Closed Bug 801954 Opened 12 years ago Closed 11 years ago

Intermittent crash [@ js::ion::FinishInvalidation] during browser_tilt_02_notifications-seq.js

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86_64
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: philor, Unassigned)

References

Details

(Keywords: crash, intermittent-failure) 

https://tbpl.mozilla.org/php/getParsedLog.php?id=16133663&tree=Mozilla-Inbound
Rev4 MacOSX Snow Leopard 10.6 mozilla-inbound opt test mochitest-other on 2012-10-15 16:07:07 PDT for push e54a4777f65a
slave: talos-r4-snow-051

PROCESS-CRASH | chrome://mochitests/content/browser/browser/devtools/tilt/test/browser_tilt_02_notifications-seq.js | application crashed (minidump found)
Crash dump filename: /var/folders/Hs/HsDn6a9SG8idoIya6p9mtE+++TI/-Tmp-/tmpxPXIM8/minidumps/82E50218-388F-4F62-B469-146B4F7D0E78.dmp
Operating system: Mac OS X
                  10.6.8 10K549
CPU: amd64
     family 6 model 23 stepping 10
     2 CPUs

Crash reason:  EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
Crash address: 0x10000078

Thread 0 (crashed)
 0  XUL!js::ion::FinishInvalidation(js::FreeOp*, JSScript*) [IonCode.h : 386 + 0x0]
    rbx = 0x000000012f5d6920   r12 = 0x0000000106991cf0
    r13 = 0x00007fff5fbfccc0   r14 = 0x0000000155d7f000
    r15 = 0x0000000000000000   rip = 0x0000000102833f6a
    rsp = 0x00007fff5fbfcc80   rbp = 0x00007fff5fbfcc90
    Found by: given as instruction pointer in context
 1  XUL!JSCompartment::discardJitCode(js::FreeOp*, bool) [jscompartment.cpp : 504 + 0xa]
    rbx = 0x000000012f5d6920   r12 = 0x0000000106991cf0
    r13 = 0x00007fff5fbfccc0   r14 = 0x0000000155d7f000
    r15 = 0x0000000000000000   rip = 0x00000001025e99aa
    rsp = 0x00007fff5fbfcca0   rbp = 0x00007fff5fbfcd10
    Found by: call frame info
 2  XUL!IncrementalCollectSlice [jsgc.cpp : 3399 + 0x9]
    rbx = 0x0000000106991000   r12 = 0x00000001069912e0
    r13 = 0x000000013245c050   r14 = 0x0000000106991cf0
    r15 = 0x000000013245c078   rip = 0x00000001026194d5
    rsp = 0x00007fff5fbfcd20   rbp = 0x00007fff5fbfce90
    Found by: call frame info
 3  XUL!GCCycle [jsgc.cpp : 4533 + 0x10]
    rbx = 0x000000015c8c7800   r12 = 0x0000000000002710
    r13 = 0x0000000000002710   r14 = 0x0000000000000000
    r15 = 0x0000000106991000   rip = 0x0000000102618c04
    rsp = 0x00007fff5fbfcea0   rbp = 0x00007fff5fbfced0
    Found by: call frame info
 4  XUL!Collect [jsgc.cpp : 4647 + 0x14]
    rbx = 0x0000000000000012   r12 = 0x0000000106991000
    r13 = 0x00000001069912e0   r14 = 0x0000000000000001
    r15 = 0x00000001069919b0   rip = 0x00000001026161cc
    rsp = 0x00007fff5fbfcee0   rbp = 0x00007fff5fbfcf20
    Found by: call frame info
 5  XUL!nsJSContext::GarbageCollectNow(js::gcreason::Reason, nsJSContext::IsIncremental, nsJSContext::IsCompartment, nsJSContext::IsShrinking, long long) [nsJSEnvironment.cpp : 2942 + 0xa]
    rbx = 0x0000000100395000   r12 = 0x0000000000000012
    r13 = 0x0000000000000001   r14 = 0x0000000000000000
    r15 = 0x0000000000000000   rip = 0x00000001016e695a
    rsp = 0x00007fff5fbfcf30   rbp = 0x00007fff5fbfcf70
    Found by: call frame info
 6  XUL!nsTimerImpl::Fire() [nsTimerImpl.cpp : 472 + 0x9]
    rbx = 0x0000000155af6e20   r12 = 0x0000000000000002
    r13 = 0x0000000100328902   r14 = 0x00000001016ebe90

See also bug 798849, where we have the tilt tests disabled on Linux because they constantly hit OOM, beginning when ionmonkey landed.
Whiteboard: [orange]
Resolving WFM keyword:intermittent-failure bugs last modified >3 months ago, whose whiteboard contains none of:
{random,disabled,marked,fuzzy,todo,fails,failing,annotated,time-bomb,leave open}

There will inevitably be some false positives; for that (and the bugspam) I apologise. Filter on orangewfm.
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.