Closed Bug 756797 Opened 12 years ago Closed 12 years ago

crash in TypeConstraintProp::newType

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Version:
15 Branch
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla15

People

(Reporter: scoobidiver, Unassigned)

References

Details

(Keywords: crash, regression, topcrash)

Crash Data

With 100 crashes an hour, it's #2 top crasher in today's build.
It first appeared in 15.0a1/20120519. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=e794cef56df6&tochange=642d1a36702f
Almost all comments are related to Facebook.

Signature 	TypeConstraintProp::newType More Reports Search
UUID	c2d5f447-c6ae-472e-8ff8-4e10c2120519
Date Processed	2012-05-19 17:05:50
Uptime	268
Install Age	4.5 minutes since version was first installed.
Install Time	2012-05-19 13:08:03
Product	Firefox
Version	15.0a1
Build ID	20120519030527
Release Channel	nightly
OS	Mac OS X
OS Version	10.7.4 11E53
Build Architecture	amd64
Build Architecture Info	family 6 model 23 stepping 10
Crash Reason	EXC_BAD_ACCESS / 0x0000000d
Crash Address	0x0
App Notes 	
AdapterVendorID: 0x1002, AdapterDeviceID: 0x944aGL Context? GL Context+ GL Layers? GL Layers+ 
Processor Notes 	This dump is too long and has triggered the automatic truncation routine
EMCheckCompatibility	True

Frame 	Module 	Signature 	Source
0 	XUL 	TypeConstraintProp::newType 	jsobjinlines.h:698
1 	XUL 	js::types::TypeSet::add 	jsinferinlines.h:843
2 	XUL 	js::analyze::ScriptAnalysis::analyzeTypesBytecode 	jsinfer.cpp:569
3 	XUL 	js::analyze::ScriptAnalysis::analyzeTypes 	jsinfer.cpp:4151
4 	XUL 	js::mjit::Compiler::checkAnalysis 	jsinferinlines.h:1485
5 	XUL 	js::mjit::Compiler::performCompilation 	Compiler.cpp:535
6 	XUL 	js::mjit::CanMethodJIT 	Compiler.cpp:146
7 	XUL 	js::Interpret 	jsinterp.cpp:1588
8 	XUL 	UncachedInlineCall 	InvokeHelpers.cpp:376
9 	XUL 	js::mjit::stubs::UncachedCallHelper 	InvokeHelpers.cpp:459
10 	XUL 	js::mjit::CallCompiler::update 	MonoIC.cpp:961
11 	XUL 	js::mjit::ic::Call 	MonoIC.cpp:1023
12 		@0x118fc661a 	
13 	XUL 	js::mjit::EnterMethodJIT 	MethodJIT.cpp:1047
14 	XUL 	js::mjit::JaegerShot 	MethodJIT.cpp:1109
15 	XUL 	js::Interpret 	jsinterp.cpp:2590 
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=GetPropertyObject
https://crash-stats.mozilla.com/report/list?signature=TypeConstraintCall%3A%3AnewType%28JSContext*%2C+js%3A%3Atypes%3A%3ATypeSet*%2C+js%3A%3Atypes%3A%3AType%29
Crash Signature: [@ TypeConstraintProp::newType] [@ GetPropertyObject] → [@ TypeConstraintProp::newType] [@ GetPropertyObject] [@ JSObject::getType]
Crash Signature: [@ TypeConstraintProp::newType] [@ GetPropertyObject] [@ JSObject::getType] → [@ TypeConstraintProp::newType] [@ GetPropertyObject] [@ JSObject::getType] [@ js::types::HashSetInsertTry<long int, js::types::Property, js::types::Property>]
Crash Signature: [@ TypeConstraintProp::newType] [@ GetPropertyObject] [@ JSObject::getType] [@ js::types::HashSetInsertTry<long int, js::types::Property, js::types::Property>] → [@ TypeConstraintProp::newType] [@ GetPropertyObject] [@ JSObject::getType] [@ PropertyAccess] [@ js::types::HashSetInsertTry<long int, js::types::Property, js::types::Property>]
https://crash-stats.mozilla.com/report/index/bp-b7b9bc44-e552-423d-a24f-753e72120520
https://crash-stats.mozilla.com/report/index/bp-75ec2888-8b5b-4efd-8e89-5d6552120520

Signature 	TypeConstraintPropagateThis::newType More Reports Search
UUID	b7b9bc44-e552-423d-a24f-753e72120520
Date Processed	2012-05-20 14:50:24
Uptime	6492
Last Crash	1.8 hours before submission
Install Age	1.8 hours since version was first installed.
Install Time	2012-05-20 13:01:59
Product	Firefox
Version	15.0a1
Build ID	20120520030530
Release Channel	nightly
OS	Mac OS X
OS Version	10.7.4 11E53
Build Architecture	amd64
Build Architecture Info	family 6 model 23 stepping 6
Crash Reason	EXC_BAD_ACCESS / 0x0000000d
Crash Address	0x0
User Comments	
App Notes 	

AdapterVendorID: 0x10de, AdapterDeviceID: 0x 611GL Context? GL Context+ GL Layers? GL Layers+ 

Processor Notes 	
EMCheckCompatibility	False
Winsock LSP	

Adapter Vendor ID	
Adapter Device ID	

    756796 NEW crash in TypeConstraintPropagateThis::newType

Crashing Thread
Frame 	Module 	Signature 	Source
0 	XUL 	TypeConstraintPropagateThis::newType 	jsinfer.cpp:1259
1 	XUL 	js::types::TypeSet::add 	jsinferinlines.h:843
2 	XUL 	js::types::TypeSet::addPropagateThis 	jsinfer.cpp:752
3 	XUL 	js::analyze::ScriptAnalysis::analyzeTypesBytecode 	jsinfer.cpp:3627
4 	XUL 	js::analyze::ScriptAnalysis::analyzeTypes 	jsinfer.cpp:4151
5 	XUL 	js::mjit::Compiler::checkAnalysis 	jsinferinlines.h:1485
6 	XUL 	js::mjit::Compiler::performCompilation 	Compiler.cpp:535
7 	XUL 	js::mjit::CanMethodJIT 	Compiler.cpp:146
8 	XUL 	UncachedInlineCall 	InvokeHelpers.cpp:308
9 	XUL 	js::mjit::stubs::UncachedCallHelper 	InvokeHelpers.cpp:459
10 	XUL 	js::mjit::stubs::CompileFunction
kiwiplant, we have already access to your crashes by the link in comment 0.
This bug is probably a dupe of bug 756796 which is under investigation.
The bug that caused this regression is currently unknown.
Bug 756796 is fixed in today's nightly, so hopefully this crash will also go away.
Status: NEW → RESOLVED
Closed: 12 years ago
tracking-firefox15: ? → ---
Resolution: --- → FIXED
Target Milestone: --- → mozilla15
Depends on: 756851
You need to log in before you can comment on or make changes to this bug.