800829 - Firefox 19 crash in js::types::TypeSet::hasType

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Scoobidiver (away)]

With the stack trace below, it first appeared in 19.0a1/20121010 and is currently #8 top crasher in today's build. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=aa5e3b445810&tochange=ec10630b1a54

Signature 	js::types::TypeSet::hasType(js::types::Type) More Reports Search
UUID	e8f33f43-2380-466f-b279-c27232121012
Date Processed	2012-10-12 05:12:51
Uptime	77
Last Crash	1.6 minutes before submission
Install Age	14.6 hours since version was first installed.
Install Time	2012-10-11 14:39:13
Product	Firefox
Version	19.0a1
Build ID	20121011030552
Release Channel	nightly
OS	Windows NT
OS Version	6.1.7600
Build Architecture	x86
Build Architecture Info	GenuineIntel family 6 model 30 stepping 5
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x0
App Notes 	
AdapterVendorID: 0x1002, AdapterDeviceID: 0x68e0, AdapterSubsysID: 1bf21043, AdapterDriverVersion: 8.692.1.0
D3D10 Layers? D3D10 Layers- D3D9 Layers? D3D9 Layers+ 
EMCheckCompatibility	True
Adapter Vendor ID	0x1002
Adapter Device ID	0x68e0
Total Virtual Memory	2147352576
Available Virtual Memory	1794318336
System Memory Use Percentage	41
Available Page File	2422882304
Available Physical Memory	1217544192

Frame 	Module 	Signature 	Source
0 	mozjs.dll 	js::types::TypeSet::hasType 	js/src/jsinferinlines.h:1289
1 	mozjs.dll 	js::baseops::SetPropertyHelper 	js/src/jsobj.cpp:4686
2 	mozjs.dll 	js::ion::SetProperty 	js/src/ion/VMFunctions.cpp:376
3 	mozjs.dll 	js::ion::SetPropertyCache 	js/src/ion/IonCaches.cpp:1068
4 		@0x2c0d56e

More reports at:
https://crash-stats.mozilla.com/report/list?version=Firefox:19.0a1&signature=js%3A%3Atypes%3A%3ATypeSet%3A%3AhasType%28js%3A%3Atypes%3A%3AType%29

Comment 1

[Alex Keybl [:akeybl]]

dvander/naveed - please add the qawanted/steps-wanted/needURLs keywords if this regression isn't immediately obvious from the regression range.

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

From the callstack this looks IonMonkey related. Nothing in the regression range or callstack strikes me though. CC'ing some IonCache.cpp experts just in case.

Comment 3

[Marcia Knous [:marcia]]

3 	http://www.meamargroup.com/pages/products/ProjeuctDetails.aspx?Id=37
3 	http://vk.com/app3130031?loc=apps&ref=12
3 	http://nhacpro.info/
2 	http://screepts.com/happyplace/v2/#
2 	http://jeux.jooprix.com/
2 	http://vk.com/app3130031_137810806?ref=9
2 	http://noone.com.vn/chi-tiet-san-pham/android-tv-box-measy-a5a-12-ghz-cortex-17.
2 	http://www.odnoklassniki.ru/game/100to1
2 	http://www.tcgrandelondrina.com.br/
2 	about:blank
1 	http://www.paulistana.org.br/site/
1 	http://172.21.6.11/calidadgestion/principal.php
1 	http://worldoflogs.com/reports/rt-orjue24pqgpawe63/sum/damageDone/?s=10000&e=103
1 	http://dispendik.surabaya.go.id/
1 	http://narutogame.com.br/index.php?secao=dojo_batalha_lutador
1 	http://www.chainreactioncycles.com/Categories.aspx?CategoryID=2580
1 	http://www.chainreactioncycles.com/Offers.aspx?Offer=2&Page=14&SortBy=salesrank
1 	http://www.logitech.com/en-us/support/mice/marathon-mouse-m705
1 	http://www.chainreactioncycles.com/Models.aspx?ModelID=74906
1 	http://rusbt.ru/katalog-tovarov/01-bytovaya-tekhnika/04-tekhnika-dlya-doma/08-kh
1 	http://honthe.soha.vn/tin-tuc/642-cac-loi-code-cho-close-beta-va-cach-nhn.html
1 	http://jeux.jooprix.com/
1 	http://vk.com/
1 	http://www.swiatokularow.com/index.php/sklep/okulary-korekcyjne/oprawy-meskie
1 	https://www.google.com.br/search?um=1&hl=en&client=firefox-nightly&rls=org.mozil
1 	http://worldoflogs.com/reports/rt-48zwgji3qkwrhcq9/sum/damageDone/?s=11885&e=122
1 	http://apps.facebook.com/inthemafia/index.php?next_params=YTozOntpOjA7czo1OiJpbm
1 	http://www.codeavengers.com/javascript#10.4
1 	http://www.mousehuntgame.com/turn.php
1 	http://www.dernierinventaire.fr/
1 	http://www.banyuwangikab.go.id/#
1 	http://www.mousehuntgame.com/

Comment 4

[Alice0775 White]

Build Identifier:
http://hg.mozilla.org/mozilla-central/rev/5ecff3e46ed5
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:19.0) Gecko/19.0 Firefox/19.0 ID:20121026030606

bp-bc370adc-9968-416f-918a-6c8492121026

Reproducible: always

Steps to reproduce:
1. Open http://live.nicovideo.jp/
2. Stay for about 1min30sec

Actual results:
Crash

Expexted results:
not crash

Comment 5

[Scoobidiver (away)]

(In reply to Alice0775 White from comment #4)
> bp-bc370adc-9968-416f-918a-6c8492121026
It's bug 790473.

Comment 6

[Alice0775 White]

(In reply to Scoobidiver from comment #5)
> (In reply to Alice0775 White from comment #4)
> > bp-bc370adc-9968-416f-918a-6c8492121026
> It's bug 790473.

Oops:
bp-e4b444e9-194a-4066-8ca9-5e35b2121026

And I got bug 790473 randomly with same STR.

Comment 7

[Scoobidiver (away)]

Crashes almost completely stopped after 19.0a1/20121024. The working range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=93cc1ee94291&tochange=5c82f5a5e90d

Comment 8

[Scoobidiver (away)]

Alice, do you still crash with your STR of comment 4?

Comment 9

[Alice0775 White]

http://hg.mozilla.org/mozilla-central/rev/456cb08f8509
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:22.0) Gecko/20130326 Firefox/22.0 ID:20130326030941
http://hg.mozilla.org/releases/mozilla-aurora/rev/e89c06192e6c
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20130326 Firefox/21.0 ID:20130326042012
http://hg.mozilla.org/releases/mozilla-beta/rev/06ddb0618063
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:20.0) Gecko/20100101 Firefox/20.0 ID:20130325214615

I cannot reproduce the crash anymore.