Closed Bug 798870 Opened 13 years ago Closed 13 years ago

IonMonkey: crash in js::ion::FastInvoke

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Version:
18 Branch
Type:
defect
Priority:
Not set
Severity:
blocker

Tracking

()

Status:
VERIFIED FIXED
Milestone:
mozilla18
Tracking Flags:
Tracking Status
firefox18 + verified

People

(Reporter: scoobidiver, Unassigned)

References

Details

(Keywords: crash, regression, topcrash)

Crash Data

It first appeared in 18.0a1/20121006134717 and is #1 top crasher with about 40 crashes an hour. The regression range is: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=2da1f2bde40e&tochange=9f677c2bb33d It's a regression from bug 797131. Signature js::ion::FastInvoke(JSContext*, JS::Handle<JSFunction*>, JS::CallArgs&) More Reports Search UUID 2f1724f5-f2f7-46d4-9f02-037052121007 Date Processed 2012-10-07 07:05:00 Uptime 1050 Last Crash 3.5 days before submission Install Age 17.5 minutes since version was first installed. Install Time 2012-10-07 06:47:08 Product Firefox Version 18.0a1 Build ID 20121006134717 Release Channel nightly OS Windows NT OS Version 5.1.2600 Service Pack 3 Build Architecture x86 Build Architecture Info GenuineIntel family 15 model 4 stepping 9 Crash Reason EXCEPTION_ACCESS_VIOLATION_READ Crash Address 0x0 App Notes AdapterVendorID: 0x8086, AdapterDeviceID: 0x29c2, AdapterSubsysID: 00000000, AdapterDriverVersion: 6.14.10.5218 D3D10 Layers? D3D10 Layers- D3D9 Layers? D3D9 Layers- EMCheckCompatibility True Adapter Vendor ID 0x8086 Adapter Device ID 0x29c2 Total Virtual Memory 2147352576 Available Virtual Memory 1735913472 System Memory Use Percentage 53 Available Page File 2055303168 Available Physical Memory 499310592 Frame Module Signature Source 0 mozjs.dll js::ion::FastInvoke js/src/ion/Ion.cpp:1474 1 mozjs.dll js::FastInvokeGuard::invoke js/src/jsinterpinlines.h:1035 2 mozjs.dll array_map js/src/jsarray.cpp:3225 3 mozjs.dll js::mjit::CallCompiler::generateNativeStub js/src/methodjit/MonoIC.cpp:1057 4 mozjs.dll js::mjit::ic::NativeCall js/src/methodjit/MonoIC.cpp:1307 5 mozjs.dll js::mjit::JaegerShot js/src/methodjit/MethodJIT.cpp:1122 6 mozjs.dll js::Interpret js/src/jsinterp.cpp:2513 7 mozjs.dll js::RunScript js/src/jsinterp.cpp:316 8 mozjs.dll js::InvokeKernel js/src/jsinterp.cpp:378 9 mozjs.dll js::Invoke js/src/jsinterp.h:109 10 mozjs.dll js::FastInvokeGuard::invoke js/src/jsinterpinlines.h:1051 11 mozjs.dll array_readonlyCommon<ArrayForEachBehavior> js/src/jsarray.cpp:3123 12 mozjs.dll array_forEach js/src/jsarray.cpp:3160 13 mozjs.dll js::InvokeKernel js/src/jsinterp.cpp:367 14 mozjs.dll js::Interpret js/src/jsinterp.cpp:2461 15 mozjs.dll js::ObjectImpl::nativeLookup js/src/vm/ObjectImpl.cpp:265 More reports at: https://crash-stats.mozilla.com/report/list?signature=js%3A%3Aion%3A%3AFastInvoke%28JSContext*%2C+JS%3A%3AHandle%3CJSFunction*%3E%2C+JS%3A%3ACallArgs%26%29 https://crash-stats.mozilla.com/report/list?signature=js%3A%3Aion%3A%3AFastInvoke
Severity: critical → blocker
Sounds like this should drop off given https://bugzilla.mozilla.org/show_bug.cgi?id=797131#c11. Let's see if that's true.
There are no crashes in 18.0a1/20121007 and above.
Fixed by disabling part 3 of bug 797131.
Status: NEW → RESOLVED
Closed: 13 years ago
status-firefox18: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla18
While checking in Socorro, there aren't any new crashes appeared within the last month, with these 2 signatures.
Status: RESOLVED → VERIFIED
status-firefox18: fixed → verified
QA Contact: manuela.muntean
You need to log in before you can comment on or make changes to this bug.