  XUL!GCCycle [jsgc.cpp : 3603 + 0x11]
    rbx = 0x00000001   r12 = 0x00000000   r13 = 0x28a2b000   r14 = 0x0129f810
    r15 = 0x06cf9000   rip = 0x03a4b5a1   rsp = 0x5fbfa3f0   rbp = 0x5fbfa4d0
    Found by: call frame info
 5  XUL!Collect [jsgc.cpp : 3692 + 0x11]
    rbx = 0x06cf9318   r12 = 0x06cf9000   r13 = 0x06cf99f8   r14 = 0x00000001
    r15 = 0x5fbfa500   rip = 0x03a4c1ae   rsp = 0x5fbfa4e0   rbp = 0x5fbfa540
    Found by: call frame info
 6  XUL!js_InvokeOperationCallback [jscntxt.cpp : 869 + 0x11]
    rbx = 0x000000c2   r12 = 0x06cf9000   r13 = 0x07e902c0   r14 = 0x00000000
    r15 = 0x00000001   rip = 0x039e51d2   rsp = 0x5fbfa550   rbp = 0x5fbfa570
    Found by: call frame info
 7  XUL!js_HandleExecutionInterrupt [jscntxt.cpp : 885 + 0x4]
    rbx = 0x000000c2   r12 = 0x000000c2   r13 = 0x265907e0   r14 = 0x00000000
    r15 = 0x00000001   rip = 0x039e51f7   rsp = 0x5fbfa580   rbp = 0x5fbfa580
    Found by: call frame info
 8  XUL!js::Interpret [jsinterp.cpp : 1901 + 0x7]
    rbx = 0x000000c2   r12 = 0x000000c2   r13 = 0x265907e0   r14 = 0x00000000
    r15 = 0x00000001   rip = 0x03aa9e74   rsp = 0x5fbfa590   rbp = 0x5fbfb260
    Found by: call frame info
 9  XUL!js::RunScript [jsinterp.cpp : 475 + 0xc]
    rbx = 0x2577e240   r12 = 0x07e902c0   r13 = 0x06daf0c8   r14 = 0x4d310560
    r15 = 0x06daf0c8   rip = 0x03aba2dd   rsp = 0x5fbfb270   rbp = 0x5fbfb2c0
    Found by: call frame info
https://tbpl.mozilla.org/php/getParsedLog.php?id=11454838&tree=Mozilla-Inbound
Rev4 MacOSX Snow Leopard 10.6 mozilla-inbound debug test jsreftest on 2012-05-03 22:44:08 PDT for push fa7d8c0315b3

Assertion failure: dataEnd >= data, at ../../../js/src/jsscript.cpp:1476
TEST-UNEXPECTED-FAIL | file:///Users/cltbld/talos-slave/test/build/jsreftest/tests/jsreftest.html?test=js1_5/Regress/regress-276103.js | Exited with code 1 during test run
Summary: Intermittent "Assertion failure: dataEnd >= data, at ../../../js/src/jsscript.cpp:1460" and a crash [@ JSScript::finalize] in jsreftest.html?test=js1_5/Regress/regress-360969-06.js → Intermittent "Assertion failure: dataEnd >= data, at ../../../js/src/jsscript.cpp:1460" and a crash [@ JSScript::finalize] in jsreftest.html?test=js1_5/Regress/regress-360969-06.js and js1_5/Regress/regress-276103.js
Severity: normal → critical
Whiteboard: [orange] → [js:t][orange]
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → WORKSFORME
Whiteboard: [js:t][orange] → [js:t]
You need to log in before you can comment on or make changes to this bug.