790464 - IonMonkey: crash @ JSRope::flattenInternal

Status: RESOLVED DUPLICATE of bug 779411

(Core :: JavaScript Engine, defect)

Description

[ferongr]

Using a 32bit Nightly hourly after Ion landed. Cset: fdfaef738a00

Go to the pdf.js web demo (see URL field) and start zooming in and out of the example PDF using the reader's toolbar buttons. After some 10-20 zoom changes the browser crashes. Example crash IDs follow.

bp-d34e08ee-4f07-4235-bf6b-191712120911
bp-fe76d5e6-9b4e-4151-adb2-a464c2120911
bp-3f59cb80-66e6-4779-87e6-f09b12120911
bp-ece93ac7-2b35-4ae1-a1e9-3bac12120911
bp-12a2ada1-cacb-4698-8711-c9c5c2120911

Comment 1

[(mostly gone) XtC4UaLL [:xtc4uall]]

Tried against http://hg.mozilla.org/projects/ionmonkey/rev/01f6ddbb6542

bp-e557e340-edf3-40cc-b207-a80722120912

Frame 	Module 	Signature 	Source
0 	mozjs.dll 	JSRope::flattenInternal<1> 	js/src/vm/String.cpp:241
1 	mozjs.dll 	JS_GetStringCharsZAndLength 	js/src/jsapi.cpp:6192
2 	xul.dll 	mozilla::dom::ConvertJSValueToString 	obj-firefox/dist/include/mozilla/dom/BindingUtils.h:1005
3 	xul.dll 	mozilla::dom::CanvasRenderingContext2DBinding::set_font 	obj-firefox/dom/bindings/CanvasRenderingContext2DBinding.cpp:2135
4 		@0x69eb296

Comment 2

[Scoobidiver (away)]

It's currently #1 top crasher in today's nightly. The regression range for the spike is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=96287ad60bef&tochange=fdfaef738a00

More reports at:
https://crash-stats.mozilla.com/report/list?signature=JSRope%3A%3AflattenInternal%3Cint%3E%28JSContext*%29

Comment 3

[Robert Kaiser]

Note that this is being mentioned in bug 790663, possibly a way to repro this crash.

Comment 4

[ferongr]

Easier way to reproduce.

1. Go to http://html5puzzle.appspot.com/
2. Click Play.
3. Wait a few seconds.

bp-9896c159-57e9-4987-9645-9e4e32120912
bp-a0805bca-95ae-4824-968c-ab5402120912
bp-fb70d73d-7238-4400-a3be-e0fa22120912
bp-2b9668e2-fa0c-40e1-a466-590442120912
bp-5037ac3d-7734-4cbd-9fdc-7726c2120912
bp-9bd3ef68-dc11-4a00-bf7c-a3c6e2120912

Comment 5

[Jeff Muizelaar [:jrmuizel]]

I get this in the profiler addon as well.

Comment 6

[Scoobidiver (away)]

There are about 400 crashes per build.

Comment 7

[Brian Carpenter [:geeknik]]

Attachment: Windbg Log File

http://seb.ly/demos/MMOsteroids.html causes Nightly to crash.

https://crash-stats.mozilla.com/report/index/bp-ad8cf2a6-2173-4333-96b9-bc1232120917
https://crash-stats.mozilla.com/report/index/bp-675f4733-65e6-45bf-bfe6-39c9d2120917

Probably not necessary at this point, but I'm attaching a windbg log anyways.

Comment 8

[Scoobidiver (away)]

Changing the URL has this one is an immediate crash.

Comment 9

[Jan de Mooij [:jandem]]

I can reproduce this, it's a regalloc problem with LSetDomProperty. JSRope::flattenInternal is just one of the many places this will crash, so fixing it should hopefully also get rid of some other new topcrashes.

With bug 779411 this would have asserted immediately, will rebase and land that ASAP.

Comment 10

[Sean Stangl [:sstangl]]

http://seb.ly/demos/MMOsteroids.html and http://html5puzzle.appspot.com/ work fine for me with today's Nightly. Resolving duplicate of the bug that fixed them.

Comment 11

[IU]

(In reply to Sean Stangl from comment #10)
> http://seb.ly/demos/MMOsteroids.html and http://html5puzzle.appspot.com/
> work fine for me with today's Nightly. Resolving duplicate of the bug that
> fixed them.
> 
> *** This bug has been marked as a duplicate of bug 779411 ***

Today's nightly doesn't even include that.  Are you sure you were using a nightly build and not an hourly?

Comment 12

[Sean Stangl [:sstangl]]

Hm, you're right that the nightly doesn't include that. I am using a nightly build, and as of today it no longer reproduces for me. I'll leave open for someone else to confirm tomorrow.

Comment 13

[Loic]

I'm trying the latest Nightly and it doesn't crash anymore with the links posted previously. So I guess it's fixed.

Comment 14

[Sean Stangl [:sstangl]]

(In reply to Loic from comment #13)
> I'm trying the latest Nightly and it doesn't crash anymore with the links
> posted previously. So I guess it's fixed.

Thanks!

Comment 15

[[e-mail] (:bhearsum)]

I'm still crashing on http://www.syngames.net/game/braidjump on the latest nightly.

Comment 16

[Scoobidiver (away)]

(In reply to Ben Hearsum [:bhearsum] from comment #15)
> I'm still crashing on http://www.syngames.net/game/braidjump on the latest
> nightly.
There are no crashes with this crash signature on the latest Nightly: https://crash-stats.mozilla.com/query/query?product=Firefox&version=Firefox%3A18.0a1&range_value=1&range_unit=weeks&query_search=signature&query_type=contains&query=JSRope%3A%3AflattenInternal&reason=&build_id=20120919030602&process_type=any&hang_type=any&do_query=1

Comment 17

[[e-mail] (:bhearsum)]

Whoops, I thought bug 791589 was a dupe of this - sorry.