776861 - Intermittent crash in jsreftest.html?test=js1_5/Array/regress-99120-01.js [@ exn_finalize]

Status: RESOLVED INVALID

(Core :: JavaScript Engine, defect)

Description

[Ed Morley [:emorley]]

Rev4 MacOSX Snow Leopard 10.6 mozilla-inbound debug test jsreftest on 2012-07-23 22:51:18 PDT for push 46bd216c417f

slave: talos-r4-snow-041

https://tbpl.mozilla.org/php/getParsedLog.php?id=13794568&tree=Mozilla-Inbound

{
REFTEST TEST-START | file:///Users/cltbld/talos-slave/test/build/jsreftest/tests/jsreftest.html?test=js1_4/Regress/toString-001-n.js | 1735 / 3212 (54%)
++DOMWINDOW == 50 (0x1253f5ba0) [serial = 3290] [outer = 0x10a225e10]
BUGNUMBER: 310514
toString-001.js Regression test case for 310514
 FAILED! TypeError: Function.prototype.toString called on incompatible object
JavaScript error: file:///Users/cltbld/talos-slave/test/build/jsreftest/tests/js1_4/Regress/toString-001-n.js, line 35: Function.prototype.toString called on incompatible object
REFTEST TEST-PASS | file:///Users/cltbld/talos-slave/test/build/jsreftest/tests/jsreftest.html?test=js1_4/Regress/toString-001-n.js | var o = {}; o.toString = Function.prototype.toString; o.toString(); file:///Users/cltbld/talos-slave/test/build/jsreftest/tests/js1_4/Regress/toString-001-n.js:35: TypeError: Function.prototype.toString called on incompatible object item 1
REFTEST INFO | Loading a blank page
++DOMWINDOW == 51 (0x127dc1820) [serial = 3291] [outer = 0x10a225e10]
REFTEST TEST-START | file:///Users/cltbld/talos-slave/test/build/jsreftest/tests/jsreftest.html?test=js1_5/Array/regress-101964.js | 1736 / 3212 (54%)
++DOMWINDOW == 52 (0x127d8e0f0) [serial = 3292] [outer = 0x10a225e10]
BUGNUMBER: 101964
STATUS: Performance: truncating even very large arrays should be fast!
REFTEST TEST-PASS(EXPECTED RANDOM) | file:///Users/cltbld/talos-slave/test/build/jsreftest/tests/jsreftest.html?test=js1_5/Array/regress-101964.js | Section 1 of test -   item 1
REFTEST INFO | Loading a blank page
++DOMWINDOW == 53 (0x1253c7e50) [serial = 3293] [outer = 0x10a225e10]
REFTEST TEST-START | file:///Users/cltbld/talos-slave/test/build/jsreftest/tests/jsreftest.html?test=js1_5/Array/regress-99120-01.js | 1737 / 3212 (54%)
++DOMWINDOW == 54 (0x1253c5df0) [serial = 3294] [outer = 0x10a225e10]
BUGNUMBER: 99120
STATUS: sort() should not be O(N^2) on sorted data
TEST-UNEXPECTED-FAIL | file:///Users/cltbld/talos-slave/test/build/jsreftest/tests/jsreftest.html?test=js1_5/Array/regress-99120-01.js | Exited with code 1 during test run
INFO | automation.py | Application ran for: 0:06:38.015405
INFO | automation.py | Reading PID log: /var/folders/Hs/HsDn6a9SG8idoIya6p9mtE+++TI/-Tmp-/tmpyRBSIzpidlog
Downloading symbols from: http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-inbound-macosx64-debug/1343107542/firefox-17.0a1.en-US.mac64.crashreporter-symbols.zip
PROCESS-CRASH | file:///Users/cltbld/talos-slave/test/build/jsreftest/tests/jsreftest.html?test=js1_5/Array/regress-99120-01.js | application crashed (minidump found)
Crash dump filename: /var/folders/Hs/HsDn6a9SG8idoIya6p9mtE+++TI/-Tmp-/tmplRolCE/minidumps/8C94860C-61F0-4AFA-BF75-78E065B6BDF0.dmp
Operating system: Mac OS X
                  10.6.8 10K549
CPU: amd64
     family 6 model 23 stepping 10
     2 CPUs

Crash reason:  EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
Crash address: 0x0

Thread 0 (crashed)
 0  XUL!exn_finalize [jsexn.cpp : 384 + 0x0]
    rbx = 0x42bd1550   r12 = 0x42bd2000   r13 = 0x00000030   r14 = 0x00000000
    r15 = 0x5fbfb828   rip = 0x033f6de9   rsp = 0x5fbf7560   rbp = 0x5fbf7580
    Found by: given as instruction pointer in context
 1  XUL!JSObject::finalize [jsobjinlines.h : 252 + 0x7]
    rip = 0x0341f737   rsp = 0x5fbf7590
    Found by: stack scanning
 2  XUL!js::gc::finalize<JSObject> [jsgc.cpp : 297 + 0xb]
    rip = 0x0341f1ed   rsp = 0x5fbf75b0
    Found by: stack scanning
 3  XUL!js::gc::Chunk::releaseArena [jsgc.cpp : 765 + 0xd]
    rip = 0x03407232   rsp = 0x5fbf7600
    Found by: stack scanning
 4  XUL!js::gc::FinalizeTypedArenas<JSObject> [jsgc.cpp : 344 + 0x10]
    rip = 0x0341a2b9   rsp = 0x5fbf7650
    Found by: stack scanning
 5  XUL!js::gc::ArenaLists::finalizeObjects [jsgc.cpp : 1647 + 0xf]
    rip = 0x03408904   rsp = 0x5fbf76a0
    Found by: stack scanning
 6  XUL!GCCycle [jsgc.cpp : 3464 + 0xb]
    rip = 0x0340f9ff   rsp = 0x5fbf76c0
    Found by: stack scanning
}

Comment 1

[Ed Morley [:emorley]]

Did bug 765464 just change the signature of bug 775446 to that in comment 0, or is this different?

Comment 2

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

I find it very unlikely that I had anything to do with it.

Comment 3

[Ed Morley [:emorley]]

Ok :-)

Comment 4

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

This bug was observed only on one or more of the six machines listed in
bug 787281 comment 11, which seem likely to have bad memory, disk, or
other hardware problem, based on the rate of failures on those machines
and the types of failures observed.

Therefore I'm marking this bug invalid, though it should be reopened if
it occurs on other (more reliable) hardware.