775446 - Intermittent crash during jsreftest.html?test=js1_5/Array/regress-99120-01.js [@ js::Shape::finalize]

Status: RESOLVED INVALID

(Core :: JavaScript Engine, defect)

Description

[Ed Morley [:emorley]]

(Dupe of bug 757853 ? Although stack slightly different...)

Rev4 MacOSX Snow Leopard 10.6 mozilla-inbound opt test jsreftest on 2012-07-18 15:34:09 PDT for push 44f8cae1dcf0

slave: talos-r4-snow-041

https://tbpl.mozilla.org/php/getParsedLog.php?id=13649558&tree=Mozilla-Inbound

{
REFTEST TEST-START | file:///Users/cltbld/talos-slave/test/build/jsreftest/tests/jsreftest.html?test=js1_5/Array/regress-99120-01.js | 1763 / 3398 (51%)
BUGNUMBER: 99120
STATUS: sort() should not be O(N^2) on sorted data
TEST-UNEXPECTED-FAIL | file:///Users/cltbld/talos-slave/test/build/jsreftest/tests/jsreftest.html?test=js1_5/Array/regress-99120-01.js | Exited with code 1 during test run
INFO | automation.py | Application ran for: 0:02:30.345694
INFO | automation.py | Reading PID log: /var/folders/Hs/HsDn6a9SG8idoIya6p9mtE+++TI/-Tmp-/tmp7zCM0Ppidlog
Downloading symbols from: http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-inbound-macosx64/1342646355/firefox-17.0a1.en-US.mac.crashreporter-symbols.zip
PROCESS-CRASH | file:///Users/cltbld/talos-slave/test/build/jsreftest/tests/jsreftest.html?test=js1_5/Array/regress-99120-01.js | application crashed (minidump found)
Crash dump filename: /var/folders/Hs/HsDn6a9SG8idoIya6p9mtE+++TI/-Tmp-/tmpIcKNxh/minidumps/7AF16C97-394A-42C5-B1D4-CF72710C94B9.dmp
Operating system: Mac OS X
                  10.6.8 10K549
CPU: amd64
     family 6 model 23 stepping 10
     2 CPUs

Crash reason:  EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
Crash address: 0x580ffb88

Thread 0 (crashed)
 0  XUL!js::Shape::finalize [Heap.h:44f8cae1dcf0 : 671 + 0x0]
    rbx = 0x580eb560   r12 = 0x580ebfff   r13 = 0x00000028   r14 = 0x5fbfb808
    r15 = 0x5fbfb5c8   rip = 0x0247085a   rsp = 0x5fbfb580   rbp = 0x5fbfb590
    Found by: given as instruction pointer in context
 1  XUL!js::gc::finalize<js::Shape> [jsgc.cpp:44f8cae1dcf0 : 291 + 0xb]
    rip = 0x0240d989   rsp = 0x5fbfb5a0
    Found by: stack scanning
 2  XUL!js::gc::FinalizeArenas [jsgc.cpp:44f8cae1dcf0 : 338 + 0x14]
    rip = 0x02404e01   rsp = 0x5fbfb610
    Found by: stack scanning

Thread 1
 0  libSystem.B.dylib + 0x19c0a
    rbx = 0x000cde50   r12 = 0x70f0f998   r13 = 0x70f0fd68   r14 = 0xffffffff
    r15 = 0x70f0fda8   rip = 0x87eebc0a   rsp = 0x000cdce8   rbp = 0x000cde90
    Found by: given as instruction pointer in context
 1  libSystem.B.dylib + 0x1badc
    rip = 0x87eedadd   rsp = 0x000cdcf0
    Found by: stack scanning
 2  libSystem.B.dylib + 0x1ca9a
    rip = 0x87eeea9b   rsp = 0x000cdd50
    Found by: stack scanning
 3  libSystem.B.dylib + 0x1c92c
    rip = 0x87eee92d   rsp = 0x000cdd70
    Found by: stack scanning
 4  libmozglue.dylib!arena_run_alloc [jemalloc.c:44f8cae1dcf0 : 3552 + 0xe]
    rip = 0x0000d770   rsp = 0x000cdd90
    Found by: stack scanning
 5  libSystem.B.dylib + 0x1c78a
    rip = 0x87eee78b   rsp = 0x000cddc0
    Found by: stack scanning
 6  libSystem.B.dylib + 0x19c27
    rip = 0x87eebc28   rsp = 0x000cddf0
    Found by: stack scanning
 7  libSystem.B.dylib + 0x1b795
    rip = 0x87eed796   rsp = 0x000cde10
    Found by: stack scanning
}

Comment 1

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

This bug was observed only on one or more of the six machines listed in
bug 787281 comment 11, which seem likely to have bad memory, disk, or
other hardware problem, based on the rate of failures on those machines
and the types of failures observed.

Therefore I'm marking this bug invalid, though it should be reopened if
it occurs on other (more reliable) hardware.