752191 - CPG Respin introduced regressions for Incremental GC, varying crash signatures.

Status: RESOLVED DUPLICATE of bug 752098

(Core :: JavaScript Engine, defect)

Description

[Danial Horton]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/15.0 Firefox/15.0a1
Build ID: 20120504122939

Steps to reproduce:

updated to the CPG respin


Actual results:

Following the CPG respin i've been getting both this and nsPurpleBuffer::RemoveSkippable(bool) with iGC enabled,

Another user getting crashes with the respin found disabling iGC stopped them (for him atleast)


Expected results:

probably some testing with igc enabled to limit regressions?

not to say that CPG is the actual fault here, but alot of other things landed at the same time.

Comment 1

[Danial Horton]

Regression in Incremental GC confirmed in fresh profile

Regression window(m-c)

Works:
http://hg.mozilla.org/mozilla-central/rev/2db9df42823d
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/15.0 Firefox/15.0a1
ID:20120503142649
Fails:
http://hg.mozilla.org/mozilla-central/rev/9ebf3dc839c5
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/15.0 Firefox/15.0a1 ID:20120504122939

Comment 2

[Danial Horton]

i hope im not premature in blocking bug 735099 with this, but they do appear to stand in the way of getting incremental gc back on desktop.

i'll try and get the inbound set that brought introduced this if i can (internet stability pending) unless Alice White wants to have a go.

http://gregor-wagner.com/tmp/mem triggers it after adjusting the required about:config values

Comment 3

[Danial Horton]

Crash signatures from this regression

js::gc::Arena::finalize<JSObject>(js::FreeOp*, js::gc::AllocKind, unsigned int)

xul.dll@0x361d6c | xul.dll@0x7d62b4 | xul.dll@0x352536 | xul.dll@0x4a3bf4 | xul.dll@0x7d30b6 | RtlUnicodeStringToAnsiString | RtlUnicodeStringToAnsiString | xul.dll@0x352536 

mozjs.dll@0x1009e9

nsPurpleBuffer::RemoveSkippable(bool)

Comment 4

[Danial Horton]

more crash signatures

js::gc::PushMarkStack
js::gc::MarkRange<JSObject>
XPC_WN_NoHelper_Finalize
nsRefPtr<nsIDOMEventListener>::~nsRefPtr<nsIDOMEventListener>() | nsGenericHTMLElement::UnbindFromTree(bool, bool)

Comment 5

[Andrew McCreight [:mccr8]]

I seem to recall Gregor filing a similar bug about recent crashiness on that same site, but I can't for the life of me remember anything else about it.