Today's nightly (9/27/12) is extremely crashy in GMail, fixed by disabling ionmonkey

RESOLVED FIXED in mozilla18

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
6 years ago
5 years ago

People

(Reporter: Ben Turner (not reading bugmail, use the needinfo flag!), Assigned: billm)

Tracking

({crash})

Trunk
mozilla18
x86_64
All
crash
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(firefox18-)

Details

(crash signature)

Attachments

(1 attachment)

I'm running today's nightly build on windows (9/27/12, built from b038e9e2023f). I was going through my GMail by clicking on a message and then clicking the 'next message' button on the upper right. I'd be able to go through about five emails before crashing.

Crash reports:

bp-57e44689-5958-45ff-8fa9-306752120927
bp-3c1dabf1-7d17-4d3a-8a5a-dcd612120927
bp-8857347c-86c4-43e4-b74c-230cb2120927
bp-312c1676-5d9d-47a6-af03-c44d62120927

I set 'javascript.options.ion.content' to false and the crash no longer happens.

Comment 1

6 years ago
It's probably related to bug 794907. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=ca4af4af5334&tochange=b038e9e2023f
It might be a regression from bug 790051.
Severity: normal → critical
Keywords: crash

Comment 2

6 years ago
The mac builds are also crashing for me when loading gmail. After restarting, my gmail pinned tab starts to load and immediately after the progress bar finishes and shows the list of messages, Nightly crashes.

nightly build on os x 9/27/12
http://hg.mozilla.org/mozilla-central/rev/b038e9e2023f

The crash reports are much less useful in finding this bug report though.

Starting in safe mode doesn't crash and javascript.options.ion.content to false also doesn't crash.

[@ @0x12cdcefb5 ] https://crash-stats.mozilla.com/report/index/bp-acedc214-a078-47a6-a259-f185b2120927
[@ @0x12becc7d5 ] https://crash-stats.mozilla.com/report/index/bp-0824dc54-997a-47fe-9d8a-a12df2120927
[@ @0x1057bd975 ] https://crash-stats.mozilla.com/report/index/bp-31614e7b-f731-4c8a-9623-04fc92120927
[@ @0x11e6cc125 ] https://crash-stats.mozilla.com/report/index/bp-a7b775aa-1de7-425c-b0c5-92e292120927
[@ @0x11e65a3b5 ] https://crash-stats.mozilla.com/report/index/bp-1707318e-9bdc-40e2-92c1-5cd062120927
OS: Windows 7 → All

Comment 3

6 years ago
Crashes on a new Nightly profile too:

[@ @0x11b8ec71d ] https://crash-stats.mozilla.com/report/index/bp-10ffdd39-ec5a-49ec-907c-5e8652120927

However the first load of gmail worked fine. It only crashed after restarting Firefox.
Looking into this now.
Assignee: general → dvander
Status: NEW → ASSIGNED
This sounds like a regression from bug 787856. I probably missed a place in IonMonkey where we're using the proto of an object that might be a CCW.

Comment 6

6 years ago
I've also been crashing in gmail after updating, and disabling ionmonkey fixed it. However, the reports look different:

bp-c83b0258-aab8-48b1-a032-8229d2120927
bp-94b0e120-dfea-4e48-aa9a-8fb172120927
bp-4a236cbb-56a3-4a42-bac9-12b072120927
tracking-firefox18: --- → ?

Updated

6 years ago
Crash Signature: [@ js::ObjectImpl::nativeLookup(JSContext*, int)] [@ JSObject::getGeneric(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<int>, JS::MutableHandle<JS::Value>)] [@ js::CrossCompartmentWrapper::call(JSContext*, JSObject*, unsign&hellip;

Updated

6 years ago
Crash Signature: [@ js::ObjectImpl::nativeLookup(JSContext*, int)] [@ JSObject::getGeneric(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<int>, JS::MutableHandle<JS::Value>)] [@ js::CrossCompartmentWrapper::call(JSContext*, JSObject*, unsign&hellip; → [@ js::ObjectImpl::nativeLookup(JSContext*, int)] [@ JSObject::getGeneric(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<int>, JS::MutableHandle<JS::Value>)] [@ js::CrossCompartmentWrapper::call(JSContext*, JSObject*, unsign&hellip;
Bill bisected this to verify comment #5
Assignee: dvander → wmccloskey
Created attachment 665744 [details] [diff] [review]
patch

This patch fixes the problem for me. I got an r+ from dvander at the office while the power was out.

https://hg.mozilla.org/mozilla-central/rev/64558e8ed723
Attachment #665744 - Flags: review+
Status: ASSIGNED → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla18
Flags: in-testsuite+

Updated

6 years ago
Duplicate of this bug: 794907
Everything seems to work great for me today, thanks for the quick work guys!

Updated

6 years ago
Duplicate of this bug: 794939

Updated

6 years ago
tracking-firefox18: ? → -
You need to log in before you can comment on or make changes to this bug.