Closed Bug 756797 Opened 13 years ago Closed 13 years ago

crash in TypeConstraintProp::newType

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Version:
15 Branch
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla15

People

(Reporter: scoobidiver, Unassigned)

References

Details

(Keywords: crash, regression, topcrash)

Crash Data

With 100 crashes an hour, it's #2 top crasher in today's build. It first appeared in 15.0a1/20120519. The regression range is: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=e794cef56df6&tochange=642d1a36702f Almost all comments are related to Facebook. Signature TypeConstraintProp::newType More Reports Search UUID c2d5f447-c6ae-472e-8ff8-4e10c2120519 Date Processed 2012-05-19 17:05:50 Uptime 268 Install Age 4.5 minutes since version was first installed. Install Time 2012-05-19 13:08:03 Product Firefox Version 15.0a1 Build ID 20120519030527 Release Channel nightly OS Mac OS X OS Version 10.7.4 11E53 Build Architecture amd64 Build Architecture Info family 6 model 23 stepping 10 Crash Reason EXC_BAD_ACCESS / 0x0000000d Crash Address 0x0 App Notes AdapterVendorID: 0x1002, AdapterDeviceID: 0x944aGL Context? GL Context+ GL Layers? GL Layers+ Processor Notes This dump is too long and has triggered the automatic truncation routine EMCheckCompatibility True Frame Module Signature Source 0 XUL TypeConstraintProp::newType jsobjinlines.h:698 1 XUL js::types::TypeSet::add jsinferinlines.h:843 2 XUL js::analyze::ScriptAnalysis::analyzeTypesBytecode jsinfer.cpp:569 3 XUL js::analyze::ScriptAnalysis::analyzeTypes jsinfer.cpp:4151 4 XUL js::mjit::Compiler::checkAnalysis jsinferinlines.h:1485 5 XUL js::mjit::Compiler::performCompilation Compiler.cpp:535 6 XUL js::mjit::CanMethodJIT Compiler.cpp:146 7 XUL js::Interpret jsinterp.cpp:1588 8 XUL UncachedInlineCall InvokeHelpers.cpp:376 9 XUL js::mjit::stubs::UncachedCallHelper InvokeHelpers.cpp:459 10 XUL js::mjit::CallCompiler::update MonoIC.cpp:961 11 XUL js::mjit::ic::Call MonoIC.cpp:1023 12 @0x118fc661a 13 XUL js::mjit::EnterMethodJIT MethodJIT.cpp:1047 14 XUL js::mjit::JaegerShot MethodJIT.cpp:1109 15 XUL js::Interpret jsinterp.cpp:2590 ... More reports at: https://crash-stats.mozilla.com/report/list?signature=GetPropertyObject https://crash-stats.mozilla.com/report/list?signature=TypeConstraintCall%3A%3AnewType%28JSContext*%2C+js%3A%3Atypes%3A%3ATypeSet*%2C+js%3A%3Atypes%3A%3AType%29
Crash Signature: [@ TypeConstraintProp::newType] [@ GetPropertyObject] → [@ TypeConstraintProp::newType] [@ GetPropertyObject] [@ JSObject::getType]
Crash Signature: [@ TypeConstraintProp::newType] [@ GetPropertyObject] [@ JSObject::getType] → [@ TypeConstraintProp::newType] [@ GetPropertyObject] [@ JSObject::getType] [@ js::types::HashSetInsertTry<long int, js::types::Property, js::types::Property>]
Crash Signature: [@ TypeConstraintProp::newType] [@ GetPropertyObject] [@ JSObject::getType] [@ js::types::HashSetInsertTry<long int, js::types::Property, js::types::Property>] → [@ TypeConstraintProp::newType] [@ GetPropertyObject] [@ JSObject::getType] [@ PropertyAccess] [@ js::types::HashSetInsertTry<long int, js::types::Property, js::types::Property>]
https://crash-stats.mozilla.com/report/index/bp-b7b9bc44-e552-423d-a24f-753e72120520 https://crash-stats.mozilla.com/report/index/bp-75ec2888-8b5b-4efd-8e89-5d6552120520 Signature TypeConstraintPropagateThis::newType More Reports Search UUID b7b9bc44-e552-423d-a24f-753e72120520 Date Processed 2012-05-20 14:50:24 Uptime 6492 Last Crash 1.8 hours before submission Install Age 1.8 hours since version was first installed. Install Time 2012-05-20 13:01:59 Product Firefox Version 15.0a1 Build ID 20120520030530 Release Channel nightly OS Mac OS X OS Version 10.7.4 11E53 Build Architecture amd64 Build Architecture Info family 6 model 23 stepping 6 Crash Reason EXC_BAD_ACCESS / 0x0000000d Crash Address 0x0 User Comments App Notes AdapterVendorID: 0x10de, AdapterDeviceID: 0x 611GL Context? GL Context+ GL Layers? GL Layers+ Processor Notes EMCheckCompatibility False Winsock LSP Adapter Vendor ID Adapter Device ID 756796 NEW crash in TypeConstraintPropagateThis::newType Crashing Thread Frame Module Signature Source 0 XUL TypeConstraintPropagateThis::newType jsinfer.cpp:1259 1 XUL js::types::TypeSet::add jsinferinlines.h:843 2 XUL js::types::TypeSet::addPropagateThis jsinfer.cpp:752 3 XUL js::analyze::ScriptAnalysis::analyzeTypesBytecode jsinfer.cpp:3627 4 XUL js::analyze::ScriptAnalysis::analyzeTypes jsinfer.cpp:4151 5 XUL js::mjit::Compiler::checkAnalysis jsinferinlines.h:1485 6 XUL js::mjit::Compiler::performCompilation Compiler.cpp:535 7 XUL js::mjit::CanMethodJIT Compiler.cpp:146 8 XUL UncachedInlineCall InvokeHelpers.cpp:308 9 XUL js::mjit::stubs::UncachedCallHelper InvokeHelpers.cpp:459 10 XUL js::mjit::stubs::CompileFunction
kiwiplant, we have already access to your crashes by the link in comment 0. This bug is probably a dupe of bug 756796 which is under investigation. The bug that caused this regression is currently unknown.
Bug 756796 is fixed in today's nightly, so hopefully this crash will also go away.
Status: NEW → RESOLVED
Closed: 13 years ago
tracking-firefox15: ? → ---
Resolution: --- → FIXED
Target Milestone: --- → mozilla15
Depends on: 756851
You need to log in before you can comment on or make changes to this bug.