Closed Bug 812066 Opened 12 years ago Closed 11 years ago

Intermittent crash [@ js::Shape::removeChild(js::Shape*)] in test_bug619644.html

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86_64
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: philor, Unassigned)

References

Details

(Keywords: crash, intermittent-failure) 

https://tbpl.mozilla.org/php/getParsedLog.php?id=17052322&tree=Firefox
Rev4 MacOSX Snow Leopard 10.6 mozilla-central debug test mochitest-5 on 2012-11-14 19:33:36 PST for push 7845cfa93e3f
slave: talos-r4-snow-080

160216 INFO TEST-START | /tests/toolkit/components/prompts/test/test_bug619644.html
++DOMWINDOW == 53 (0x14fdeda20) [serial = 3213] [outer = 0x12b0b0c30]
WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80004003: file ../../../../intl/uconv/src/nsCharsetConverterManager.cpp, line 301
WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80004003: file ../../../../intl/uconv/src/nsCharsetConverterManager.cpp, line 301
WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80004003: file ../../../../intl/uconv/src/nsCharsetConverterManager.cpp, line 301
WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80004003: file ../../../../intl/uconv/src/nsCharsetConverterManager.cpp, line 301
WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80004003: file ../../../../intl/uconv/src/nsCharsetConverterManager.cpp, line 301
WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80004003: file ../../../../intl/uconv/src/nsCharsetConverterManager.cpp, line 301
WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80004003: file ../../../../intl/uconv/src/nsCharsetConverterManager.cpp, line 301
WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80004003: file ../../../../intl/uconv/src/nsCharsetConverterManager.cpp, line 301
WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80004003: file ../../../../intl/uconv/src/nsCharsetConverterManager.cpp, line 301
WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80004003: file ../../../../intl/uconv/src/nsCharsetConverterManager.cpp, line 301
WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80004003: file ../../../../intl/uconv/src/nsCharsetConverterManager.cpp, line 301
WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80004003: file ../../../../intl/uconv/src/nsCharsetConverterManager.cpp, line 301
WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80004003: file ../../../../intl/uconv/src/nsCharsetConverterManager.cpp, line 301
WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80004003: file ../../../../intl/uconv/src/nsCharsetConverterManager.cpp, line 301
WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80004003: file ../../../../intl/uconv/src/nsCharsetConverterManager.cpp, line 301
TEST-UNEXPECTED-FAIL | /tests/toolkit/components/prompts/test/test_bug619644.html | Exited with code 1 during test run
INFO | automation.py | Application ran for: 0:10:42.019199
INFO | automation.py | Reading PID log: /var/folders/Hs/HsDn6a9SG8idoIya6p9mtE+++TI/-Tmp-/tmpBrhtkWpidlog
Downloading symbols from: http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-central-macosx64-debug/1352947434/firefox-19.0a1.en-US.mac64.crashreporter-symbols.zip
PROCESS-CRASH | /tests/toolkit/components/prompts/test/test_bug619644.html | application crashed (minidump found)
Crash dump filename: /var/folders/Hs/HsDn6a9SG8idoIya6p9mtE+++TI/-Tmp-/tmpOlXE_d/minidumps/C0E238DA-BABB-4BCB-9B20-7F228CBF7D11.dmp
Operating system: Mac OS X
                  10.6.8 10K549
CPU: amd64
     family 6 model 23 stepping 10
     2 CPUs

Crash reason:  EXC_BAD_ACCESS / 0x0000000d
Crash address: 0x0

Thread 0 (crashed)
 0  XUL!js::Shape::removeChild(js::Shape*) [HashTable.h : 1235 + 0x0]
    rbx = 0x004c006500730074   r12 = 0x0000000151e25678
    r13 = 0x00007fff5fbf7058   r14 = 0x0000000153b35380
    r15 = 0x0000000151e25808   rip = 0x00000001038dfff3
    rsp = 0x00007fff5fbf6f80   rbp = 0x00007fff5fbf6fd0
    Found by: given as instruction pointer in context
 1  XUL!js::Shape::finalize(js::FreeOp*) [jspropertytree.cpp : 210 + 0x7]
    rbx = 0x0000000151e25808   r12 = 0x0000000151e25678
    r13 = 0x00007fff5fbf7058   r14 = 0x00007fff5fbfb220
    r15 = 0x0000000151e25808   rip = 0x00000001038e0687
    rsp = 0x00007fff5fbf6fe0   rbp = 0x00007fff5fbf6ff0
    Found by: call frame info
 2  XUL!bool js::gc::Arena::finalize<js::Shape>(js::FreeOp*, js::gc::AllocKind, unsigned long) [jsgc.cpp : 358 + 0xb]
    rbx = 0x0000000000000028   r12 = 0x0000000151e25678
    r13 = 0x00007fff5fbf7058   r14 = 0x0000000151e25628
    r15 = 0x0000000151e25808   rip = 0x0000000103841c5c
    rsp = 0x00007fff5fbf7000   rbp = 0x00007fff5fbf7090
    Found by: call frame info
 3  XUL!bool js::gc::FinalizeTypedArenas<js::Shape>(js::FreeOp*, js::gc::ArenaHeader**, js::gc::ArenaList&, js::gc::AllocKind, js::SliceBudget&) [jsgc.cpp : 422 + 0x14]
    rbx = 0x000000000000000d   r12 = 0x000000000000000d
    r13 = 0x0000000151e25000   r14 = 0x00007fff5fbf7158
    r15 = 0x00000001280b0bc8   rip = 0x000000010383d970
    rsp = 0x00007fff5fbf70a0   rbp = 0x00007fff5fbf70e0
    Found by: call frame info
 4  XUL!js::gc::FinalizeArenas [jsgc.cpp : 463 + 0x4]
    rbx = 0x00000001038283d9   r12 = 0x00000001061e3000
    r13 = 0x00007fff5fbf7158   r14 = 0x00007fff5fbfb220
    r15 = 0x00000001280b0800   rip = 0x00000001038283e3
    rsp = 0x00007fff5fbf70f0   rbp = 0x00007fff5fbf7100
    Found by: call frame info
 5  XUL!IncrementalCollectSlice [jsgc.cpp : 3938 + 0xa]
    rbx = 0x0000000104077da0   r12 = 0x00000001061e3000
    r13 = 0x00007fff5fbf7158   r14 = 0x00007fff5fbfb220
    r15 = 0x00000001280b0800   rip = 0x0000000103830441
    rsp = 0x00007fff5fbf7110   rbp = 0x00007fff5fbfb350
    Found by: call frame info
 6  XUL!GCCycle [jsgc.cpp : 4569 + 0x10]
    rbx = 0x00000001061e3001   r12 = 0x0000000000002710
    r13 = 0x0000000000000000   r14 = 0x00000001061e33f8
...
Similar to bug 802344, which is an assertion failure finalizing shapes
Whiteboard: [orange]
Resolving WFM keyword:intermittent-failure bugs last modified >3 months ago, whose whiteboard contains none of:
{random,disabled,marked,fuzzy,todo,fails,failing,annotated,time-bomb,leave open}

There will inevitably be some false positives; for that (and the bugspam) I apologise. Filter on orangewfm.
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.