798870 - IonMonkey: crash in js::ion::FastInvoke

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Scoobidiver (away)]

It first appeared in 18.0a1/20121006134717 and is #1 top crasher with about 40 crashes an hour. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=2da1f2bde40e&tochange=9f677c2bb33d
It's a regression from bug 797131.

Signature 	js::ion::FastInvoke(JSContext*, JS::Handle<JSFunction*>, JS::CallArgs&) More Reports Search
UUID	2f1724f5-f2f7-46d4-9f02-037052121007
Date Processed	2012-10-07 07:05:00
Uptime	1050
Last Crash	3.5 days before submission
Install Age	17.5 minutes since version was first installed.
Install Time	2012-10-07 06:47:08
Product	Firefox
Version	18.0a1
Build ID	20121006134717
Release Channel	nightly
OS	Windows NT
OS Version	5.1.2600 Service Pack 3
Build Architecture	x86
Build Architecture Info	GenuineIntel family 15 model 4 stepping 9
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x0
App Notes 	
AdapterVendorID: 0x8086, AdapterDeviceID: 0x29c2, AdapterSubsysID: 00000000, AdapterDriverVersion: 6.14.10.5218
D3D10 Layers? D3D10 Layers- D3D9 Layers? D3D9 Layers- 
EMCheckCompatibility	True
Adapter Vendor ID	0x8086
Adapter Device ID	0x29c2
Total Virtual Memory	2147352576
Available Virtual Memory	1735913472
System Memory Use Percentage	53
Available Page File	2055303168
Available Physical Memory	499310592

Frame 	Module 	Signature 	Source
0 	mozjs.dll 	js::ion::FastInvoke 	js/src/ion/Ion.cpp:1474
1 	mozjs.dll 	js::FastInvokeGuard::invoke 	js/src/jsinterpinlines.h:1035
2 	mozjs.dll 	array_map 	js/src/jsarray.cpp:3225
3 	mozjs.dll 	js::mjit::CallCompiler::generateNativeStub 	js/src/methodjit/MonoIC.cpp:1057
4 	mozjs.dll 	js::mjit::ic::NativeCall 	js/src/methodjit/MonoIC.cpp:1307
5 	mozjs.dll 	js::mjit::JaegerShot 	js/src/methodjit/MethodJIT.cpp:1122
6 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:2513
7 	mozjs.dll 	js::RunScript 	js/src/jsinterp.cpp:316
8 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:378
9 	mozjs.dll 	js::Invoke 	js/src/jsinterp.h:109
10 	mozjs.dll 	js::FastInvokeGuard::invoke 	js/src/jsinterpinlines.h:1051
11 	mozjs.dll 	array_readonlyCommon<ArrayForEachBehavior> 	js/src/jsarray.cpp:3123
12 	mozjs.dll 	array_forEach 	js/src/jsarray.cpp:3160
13 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:367
14 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:2461
15 	mozjs.dll 	js::ObjectImpl::nativeLookup 	js/src/vm/ObjectImpl.cpp:265

More reports at:
https://crash-stats.mozilla.com/report/list?signature=js%3A%3Aion%3A%3AFastInvoke%28JSContext*%2C+JS%3A%3AHandle%3CJSFunction*%3E%2C+JS%3A%3ACallArgs%26%29
https://crash-stats.mozilla.com/report/list?signature=js%3A%3Aion%3A%3AFastInvoke

Comment 1

[Alex Keybl [:akeybl]]

Sounds like this should drop off given https://bugzilla.mozilla.org/show_bug.cgi?id=797131#c11. Let's see if that's true.

Comment 2

[Scoobidiver (away)]

There are no crashes in 18.0a1/20121007 and above.

Comment 3

[Scoobidiver (away)]

Fixed by disabling part 3 of bug 797131.

Comment 4

[Manuela Muntean [Away]]

While checking in Socorro, there aren't any new crashes appeared within the last month, with these 2 signatures.