773822 - crash in js::SweepAtomState

Status: RESOLVED DUPLICATE of bug 660272

(Core :: JavaScript Engine, defect)

Description

[Marcia Knous [:marcia]]

This bug was filed from the Socorro interface and is 
report bp-d12386aa-95fc-4b39-b9cc-600042120713 .
============================================================= 

Seen while looking at Beta crash data. https://crash-stats.mozilla.com/report/list?signature=js::SweepAtomState%28JSRuntime*%29. Crashes have increased through the various betas but still relatively low volume. If you filter out the plugin crashes this ranks around #40 top crash.

Windows XP 	  74.763 %	474
Windows 7 	  23.975 %	152
Windows Vista 	   0.789 %        5
Windows 8 	   0.315 %        2
Windows Unknown    0.158 %	  1 

Frame 	Module 	Signature 	Source
0 	mozjs.dll 	js::SweepAtomState 	js/src/jsatom.cpp:290
1 	mozjs.dll 	SweepPhase 	js/src/jsgc.cpp:3164
2 	mozjs.dll 	GCCycle 	js/src/jsgc.cpp:3613
3 	mozjs.dll 	Collect 	js/src/jsgc.cpp:3702
4 	mozjs.dll 	js::GCSlice 	js/src/jsgc.cpp:3729
5 	mozjs.dll 	js::IncrementalGC 	js/src/jsfriendapi.cpp:162
6 	xul.dll 	nsXPConnect::Collect 	js/xpconnect/src/nsXPConnect.cpp:420
7 	xul.dll 	nsXPConnect::GarbageCollect 	js/xpconnect/src/nsXPConnect.cpp:430
8 	xul.dll 	nsJSContext::GarbageCollectNow 	dom/base/nsJSEnvironment.cpp:2919
9 	xul.dll 	GCTimerFired 	dom/base/nsJSEnvironment.cpp:3080
10 	xul.dll 	nsTimerImpl::Fire 	xpcom/threads/nsTimerImpl.cpp:508
11 	xul.dll 	nsTimerEvent::Run 	xpcom/threads/nsTimerImpl.cpp:591
12 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:656
13 	nspr4.dll 	_MD_CURRENT_THREAD 	nsprpub/pr/src/md/windows/w95thred.c:308
14 	xul.dll 	nsViewManager::DispatchEvent 	view/src/nsViewManager.cpp:872
15 		@0x7c8fffff

Comment 1

[Scoobidiver (away)]

It first appeared in 14.0a1/20120408. The regression range might be:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=4721cf101ae6&tochange=babbc38b7f52
It might be a regression from bug 743199.

Comment 2

[Olli Pettay [:smaug][[e-mail]]]

Incrementatl GC should be disabled in FF14.

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

Or, do we just enter IncrementalGC but do actually full GC. I guess so. But sounds still very
much like a JS eng bug.

Comment 4

[Andrew McCreight [:mccr8]]

This just looks like a change in the name of the function to me.  In bug 660272, js_SweepAtomState is shown as being "#51 top browser crasher in 12.0, #33 in 13.0b7.", which is about the same.

Comment 5

[Andrew McCreight [:mccr8]]

The name of this function changed in bug 739899, which landed on April 6, which matches the regression range in comment 1.