768418 - Intermittent crash in layout/reftests/bugs/321402-1.html [@ js::gc::ScanShape]

Status: RESOLVED INVALID

(Core :: JavaScript Engine, defect)

Description

[Ed Morley [:emorley]]

Rev3 WINNT 6.1 profiling opt test reftest on 2012-06-22 13:01:46 PDT for push 8b9d056527be

slave: talos-r3-w7-038

https://tbpl.mozilla.org/php/getParsedLog.php?id=12910105&tree=Profiling

{
REFTEST TEST-START | file:///c:/talos-slave/test/build/reftest/tests/layout/reftests/bugs/321402-1.html | 1623 / 7994 (20%)
TEST-UNEXPECTED-FAIL | file:///c:/talos-slave/test/build/reftest/tests/layout/reftests/bugs/321402-1.html | Exited with code -1073741819 during test run
INFO | automation.py | Application ran for: 0:09:36.324000
INFO | automation.py | Reading PID log: c:\users\cltbld\appdata\local\temp\tmprkxzmgpidlog
Downloading symbols from: http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/profiling-win32/1340382706/firefox-16.0a1.en-US.win32.crashreporter-symbols.zip
PROCESS-CRASH | file:///c:/talos-slave/test/build/reftest/tests/layout/reftests/bugs/321402-1.html | application crashed (minidump found)
Crash dump filename: c:\users\cltbld\appdata\local\temp\tmpbgengt\minidumps\1ae2d94c-f4ee-4d03-bb04-7dc4ba6d0733.dmp
Operating system: Windows NT
                  6.1.7600 
CPU: x86
     GenuineIntel family 6 model 23 stepping 10
     2 CPUs

Crash reason:  EXCEPTION_ACCESS_VIOLATION_READ
Crash address: 0xffffffff93bfe1bc

Thread 0 (crashed)
 0  mozjs.dll!js::gc::ScanShape [Marking.cpp:8b9d056527be : 604 + 0x2f]
    eip = 0x722e7f1f   esp = 0x0015cc84   ebp = 0x00000000   ebx = 0x00000000
    esi = 0x00000002   edi = 0x93bfe1bc   eax = 0x000107c1   ecx = 0x0000083e
    edx = 0x93b00000   efl = 0x00010286
    Found by: given as instruction pointer in context
 1  mozjs.dll!js::gc::PushMarkStack [Marking.cpp:8b9d056527be : 575 + 0xa]
    eip = 0x722e8474   esp = 0x0015cc98   ebp = 0x00000000
    Found by: stack scanning
 2  mozjs.dll!js::gc::MarkInternal<js::Shape>(JSTracer *,js::Shape * *) [Marking.cpp:8b9d056527be : 114 + 0x6]
    eip = 0x722e8d16   esp = 0x0015ccb4   ebp = 0x00000000
    Found by: stack scanning
 3  mozjs.dll!js::gc::MarkShapeRoot(JSTracer *,js::Shape * *,char const *) [Marking.cpp:8b9d056527be : 237 + 0x23]
    eip = 0x722e93f4   esp = 0x0015ccc8   ebp = 0x00000000
    Found by: stack scanning
 4  mozjs.dll!js::HeapPtr<js::Shape,unsigned int>::operator=(js::Shape *) [Barrier.h:8b9d056527be : 194 + 0x33]
    eip = 0x721f3b38   esp = 0x0015ccd4   ebp = 0x00000000
    Found by: stack scanning
 5  mozjs.dll!js::Shape::initDictionaryShape(js::StackShape const &,unsigned int,js::HeapPtr<js::Shape,unsigned int> *) [jsscopeinlines.h:8b9d056527be : 369 + 0x2b]
    eip = 0x72268eb6   esp = 0x0015ccec   ebp = 0x00000000
    Found by: stack scanning
 6  mozjs.dll!JSObject::replaceWithNewEquivalentShape(JSContext *,js::Shape *,js::Shape *) [jsscope.cpp:8b9d056527be : 994 + 0x21]
    eip = 0x72269704   esp = 0x0015cd00   ebp = 0x00000000
    Found by: stack scanning
 7  mozjs.dll!js::SetProto(JSContext *,JS::Handle<JSObject *>,JS::Handle<JSObject *>,bool) [jsobj.cpp:8b9d056527be : 4206 + 0xc]
    eip = 0x7223f122   esp = 0x0015cd30   ebp = 0x0015cde4
    Found by: stack scanning
 8  mozjs.dll!JS_SetPrototype [jsapi.cpp:8b9d056527be : 3243 + 0x25]
    eip = 0x721ec0ff   esp = 0x0015cd48   ebp = 0x0015cde4
}

Comment 1

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

This bug was observed only on one or more of the six machines listed in
bug 787281 comment 11, which seem likely to have bad memory, disk, or
other hardware problem, based on the rate of failures on those machines
and the types of failures observed.

Therefore I'm marking this bug invalid, though it should be reopened if
it occurs on other (more reliable) hardware.