Closed Bug 794947 Opened 8 years ago Closed 8 years ago

Today's nightly (9/27/12) is extremely crashy in GMail, fixed by disabling ionmonkey

Categories

(Core :: JavaScript Engine, defect, critical)

x86_64
All
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla18
Tracking Status
firefox18 - ---

People

(Reporter: bent.mozilla, Assigned: billm)

References

Details

(Keywords: crash)

Crash Data

Attachments

(1 file)

I'm running today's nightly build on windows (9/27/12, built from b038e9e2023f). I was going through my GMail by clicking on a message and then clicking the 'next message' button on the upper right. I'd be able to go through about five emails before crashing.

Crash reports:

bp-57e44689-5958-45ff-8fa9-306752120927
bp-3c1dabf1-7d17-4d3a-8a5a-dcd612120927
bp-8857347c-86c4-43e4-b74c-230cb2120927
bp-312c1676-5d9d-47a6-af03-c44d62120927

I set 'javascript.options.ion.content' to false and the crash no longer happens.
It's probably related to bug 794907. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=ca4af4af5334&tochange=b038e9e2023f
It might be a regression from bug 790051.
Severity: normal → critical
Keywords: crash
The mac builds are also crashing for me when loading gmail. After restarting, my gmail pinned tab starts to load and immediately after the progress bar finishes and shows the list of messages, Nightly crashes.

nightly build on os x 9/27/12
http://hg.mozilla.org/mozilla-central/rev/b038e9e2023f

The crash reports are much less useful in finding this bug report though.

Starting in safe mode doesn't crash and javascript.options.ion.content to false also doesn't crash.

[@ @0x12cdcefb5 ] https://crash-stats.mozilla.com/report/index/bp-acedc214-a078-47a6-a259-f185b2120927
[@ @0x12becc7d5 ] https://crash-stats.mozilla.com/report/index/bp-0824dc54-997a-47fe-9d8a-a12df2120927
[@ @0x1057bd975 ] https://crash-stats.mozilla.com/report/index/bp-31614e7b-f731-4c8a-9623-04fc92120927
[@ @0x11e6cc125 ] https://crash-stats.mozilla.com/report/index/bp-a7b775aa-1de7-425c-b0c5-92e292120927
[@ @0x11e65a3b5 ] https://crash-stats.mozilla.com/report/index/bp-1707318e-9bdc-40e2-92c1-5cd062120927
OS: Windows 7 → All
Crashes on a new Nightly profile too:

[@ @0x11b8ec71d ] https://crash-stats.mozilla.com/report/index/bp-10ffdd39-ec5a-49ec-907c-5e8652120927

However the first load of gmail worked fine. It only crashed after restarting Firefox.
Looking into this now.
Assignee: general → dvander
Status: NEW → ASSIGNED
This sounds like a regression from bug 787856. I probably missed a place in IonMonkey where we're using the proto of an object that might be a CCW.
I've also been crashing in gmail after updating, and disabling ionmonkey fixed it. However, the reports look different:

bp-c83b0258-aab8-48b1-a032-8229d2120927
bp-94b0e120-dfea-4e48-aa9a-8fb172120927
bp-4a236cbb-56a3-4a42-bac9-12b072120927
Crash Signature: [@ js::ObjectImpl::nativeLookup(JSContext*, int)] [@ JSObject::getGeneric(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<int>, JS::MutableHandle<JS::Value>)] [@ js::CrossCompartmentWrapper::call(JSContext*, JSObject*, unsigned int …
Crash Signature: JS::Value*)] → JS::Value*)] [@ js::baseops::LookupProperty] [@ PR_SetThreadPrivate | EnterIon]
Bill bisected this to verify comment #5
Assignee: dvander → wmccloskey
Attached patch patchSplinter Review
This patch fixes the problem for me. I got an r+ from dvander at the office while the power was out.

https://hg.mozilla.org/mozilla-central/rev/64558e8ed723
Attachment #665744 - Flags: review+
Status: ASSIGNED → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla18
Flags: in-testsuite+
Duplicate of this bug: 794907
Everything seems to work great for me today, thanks for the quick work guys!
Duplicate of this bug: 794939
Depends on: 814177
You need to log in before you can comment on or make changes to this bug.