801336 - PGO error? crash in ToBooleanSlow

Status: RESOLVED DUPLICATE of bug 791214

(Core :: JavaScript Engine, defect)

Description

[Alice0775 White]

This bug was filed from the Socorro interface and is 
report bp-61d3c319-fda8-434a-acb0-4b0362121013 .
============================================================= 

http://hg.mozilla.org/mozilla-central/rev/90857937b601
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:19.0) Gecko/19.0 Firefox/19.0 ID:20121013030542

I noticed the crash when I test Bug 801267.

Steps to reproduce:
1. Open http://paperjs.org/examples/meta-balls/
2. Move mouse in the right pane

Comment 1

[Alice0775 White]

tinder box build hourly does not crash.however, Nightly nightly build crashes in spite of the same change set .
Something wrong PGO?

Regression window(m-c)
Good(tinder box build):
http://hg.mozilla.org/mozilla-central/rev/90857937b601
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:19.0) Gecko/19.0 Firefox/19.0 ID:20121012191638
Crash(nightly build):
http://hg.mozilla.org/mozilla-central/rev/90857937b601
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:19.0) Gecko/19.0 Firefox/19.0 ID:20121013030542

Comment 2

[Scoobidiver (away)]

64-bit builds don't crash either.

Comment 3

[Alice0775 White]

I cannot reproduce the crash in Nightly19.0a1 2012-10-14 and 2012-10-15 anymore.

Comment 4

[Alice0775 White]

bp-4c5cbb4f-1a4a-4930-a97f-b6c9d2121017
bp-4f8182a3-385a-43fa-ae7f-104a62121017

Browser crashes with same STR in Nightly19.0a1 2012-10-16 and 2012-10-17 again .

So I think something PGO error .

Comment 5

[Alice0775 White]

Not crash;
http://hg.mozilla.org/mozilla-central/rev/8f145599e4bf
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:19.0) Gecko/19.0 Firefox/19.0 ID:20121016010947
Crash:
http://hg.mozilla.org/mozilla-central/rev/8f145599e4bf
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:19.0) Gecko/19.0 Firefox/19.0 ID:20121016030544

Not crash;
http://hg.mozilla.org/mozilla-central/rev/dac5700acf8b
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:19.0) Gecko/19.0 Firefox/19.0 ID:20121016185305
Crash:
http://hg.mozilla.org/mozilla-central/rev/dac5700acf8b
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:19.0) Gecko/19.0 Firefox/19.0 ID:20121017030548

Comment 6

[Alex Keybl [:akeybl]]

Not clear that this issue is critical, but it is a reproducible regression and we should take a look.

Comment 8

[David Anderson [:dvander] - inactive, e-mail if emergency]

I can reproduce this, and given the mess PGO made in js::Interpret, it is likely Yet Another PGO Bug. Unfortunately it's not as clear where we should deoptimize this time. ToBooleanSlow is probably not a good candidate since it's not optimized or inlined, but it's worth a shot. Next up might be ToBoolean or whatever is calling ToBooleanSlow.

Comment 9

[Alex Keybl [:akeybl]]

Given the fact that this isn't a top crasher, untracking so that the JS team has time to investigate bugs 791214 and 791999.