Closed Bug 774070 Opened 14 years ago Closed 13 years ago

Android crash in js::gc::IsObjectMarked

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Version:
15 Branch
Platform:
ARM
Android
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME
Tracking Flags:
Tracking Status
firefox15 - affected
firefox16 --- unaffected

People

(Reporter: scoobidiver, Unassigned)

Details

(Keywords: crash, qawanted, regression, Whiteboard: [js:inv:p1][native-crash])

Crash Data

There's a spike in crashes from 15.0a2/20120713 that makes it #5 top crasher in 15.0a2 over the last 3 days. The Aurora regression range for the spike is: http://hg.mozilla.org/releases/mozilla-aurora/pushloghtml?fromchange=226a2d776e84&tochange=88382a387a66 Signature js::gc::IsObjectMarked More Reports Search UUID 98a15597-340a-4f90-a2ba-548052120715 Date Processed 2012-07-15 11:49:23 Uptime 1201 Install Age 20.0 minutes since version was first installed. Install Time 2012-07-15 11:29:06 Product FennecAndroid Version 15.0a2 Build ID 20120714042007 Release Channel aurora OS Linux OS Version 0.0.0 Linux 2.6.35.7-FB07-CL972632 #2 PREEMPT Tue Feb 21 18:04:12 KST 2012 armv7l Build Architecture arm Build Architecture Info Crash Reason SIGSEGV Crash Address 0x30f334f App Notes AdapterVendorID: smdkc110, AdapterDeviceID: SCH-S720C. AdapterDescription: 'Model: 'SCH-S720C', Product: 'SCH-S720C', Manufacturer: 'samsung', Hardware: 'smdkc110''. EGL? EGL+ GL Context? GL Context+ GL Layers? GL Layers+ samsung SCH-S720C samsung/SCH-S720C/SCH-S720C:2.3.6/GINGERBREAD/FB07:user/release-keys EMCheckCompatibility True Adapter Vendor ID smdkc110 Adapter Device ID SCH-S720C Frame Module Signature Source 0 libxul.so js::gc::IsObjectMarked js/src/jscompartment.h:115 1 libxul.so js::WeakMap<js::HeapPtr<JSObject, unsigned int>, js::HeapValue, js::DefaultHashe js/src/gc/Marking.h:250 2 libxul.so js::WeakMapBase::markAllIteratively js/src/jsweakmap.cpp:34 3 libxul.so EndMarkPhase js/src/jsgc.cpp:3037 4 libxul.so GCCycle js/src/jsgc.cpp:3360 5 libxul.so js::GCSlice js/src/jsgc.cpp:3822 6 libxul.so js::IncrementalGC js/src/jsfriendapi.cpp:149 7 libxul.so nsJSContext::GarbageCollectNow dom/base/nsJSEnvironment.cpp:2969 8 libxul.so GCTimerFired dom/base/nsJSEnvironment.cpp:3141 9 libxul.so nsTimerImpl::Fire xpcom/threads/nsTimerImpl.cpp:473 10 libxul.so nsTimerEvent::Run xpcom/threads/nsTimerImpl.cpp:556 11 libxul.so nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:624 12 libxul.so NS_ProcessNextEvent_P obj-firefox/xpcom/build/nsThreadUtils.cpp:213 13 libxul.so mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:113 14 libxul.so MessageLoop::RunInternal ipc/chromium/src/base/message_loop.cc:208 15 libxul.so MessageLoop::Run ipc/chromium/src/base/message_loop.cc:201 16 libxul.so nsBaseAppShell::Run widget/xpwidgets/nsBaseAppShell.cpp:163 17 libxul.so nsAppStartup::Run toolkit/components/startup/nsAppStartup.cpp:256 18 libxul.so XREMain::XRE_mainRun toolkit/xre/nsAppRunner.cpp:3786 19 libxul.so XREMain::XRE_main toolkit/xre/nsAppRunner.cpp:3863 20 libxul.so XRE_main toolkit/xre/nsAppRunner.cpp:3939 ... More reports at: https://crash-stats.mozilla.com/report/list?signature=js%3A%3Agc%3A%3AIsObjectMarked
More reports also at: https://crash-stats.mozilla.com/report/list?signature=js%3A%3AWeakMap%3Cjs%3A%3AHeapPtr%3CJSObject%2C+unsigned+int%3E%2C+js%3A%3AHeapValue%2C+js%3A%3ADefaultHasher%3Cjs%3A%3AHeapPtr%3CJSObject%2C+unsigned+int%3E+%3E+%3E%3A%3AmarkIteratively
Crash Signature: [@ js::gc::IsObjectMarked] → [@ js::gc::IsObjectMarked] [@ js::WeakMap<js::HeapPtr<JSObject, unsigned int>, js::HeapValue, js::DefaultHasher<js::HeapPtr<JSObject, unsigned int> > >::markIteratively]
QA Contact: nhirata.bugzilla
Bill, could take a look at these and see if the stacks mean anything to you? I looked at the Aurora regression range and there's not much on there--a plugin change and what looks like some front-end things.
The stacks don't help much. It just looks like some pointer is corrupted--either the weakmap list or something in one of the weakmaps. Given the regression range, it seems likely that something else is corrupting our memory.
Whiteboard: [native-crash] → [js:inv:p1][native-crash]
The Fennec Native's browser.js does use weak maps, but that's not really much help. I'm not sure if any of the checked in code touched that stuff or not.
(In reply to Andrew McCreight [:mccr8] from comment #5) > The Fennec Native's browser.js does use weak maps, but that's not really > much help. I'm not sure if any of the checked in code touched that stuff or > not. Almost every bugs that has added Text Selection, i.e. bug 765372, bug 695173, bug 765057, bug 766789, bug 765072, bug 724339, bug 767626, bug 765390, bug 767600, bug 767065, bug 768665, bug 769038, bug 766556, bug 768666, bug 770371, bug 771501, and bug 772656.
tracking-fennec: --- → ?
Aurora 16 is unaffected.
status-firefox15: --- → affected
status-firefox16: --- → unaffected
It's #28 top crasher in 15.0b2.
tracking-fennec: ? → ---
tracking-firefox15: + → ?
Keywords: topcrash
Comment 4 says this looks like random corruption, so I don't think there's too much we can do unless someone can find STR.
It's only #31 top crasher in 15.0b3. I ask to untrack it.
tracking-firefox15: + → ?
Yes, since the volume of crashes has gone down and this isn't a recurring issue in 16 I'll un-track for release.
tracking-firefox15: ? → -
There are no crashes in 16.0.1 and above.
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.