crash in JSScript::markChildren

NEW
Unassigned

Status

()

Core
JavaScript Engine
--
critical
6 years ago
2 years ago

People

(Reporter: Scoobidiver (away), Unassigned)

Tracking

({crash, regression})

13 Branch
crash, regression
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox15-, firefox16-, firefox17-, firefox30 affected, firefox31 affected)

Details

(Whiteboard: [js:t][unactionable], crash signature)

(Reporter)

Description

6 years ago
It first appeared in 13.0a1/20120307. The regression range might be:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=7d0d1108a14e&tochange=78e56fd22f2a
It's #178 top crasher in 13.0b7, #200 in 14.0a2 over the last week.

There's a spike in crashes starting from 15.0a1/20120601. The regression range for the spike is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=3aa566994890&tochange=73783bf75c4c
It's #36 top crasher in 15.0a1 over the last day.

Signature 	JSScript::markChildren(JSTracer*) More Reports Search
UUID	bcd2c732-f01a-49d4-a735-4aa082120604
Date Processed	2012-06-04 01:10:42
Uptime	36
Last Crash	38 seconds before submission
Install Age	9.9 hours since version was first installed.
Install Time	2012-06-03 15:17:00
Product	Firefox
Version	15.0a1
Build ID	20120603030523
Release Channel	nightly
OS	Windows NT
OS Version	6.1.7601 Service Pack 1
Build Architecture	x86
Build Architecture Info	GenuineIntel family 6 model 23 stepping 7
Crash Reason	EXCEPTION_ACCESS_VIOLATION_WRITE
Crash Address	0x1ff32f0
App Notes 	
AdapterVendorID: 0x10de, AdapterDeviceID: 0x1201, AdapterSubsysID: 14603842, AdapterDriverVersion: 8.17.13.142
D2D? D2D+ DWrite? DWrite+ D3D10 Layers? D3D10 Layers+ 
EMCheckCompatibility	True	
Total Virtual Memory	4294836224
Available Virtual Memory	3880792064
System Memory Use Percentage	21
Available Page File	32229367808
Available Physical Memory	6740520960

Frame 	Module 	Signature 	Source
0 	mozjs.dll 	JSScript::markChildren 	js/src/jsscript.cpp:2110
1 	mozjs.dll 	js::gc::MarkUnbarriered<JSScript> 	js/src/gc/Marking.cpp:135
2 	mozjs.dll 	fun_trace 	js/src/jsfun.cpp:499
3 	mozjs.dll 	js::GCMarker::processMarkStackTop 	js/src/gc/Marking.cpp:1180
4 	mozjs.dll 	js::GCMarker::drainMarkStack 	js/src/gc/Marking.cpp:1224
5 	mozjs.dll 	NonIncrementalMark 	js/src/jsgc.cpp:3345
6 	mozjs.dll 	GCCycle 	js/src/jsgc.cpp:3693
7 	mozjs.dll 	Collect 	js/src/jsgc.cpp:3802
8 	xul.dll 	mozilla::CalibratedPerformanceCounter 	xpcom/ds/TimeStamp_windows.cpp:521
9 	xul.dll 	nsJSContext::GarbageCollectNow 	dom/base/nsJSEnvironment.cpp:2978

More reports at:
https://crash-stats.mozilla.com/report/list?signature=JSScript%3A%3AmarkChildren%28JSTracer*%29
https://crash-stats.mozilla.com/report/list?signature=JSScript%3A%3AmarkChildren
Whiteboard: [js:p1:fx16]
It subsided again.
Whiteboard: [js:p1:fx16] → [js:t]
Blocks: 768402
(Reporter)

Comment 2

5 years ago
It's #18 top browser crasher in 15.0b2, #12 in 16.0a2, and #14 in 17.0a1.
tracking-firefox15: --- → ?
tracking-firefox16: --- → ?
tracking-firefox17: --- → ?
Keywords: topcrash

Comment 3

5 years ago
(In reply to Scoobidiver from comment #2)
> It's #18 top browser crasher in 15.0b2, #12 in 16.0a2, and #14 in 17.0a1.

Let's see if this is spiking before tracking for release.
Whiteboard: [js:t] → [js:t] [crash-spike]
(Reporter)

Comment 4

5 years ago
(In reply to Alex Keybl [:akeybl] from comment #3)
> Let's see if this is spiking before tracking for release.
It spiked in 15.0a1/20120601 as explained in comment 0.

Updated

5 years ago
Whiteboard: [js:t] [crash-spike] → [js:t]

Updated

5 years ago
Blocks: 778788
This is highest on Win XP (70%) and much higher in 15 than it was in 14 but it's been around since 13 so while it's worth keeping an eye on, I wouldn't block a release on this with its present volume.
tracking-firefox15: ? → -
tracking-firefox16: ? → -
tracking-firefox17: ? → -
Also the volume on 16/17 is quite low which contributes to the decision on comment 5.
We have compartment GC enabled in FF15 but not in 16 or 17. However, nothing related to compartment GC happened on 6/1.
(Reporter)

Comment 8

5 years ago
(In reply to Lukas Blakk [:lsblakk] from comment #6)
> Also the volume on 16/17 is quite low which contributes to the decision on
> comment 5.
Without counting Flash hangs where nothing can be done by Mozilla, it's #9 in 15.0b2, #10 in 16.0a2 and 17.0a1.

Comment 9

5 years ago
This signature is topcrash #6 in Firefox desktop 18.0b3
Duplicate of this bug: 847937
(Reporter)

Updated

5 years ago
Crash Signature: [@ JSScript::markChildren(JSTracer*)] [@ JSScript::markChildren] → [@ JSScript::markChildren(JSTracer*)] [@ JSScript::markChildren] [@ MarkInternal<JSAtom> ]
(Reporter)

Updated

5 years ago
Crash Signature: [@ JSScript::markChildren(JSTracer*)] [@ JSScript::markChildren] [@ MarkInternal<JSAtom> ] → [@ JSScript::markChildren(JSTracer*)] [@ JSScript::markChildren] [@ MarkInternal<JSAtom> ] [@ MarkInternal<js::ArgumentsObject>]
(Reporter)

Updated

5 years ago
Crash Signature: [@ JSScript::markChildren(JSTracer*)] [@ JSScript::markChildren] [@ MarkInternal<JSAtom> ] [@ MarkInternal<js::ArgumentsObject>] → [@ JSScript::markChildren(JSTracer*)] [@ JSScript::markChildren] [@ MarkInternal<JSAtom> ] [@ MarkInternal<js::ArgumentsObject>] [@ MarkRange<JSObject>]

Updated

4 years ago
Whiteboard: [js:t] → [js:t][unactionable]

Updated

4 years ago
Keywords: topcrash

Comment 11

4 years ago
FWIW Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0 ID:20140415030203 CSet: 5b6e82e7bbbf crashed like this for me.

Report ID 	Date Submitted
bp-27ab81d3-d853-4022-8b3e-01bab2140415	15/04/2014	03:15 p.m.

Shall I file a new bug?

Comment 12

4 years ago
Robert,

Can you please advise on comment 11 above?
Flags: needinfo?(kairo)

Comment 13

4 years ago
Is this reproducible? If not, then there's not much sense in filing a separate bug for a crash that happens during garbage collection as there's no way to determine what's causing it from the report, the cause for something like this (like memory corruption) has usually happened long before the garbage collection stumbled over it and crashed.
Flags: needinfo?(kairo)

Comment 14

4 years ago
https://crash-stats.mozilla.com/report/index/08dd165a-16de-4663-8451-e21672140424
status-firefox31: --- → affected
crashes @ JSScript::markChildren(JSTracer*) have crept into the top 20 volume crashers on Fx30. (#19)
status-firefox30: --- → affected
Keywords: topcrash-win
Firefox 32: https://crash-stats.mozilla.com/report/index/017e3d6d-0433-4977-8199-1df902140531

Comment 17

4 years ago
https://crash-stats.mozilla.com/report/index/146cfb49-006c-41c3-ba40-4146c2140602
None of these signatures are in the topcrash range anymore. Regardless we still have no actionable information for this long-standing crash.
Keywords: topcrash-win
(Assignee)

Updated

3 years ago
Assignee: general → nobody

Updated

2 years ago
Crash Signature: [@ JSScript::markChildren(JSTracer*)] [@ JSScript::markChildren] [@ MarkInternal<JSAtom> ] [@ MarkInternal<js::ArgumentsObject>] [@ MarkRange<JSObject>] → [@ JSScript::markChildren(JSTracer*)] [@ JSScript::markChildren] [@ MarkInternal<JSAtom> ] [@ MarkInternal<js::ArgumentsObject>] [@ MarkRange<JSObject>] [@ MarkInternal<T> ] [@ MarkRange<T>]
You need to log in before you can comment on or make changes to this bug.