Closed Bug 809322 Opened 13 years ago Closed 13 years ago

Intermittent crash [@ js::gc::MarkValueRootRange] in test_media_queries.html, test_parse_rule.html, test_bug57600.html, test_bug582412-1.html, test_HTMLDocument05.html, test_input_number_value.html, test_sessionStorageReplace.html, test_meter_element.html

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
ARM
Android
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME
Tracking Flags:
Tracking Status
firefox18 --- unaffected
firefox19 --- affected

People

(Reporter: philor, Unassigned)

References

Details

(Keywords: crash, intermittent-failure)

Crash Data

https://tbpl.mozilla.org/php/getParsedLog.php?id=16803700&tree=Mozilla-Inbound Android Armv6 Tegra 250 mozilla-inbound opt test mochitest-8 on 2012-11-06 16:35:23 PST for push 11ff92705a23 slave: tegra-254 35164 INFO TEST-PASS | /tests/layout/style/test/test_media_queries.html | Media query 'not all and (max--moz-device-pixel-ratio: 1)' should NOT apply after cloning INFO | automation.py | Application ran for: 0:07:37.749675 INFO | automation.py | Reading PID log: /tmp/tmpNu_fW5pidlog getting files in '/mnt/sdcard/tests/profile/minidumps/' Downloading symbols from: http://ftp.mozilla.org/pub/mozilla.org/mobile/tinderbox-builds/mozilla-inbound-android-armv6/1352244211/fennec-19.0a1.en-US.android-arm-armv6.crashreporter-symbols.zip PROCESS-CRASH | /tests/layout/style/test/test_media_queries.html | application crashed (minidump found) Crash dump filename: /tmp/tmprRqW5r/3a36def3-ecce-12cb-62384a09-3a5fab40.dmp Operating system: Android 0.0.0 Linux 2.6.32.9-00002-gd8084dc-dirty #1 SMP PREEMPT Wed Feb 2 11:32:06 PST 2011 armv7l nvidia/harmony/harmony/harmony:2.2/FRF91/20110202.102810:eng/test-keys CPU: arm 0 CPUs Crash reason: SIGSEGV Crash address: 0x4 Thread 4 (crashed) 0 libxul.so!js::gc::MarkValueRootRange(JSTracer*, unsigned int, JS::Value*, char const*) [Marking.cpp : 443 + 0x8] r4 = 0x50331108 r5 = 0x0000011e r6 = 0x00000000 r7 = 0x00000000 r8 = 0x00000000 r9 = 0xffffff87 r10 = 0x5470f4a4 fp = 0x4e00cc04 sp = 0x4e00cbf8 lr = 0x541aa55c pc = 0x54357748 Found by: given as instruction pointer in context 1 libxul.so!JS::AutoGCRooter::traceAll(JSTracer*) [jsgc.cpp : 2385 + 0x12] r4 = 0x4e00cf4c r5 = 0x50331108 r6 = 0x50331000 r7 = 0x58db2b18 r8 = 0x50331108 r9 = 0x5470f194 r10 = 0x58db2b18 fp = 0x5470f1a4 sp = 0x4e00cc30 pc = 0x541aa55c Found by: call frame info 2 libxul.so!IncrementalCollectSlice [jsgc.cpp : 2435 + 0x6] r4 = 0x50331000 r5 = 0x58db2b18 r6 = 0x50331000 r7 = 0x58db2b18 r8 = 0x50331108 r9 = 0x58db2b18 r10 = 0x58db2b18 fp = 0x503311d8 sp = 0x4e00cc68 pc = 0x541b1108 Found by: call frame info 3 libxul.so!GCCycle [jsgc.cpp : 4452 + 0x1e] r4 = 0x50331000 r5 = 0x5470f514 r6 = 0x00000000 r7 = 0x503319b8 r8 = 0x00000000 r9 = 0x00000000 r10 = 0x503311d8 fp = 0x50331000 sp = 0x4e00ce28 pc = 0x541b6168 Found by: call frame info 4 libxul.so!js::GC(JSRuntime*, js::JSGCInvocationKind, js::gcreason::Reason) [jsgc.cpp : 4566 + 0x1a] r4 = 0x50331000 r5 = 0x503311d8 r6 = 0x00000004 r7 = 0x00000000 r8 = 0x00000000 r9 = 0x5489d2f0 r10 = 0x00000002 fp = 0x50331000 sp = 0x4e00ce58 pc = 0x541b6734 Found by: call frame info 5 libxul.so!js::gc::ArenaLists::refillFreeList(JSContext*, js::gc::AllocKind) [jsgc.cpp : 1733 + 0x2] r4 = 0x50395c00 r5 = 0x00000003 r6 = 0x5489d2f0 r7 = 0x50331000 r8 = 0x00000020 r9 = 0x5489d2f0 r10 = 0x548e7818 fp = 0x50331000 sp = 0x4e00ce80 pc = 0x541b6c1c Found by: call frame info 6 libxul.so!JSObject::createDenseArray(JSContext*, js::gc::AllocKind, JS::Handle<js::Shape*>, JS::Handle<js::types::TypeObject*>, unsigned int) [jsgcinlines.h : 457 + 0x12] r4 = 0x54cd0700 r5 = 0x00001000 r6 = 0x50395c24 r7 = 0x00000000 r8 = 0x00000020 r9 = 0x5489d2f0 r10 = 0x548e7818 fp = 0x50331000 sp = 0x4e00cec8 pc = 0x541532cc Found by: call frame info 7 libxul.so!js::NewDenseCopiedArray(JSContext*, unsigned int, JS::Value const*, JSObject*) [jsarray.cpp : 3664 + 0x6] r4 = 0x0000011e r5 = 0x00000000 r6 = 0x0000000e r7 = 0x54cd0700 r8 = 0x5489d2f0 r9 = 0x5489d2f0 r10 = 0x548e7818 fp = 0x50331000 sp = 0x4e00cee8 pc = 0x54157d48 Found by: call frame info 8 libxul.so!JS_NewArrayObject(JSContext*, int, JS::Value*) [jsapi.cpp : 4710 + 0x2] r4 = 0x00000000 r5 = 0x0000011e r6 = 0x54cd0700 r7 = 0x4e00d340 r8 = 0x4e00d310 r9 = 0x5489d2f0 r10 = 0x0000011e fp = 0x4e00d070 sp = 0x4e00cf48 pc = 0x54145054 Found by: call frame info 9 libxul.so!XPCConvert::NativeArray2JS(XPCLazyCallContext&, JS::Value*, void const**, nsXPTType const&, nsID const*, unsigned int, tag_nsresult*) [XPCConvert.cpp : 1415 + 0xe] r4 = 0x4e00d348 r5 = 0x4e00d3a0 r6 = 0x54cd0700 r7 = 0x4e00d340 r8 = 0x4e00d310 r9 = 0x5489d2f0 r10 = 0x0000011e fp = 0x4e00d070 sp = 0x4e00cf70 pc = 0x538c7134 Found by: call frame info 10 libxul.so!XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) [XPCWrappedNative.cpp : 2638 + 0x2] r4 = 0x00000000 r5 = 0x00000001 r6 = 0x4e00d178 r7 = 0x4e00d338 r8 = 0x4e00d310 r9 = 0x00000008 r10 = 0x5489d2f0 fp = 0x0000011e sp = 0x4e00d000 pc = 0x538e13a8 Found by: call frame info 11 libxul.so!XPC_WN_CallMethod(JSContext*, unsigned int, JS::Value*) [XPCWrappedNativeJSOps.cpp : 1488 + 0xa] r4 = 0x54cd0700 r5 = 0x4e00d3a0 r6 = 0x505002f0 r7 = 0x5b61e9a0 r8 = 0x00000001 r9 = 0x4e00d784 r10 = 0x00000001 fp = 0x4e00d75c sp = 0x4e00d380 pc = 0x538e8dc8 Found by: call frame info 12 libxul.so!js::InvokeKernel [jscntxtinlines.h : 364 + 0xa] r4 = 0x4e00d438 r5 = 0x00000000 r6 = 0x54cd0700 r7 = 0x5b61e9a0 r8 = 0x00000000 r9 = 0x4e00d784 r10 = 0x4e00d764 fp = 0x4e00d75c sp = 0x4e00d428 pc = 0x541de428 Found by: call frame info 13 libxul.so!js::Interpret(JSContext*, js::StackFrame*, js::InterpMode) [jsinterp.cpp : 2324 + 0x12] r4 = 0x54cd0700 r5 = 0x50500300 r6 = 0x548e8bc4 r7 = 0x00001cdc r8 = 0x4e00d8d0 r9 = 0x4e00d784 r10 = 0x4e00d764 fp = 0x4e00d75c sp = 0x4e00d4c0 pc = 0x541da07c Found by: call frame info 14 libxul.so!js::RunScript(JSContext*, JS::Handle<JSScript*>, js::StackFrame*) [jsinterp.cpp : 324 + 0xe] r4 = 0x54cd0700 r5 = 0x50500040 r6 = 0x4e00d99c r7 = 0x00000000 r8 = 0x4e00da08 r9 = 0x50500018 r10 = 0x54cd0764 fp = 0xffffff86 sp = 0x4e00d990 pc = 0x541dd9d8 Found by: call frame info 15 libxul.so!js::Invoke [jsinterp.cpp : 379 + 0x2] r4 = 0x50c751a0 r5 = 0x4e00d9d4 r6 = 0x54cd0700 r7 = 0x00000001 r8 = 0x4e00da08 r9 = 0x50500018 r10 = 0x54cd0764 fp = 0xffffff86 sp = 0x4e00d9c0 pc = 0x541df61c Found by: call frame info 16 libxul.so!js::BaseProxyHandler::call(JSContext*, JSObject*, unsigned int, JS::Value*) [jsproxy.cpp : 266 + 0x12] r4 = 0x50500010 r5 = 0x4e00da88 r6 = 0x5624e010 r7 = 0x00000001 r8 = 0x54cd0700 r9 = 0x550c2c00 r10 = 0x00000000 fp = 0xffffff86 sp = 0x4e00da70 pc = 0x542253d4 Found by: call frame info 17 libxul.so!js::Wrapper::call(JSContext*, JSObject*, unsigned int, JS::Value*) [jswrapper.cpp : 294 + 0x2a] r4 = 0x5495ada0 r5 = 0x00000001 r6 = 0x5624e010 r7 = 0x54cd0700 r8 = 0x50500010 r9 = 0x550c2c00 r10 = 0x00000001 fp = 0x5495ada0 sp = 0x4e00dab0 pc = 0x5429d390 Found by: call frame info 18 libxul.so!js::CrossCompartmentWrapper::call(JSContext*, JSObject*, unsigned int, JS::Value*) [jswrapper.cpp : 626 + 0x16] r4 = 0x54cd0700 r5 = 0x50500010 r6 = 0x5624e010 r7 = 0x50500028 r8 = 0x00000001 r9 = 0x550c2c00 r10 = 0x00000001 fp = 0x5495ada0 sp = 0x4e00dad8 pc = 0x5429fc2c Found by: call frame info 19 libxul.so!proxy_Call [jsproxy.cpp : 2461 + 0x16] r4 = 0x54cd0700 r5 = 0x50500020 r6 = 0x54cd0700 r7 = 0x00000001 r8 = 0x4e00db68 r9 = 0x4e00dbe0 r10 = 0x54cd0764 fp = 0x4e00e028 sp = 0x4e00db08 pc = 0x542286b8 Found by: call frame info 20 libxul.so!js::Invoke [jscntxtinlines.h : 364 + 0xa] r4 = 0x5624e010 r5 = 0x50500020 r6 = 0x54cd0700 r7 = 0x00000001 r8 = 0x4e00db68 r9 = 0x4e00dbe0 r10 = 0x54cd0764 fp = 0x4e00e028 sp = 0x4e00db20 pc = 0x541df698 Found by: call frame info 21 libxul.so!JS_CallFunctionValue(JSContext*, JSObject*, JS::Value, unsigned int, JS::Value*, JS::Value*) [jsapi.cpp : 5781 + 0x22] r4 = 0x54cd0700 r5 = 0x550f65e0 r6 = 0x502f5d40 r7 = 0x4e00de30 r8 = 0x00000001 r9 = 0x80004005 r10 = 0x00102048 fp = 0x4e00e028 sp = 0x4e00dbd0 pc = 0x5414abe4 Found by: call frame info 22 libxul.so!nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS*, unsigned short, XPTMethodDescriptor const*, nsXPTCMiniVariant*) [XPCWrappedJSClass.cpp : 1420 + 0x22] r4 = 0x54cd0700 r5 = 0x550f65e0 r6 = 0x502f5d40 r7 = 0x4e00de30 r8 = 0x00000001 r9 = 0x80004005 r10 = 0x00102048 fp = 0x4e00e028 sp = 0x4e00dbf8 pc = 0x538dcb5c Found by: call frame info 23 libxul.so!nsXPCWrappedJS::CallMethod(unsigned short, XPTMethodDescriptor const*, nsXPTCMiniVariant*) [XPCWrappedJS.cpp : 580 + 0x1e] r4 = 0x56172340 r5 = 0x502f5d40 r6 = 0x4e00e028 r7 = 0x00000003 r8 = 0x00000008 r9 = 0x00000003 r10 = 0x5617eb40 fp = 0x4e00e028 sp = 0x4e00dff8 pc = 0x538d84ac Found by: call frame info 24 libxul.so!PrepareAndDispatch [xptcstubs_arm.cpp : 105 + 0x1a] r4 = 0x4e00e028 r5 = 0x00000008 r6 = 0x4e00e0e4 r7 = 0x4e00e0ac r8 = 0x00000008 r9 = 0x00000003 r10 = 0x5617eb40 fp = 0x4e00e028 sp = 0x4e00e028 pc = 0x53dbcb3c Found by: call frame info 25 libxul.so + 0x1019226 r4 = 0x5617eb40 r5 = 0x59ec7a60 r6 = 0x00000000 r7 = 0x4e00e220 r8 = 0x56d54ec0 r9 = 0x00000004 r10 = 0x4e00e230 fp = 0x00000001 sp = 0x4e00e0e0 pc = 0x53dbc228 Found by: call frame info 26 libxul.so!nsEventListenerManager::HandleEventSubType(nsListenerStruct*, nsIDOMEventListener*, nsIDOMEvent*, nsIDOMEventTarget*, unsigned int, nsCxPusher*) [nsEventListenerManager.cpp : 872 + 0xa] r4 = 0x5617eb40 r5 = 0x59ec7a60 r6 = 0x00000000 r7 = 0x4e00e220 r8 = 0x56d54ec0 r9 = 0x00000004 r10 = 0x4e00e230 fp = 0x00000001 sp = 0x4e00e0f0 pc = 0x53466198 Found by: call frame info 27 libxul.so!nsEventListenerManager::HandleEventInternal(nsPresContext*, nsEvent*, nsIDOMEvent**, nsIDOMEventTarget*, unsigned int, nsEventStatus*, nsCxPusher*) [nsEventListenerManager.cpp : 945 + 0x16] r4 = 0x56ebd240 r5 = 0x56785d28 r6 = 0x5614c6a0 r7 = 0x4e00e220 r8 = 0x56d54ec0 r9 = 0x00000004 r10 = 0x4e00e230 fp = 0x00000001 sp = 0x4e00e100 pc = 0x534663a4 Found by: call frame info 28 libxul.so!nsEventTargetChainItem::HandleEvent(nsEventChainPostVisitor&, unsigned int, bool, nsCxPusher*) [nsEventListenerManager.h : 153 + 0x1e] r4 = 0x00000a8d r5 = 0x4e00e224 r6 = 0x00000004 r7 = 0x00000000 r8 = 0x00000006 r9 = 0x00001628 r10 = 0x00000000 fp = 0x00000000 sp = 0x4e00e168 pc = 0x5348242c Found by: call frame info 29 libxul.so!nsEventTargetChainItem::HandleEventTargetChain(nsEventChainPostVisitor&, unsigned int, nsDispatchingCallback*, bool, nsCxPusher*) [nsEventDispatcher.cpp : 286 + 0x12] r4 = 0x4e00e218 r5 = 0x5763ec10 r6 = 0x5489d2f0 r7 = 0x4e00e230 r8 = 0x00000006 r9 = 0x00001628 r10 = 0x00000000 fp = 0x00000000 sp = 0x4e00e190 pc = 0x53482518 Found by: call frame info 30 libxul.so!nsEventDispatcher::Dispatch(nsISupports*, nsPresContext*, nsEvent*, nsIDOMEvent*, nsEventStatus*, nsDispatchingCallback*, nsCOMArray<nsIDOMEventTarget>*) [nsEventDispatcher.cpp : 634 + 0x16] r4 = 0x56ebd240 r5 = 0x00000000 r6 = 0x00000000 r7 = 0x5763ec70 r8 = 0x4e00e230 r9 = 0x549036c0 r10 = 0x5673c140 fp = 0x00000000 sp = 0x4e00e1d8 pc = 0x53482ef0 Found by: call frame info 31 libxul.so!nsEventDispatcher::DispatchDOMEvent(nsISupports*, nsEvent*, nsIDOMEvent*, nsPresContext*, nsEventStatus*) [nsEventDispatcher.cpp : 694 + 0x16] r4 = 0x59ec7a60 r5 = 0x00000000 r6 = 0x56ebd240 r7 = 0x00000000 r8 = 0x00000000 r9 = 0x4e00e2fc r10 = 0x4e5e6ae8 fp = 0x4e5e6ae8 sp = 0x4e00e270 pc = 0x53483218 Found by: call frame info 32 libxul.so!nsDocument::DispatchPageTransition(nsIDOMEventTarget*, nsAString_internal const&, bool) [nsDocument.cpp : 7009 + 0x16] r4 = 0x00000001 r5 = 0x5964d400 r6 = 0x00000000 r7 = 0x4e00e2b4 r8 = 0x00000000 r9 = 0x4e00e2fc r10 = 0x53522970 fp = 0x4e5e6ae8 sp = 0x4e00e2a8 pc = 0x533be80c Found by: call frame info 33 libxul.so!nsDocument::OnPageShow(bool, nsIDOMEventTarget*) [nsDocument.cpp : 7068 + 0x2] r4 = 0x5964d400 r5 = 0x4e00e2fc r6 = 0x4e00e2f7 r7 = 0x00000001 r8 = 0x00000001 r9 = 0x56fdb434 r10 = 0x00000000 fp = 0x58536aac sp = 0x4e00e2f0 pc = 0x533bec38 Found by: call frame info 34 libxul.so!DocumentViewerImpl::LoadComplete(tag_nsresult) [nsDocumentViewer.cpp : 1052 + 0x12] r4 = 0x4ff61350 r5 = 0x57b91e80 r6 = 0x4e5e6a90 r7 = 0x56fdb580 r8 = 0x00000001 r9 = 0x56fdb434 r10 = 0x00000000 fp = 0x58536aac sp = 0x4e00e340 pc = 0x531f0ab0 Found by: call frame info 35 libxul.so!nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, tag_nsresult) [nsDocShell.cpp : 6510 + 0x12] r4 = 0x56fdb400 r5 = 0x00000000 r6 = 0x58536aac r7 = 0x56fdb580 r8 = 0x00000001 r9 = 0x56fdb434 r10 = 0x00000000 fp = 0x58536aac sp = 0x4e00e3a0 pc = 0x53963ccc Found by: call frame info 36 libxul.so!nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, tag_nsresult) [nsDocShell.cpp : 6338 + 0x1a] r4 = 0x56fdb400 r5 = 0x56fdb414 r6 = 0x58536aac r7 = 0x4e00e5f4 r8 = 0x00000000 r9 = 0x56fdb434 r10 = 0xfffdffef fp = 0x58536aac sp = 0x4e00e590 pc = 0x5395f97c Found by: call frame info 37 libxul.so!nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, tag_nsresult) [nsDocLoader.cpp : 1351 + 0x16] r4 = 0x00000000 r5 = 0x54e77320 r6 = 0x4e00e6cc r7 = 0x5489d2f0 r8 = 0x56fdb414 r9 = 0x56fdb434 r10 = 0x56fdb400 fp = 0x58536aac sp = 0x4e00e640 pc = 0x5396cc5c Found by: call frame info (and on and on, 91 frames deep, well back into Java without useful detail)
Severity: normal → critical
Crash Signature: [@ js::gc::MarkValueRootRange]
https://tbpl.mozilla.org/php/getParsedLog.php?id=16834403&tree=Mozilla-Inbound
Summary: Intermittent crash [@ js::gc::MarkValueRootRange] in test_media_queries.html → Intermittent crash [@ js::gc::MarkValueRootRange] in test_media_queries.html, test_parse_rule.html
https://tbpl.mozilla.org/php/getParsedLog.php?id=16809068&tree=Services-Central
Summary: Intermittent crash [@ js::gc::MarkValueRootRange] in test_media_queries.html, test_parse_rule.html → Intermittent crash [@ js::gc::MarkValueRootRange] in test_media_queries.html, test_parse_rule.html, test_bug57600.html
https://tbpl.mozilla.org/php/getParsedLog.php?id=16879200&tree=Firefox
Summary: Intermittent crash [@ js::gc::MarkValueRootRange] in test_media_queries.html, test_parse_rule.html, test_bug57600.html → Intermittent crash [@ js::gc::MarkValueRootRange] in test_media_queries.html, test_parse_rule.html, test_bug57600.html, test_bug582412-1.html
https://tbpl.mozilla.org/php/getParsedLog.php?id=16896093&tree=Mozilla-Inbound
Summary: Intermittent crash [@ js::gc::MarkValueRootRange] in test_media_queries.html, test_parse_rule.html, test_bug57600.html, test_bug582412-1.html → Intermittent crash [@ js::gc::MarkValueRootRange] in test_media_queries.html, test_parse_rule.html, test_bug57600.html, test_bug582412-1.html, test_HTMLDocument05.html
https://tbpl.mozilla.org/php/getParsedLog.php?id=16942630&tree=Mozilla-Inbound
Summary: Intermittent crash [@ js::gc::MarkValueRootRange] in test_media_queries.html, test_parse_rule.html, test_bug57600.html, test_bug582412-1.html, test_HTMLDocument05.html → Intermittent crash [@ js::gc::MarkValueRootRange] in test_media_queries.html, test_parse_rule.html, test_bug57600.html, test_bug582412-1.html, test_HTMLDocument05.html, test_input_number_value.html
https://tbpl.mozilla.org/php/getParsedLog.php?id=16965238&tree=Mozilla-Inbound
Summary: Intermittent crash [@ js::gc::MarkValueRootRange] in test_media_queries.html, test_parse_rule.html, test_bug57600.html, test_bug582412-1.html, test_HTMLDocument05.html, test_input_number_value.html → Intermittent crash [@ js::gc::MarkValueRootRange] in test_media_queries.html, test_parse_rule.html, test_bug57600.html, test_bug582412-1.html, test_HTMLDocument05.html, test_input_number_value.html, test_sessionStorageReplace.html
Blocks: 811389
Bill please may you take a look at this? Between this bug and bug 811389, this crash is now occurring fairly frequently.
Flags: needinfo?(wmccloskey)
Blocks: 812585
Whiteboard: [orange]
Blocks: 820779
Blocks: 827062
I'd love to get this fixed, but it's hard to tell what could be going wrong. My first suspicion is some sort of compiler bug. The fact that it's ARM-only makes it pretty unlikely that I'd be able to help much.
Flags: needinfo?(wmccloskey)
Apparently fixed by some unknown thing in early January, there's been nothing but misstars and downbranches since then.
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.