768425 - Intermittent crash in [@ js::gc::MarkInternal<JSString>(JSTracer *,JSString * *)]

Status: RESOLVED INVALID

(Core :: JavaScript Engine, defect)

Description

[Ed Morley [:emorley]]

Rev3 WINNT 6.1 mozilla-inbound opt test jsreftest on 2012-06-26 00:09:31 PDT for push 8a0a36ccc830

slave: talos-r3-w7-038

https://tbpl.mozilla.org/php/getParsedLog.php?id=12993538&tree=Mozilla-Inbound

{
REFTEST TEST-START | file:///c:/talos-slave/test/build/jsreftest/tests/jsreftest.html?test=js1_5/Regress/regress-191633.js | 1913 / 3410 (56%)
BUGNUMBER: 191633
STATUS: Testing script with huge number of comments
REFTEST TEST-PASS | file:///c:/talos-slave/test/build/jsreftest/tests/jsreftest.html?test=js1_5/Regress/regress-191633.js | Section 1 of test -   item 1
REFTEST INFO | Loading a blank page
REFTEST TEST-START | file:///c:/talos-slave/test/build/jsreftest/tests/jsreftest.html?test=js1_5/Regress/regress-191668.js | 1914 / 3410 (56%)
TEST-UNEXPECTED-FAIL | file:///c:/talos-slave/test/build/jsreftest/tests/jsreftest.html?test=js1_5/Regress/regress-191668.js | Exited with code -1073741819 during test run
INFO | automation.py | Application ran for: 0:07:12.910000
INFO | automation.py | Reading PID log: c:\users\cltbld\appdata\local\temp\tmpgquqhfpidlog
Downloading symbols from: http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-inbound-win32/1340692998/firefox-16.0a1.en-US.win32.crashreporter-symbols.zip
PROCESS-CRASH | file:///c:/talos-slave/test/build/jsreftest/tests/jsreftest.html?test=js1_5/Regress/regress-191668.js | application crashed (minidump found)
Crash dump filename: c:\users\cltbld\appdata\local\temp\tmpi52xqb\minidumps\7e840ebf-df41-4703-869b-903e05c30620.dmp
Operating system: Windows NT
                  6.1.7600 
CPU: x86
     GenuineIntel family 6 model 23 stepping 10
     2 CPUs

Crash reason:  EXCEPTION_ACCESS_VIOLATION_READ
Crash address: 0x3604d000

Thread 0 (crashed)
 0  mozjs.dll!js::gc::MarkInternal<JSString>(JSTracer *,JSString * *) [Marking.cpp:8a0a36ccc830 : 113 + 0x8]
    eip = 0x728e2e6e   esp = 0x002bd5e8   ebp = 0x002bd5f0   ebx = 0x00000000
    esi = 0x036450f0   edi = 0x00000002   eax = 0x3604d741   ecx = 0x3604d000
    edx = 0x0d0a4438   efl = 0x00010206
    Found by: given as instruction pointer in context
 1  mozjs.dll!js::gc::MarkString(JSTracer *,js::HeapPtr<JSAtom,unsigned int> *,char const *) [Marking.cpp:8a0a36ccc830 : 238 + 0x23]
    eip = 0x728e3714   esp = 0x002bd5f8   ebp = 0x002bd600
    Found by: call frame info
 2  mozjs.dll!JSScript::markChildren(JSTracer *) [jsscript.cpp:8a0a36ccc830 : 2078 + 0xe]
    eip = 0x7286ab6d   esp = 0x002bd608   ebp = 0x002bd62c
    Found by: call frame info
 3  mozjs.dll!js::gc::PushMarkStack [Marking.cpp:8a0a36ccc830 : 562 + 0xb]
    eip = 0x728e2733   esp = 0x002bd634   ebp = 0x002bd644
    Found by: call frame info
 4  mozjs.dll!js::gc::MarkInternal<JSScript>(JSTracer *,JSScript * *) [Marking.cpp:8a0a36ccc830 : 114 + 0x6]
    eip = 0x728e2c47   esp = 0x002bd64c   ebp = 0x002bd65c
    Found by: call frame info
 5  mozjs.dll!js::gc::MarkScript(JSTracer *,js::HeapPtr<JSScript,unsigned int> *,char const *) [Marking.cpp:8a0a36ccc830 : 236 + 0x23]
    eip = 0x728e36e4   esp = 0x002bd664   ebp = 0x002bd66c
    Found by: call frame info
 6  mozjs.dll!JSFunction::trace(JSTracer *) [jsfun.cpp:8a0a36ccc830 : 491 + 0xb]
    eip = 0x7281353d   esp = 0x002bd674   ebp = 0x002bd688
    Found by: call frame info
 7  mozjs.dll!fun_trace [jsfun.cpp:8a0a36ccc830 : 500 + 0xb]
    eip = 0x7281356f   esp = 0x002bd690   ebp = 0x002bd694
    Found by: call frame info
 8  mozjs.dll!js::GCMarker::processMarkStackTop(js::SliceBudget &) [Marking.cpp:8a0a36ccc830 : 1182 + 0x6]
    eip = 0x728e4788   esp = 0x002bd69c   ebp = 0x002bd6c8
}

Comment 1

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

This bug was observed only on one or more of the six machines listed in
bug 787281 comment 11, which seem likely to have bad memory, disk, or
other hardware problem, based on the rate of failures on those machines
and the types of failures observed.

Therefore I'm marking this bug invalid, though it should be reopened if
it occurs on other (more reliable) hardware.