817323 - crash in js::SweepAtoms

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Scoobidiver (away)]

It's #30 top browser crasher in 18.0b1, #16 in 18.0b2, and #40 in 19.0a2.
It first showed up in 18.0a1/20120919. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=0d3b17a88d5f&tochange=80499f04e875
It's likely a regression from bug 789635.

Signature 	js::SweepAtoms(JSRuntime*) More Reports Search
UUID	af00e78e-6e80-4bb3-a7b8-1fdf82121201
Date Processed	2012-12-01 16:44:31
Uptime	7
Last Crash	13 seconds before submission
Install Age	1.0 days since version was first installed.
Install Time	2012-11-30 16:41:26
Product	Firefox
Version	18.0
Build ID	20121128060531
Release Channel	beta
OS	Windows NT
OS Version	5.1.2600 Service Pack 2
Build Architecture	x86
Build Architecture Info	GenuineIntel family 15 model 3 stepping 3
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x0
App Notes 	
AdapterVendorID: 0x8086, AdapterDeviceID: 0x29c2, AdapterSubsysID: 29c28086, AdapterDriverVersion: 6.14.10.4820
D3D10 Layers? D3D10 Layers- D3D9 Layers? D3D9 Layers- 
EMCheckCompatibility	True
Adapter Vendor ID	0x8086
Adapter Device ID	0x29c2
Total Virtual Memory	2147352576
Available Virtual Memory	1980289024
System Memory Use Percentage	40
Available Page File	2275782656
Available Physical Memory	637480960

Frame 	Module 	Signature 	Source
0 	mozjs.dll 	js::SweepAtoms 	js/src/jsatom.cpp:204
1 	mozjs.dll 	SweepAtomsCompartment 	js/src/jsgc.cpp:3960
2 	mozjs.dll 	IncrementalCollectSlice 	js/src/jsgc.cpp:4392
3 	mozjs.dll 	GCCycle 	js/src/jsgc.cpp:4540
4 	mozjs.dll 	Collect 	js/src/jsgc.cpp:4655
5 	mozjs.dll 	js::GC 	js/src/jsgc.cpp:4680
6 	mozjs.dll 	js::GCForReason 	js/src/jsfriendapi.cpp:160
7 	xul.dll 	nsXPConnect::Collect 	js/xpconnect/src/nsXPConnect.cpp:375
8 	xul.dll 	nsCycleCollector::GCIfNeeded 	xpcom/base/nsCycleCollector.cpp:2656
9 	xul.dll 	nsCycleCollectorRunner::Collect 	xpcom/base/nsCycleCollector.cpp:3119
10 	xul.dll 	nsCycleCollector_collect 	xpcom/base/nsCycleCollector.cpp:3236
11 	xul.dll 	nsJSContext::CycleCollectNow 	dom/base/nsJSEnvironment.cpp:3103
12 	xul.dll 	CCTimerFired 	dom/base/nsJSEnvironment.cpp:3296
13 	xul.dll 	nsTimerImpl::Fire 	xpcom/threads/nsTimerImpl.cpp:473
14 	xul.dll 	nsTimerEvent::Run 	xpcom/threads/nsTimerImpl.cpp:556
15 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:620
16 	xul.dll 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:117
17 	xul.dll 	MessageLoop::RunHandler 	ipc/chromium/src/base/message_loop.cc:208
18 	xul.dll 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:182
19 	xul.dll 	nsBaseAppShell::Run 	widget/xpwidgets/nsBaseAppShell.cpp:163
20 	xul.dll 	nsAppShell::Run 	widget/windows/nsAppShell.cpp:232
21 	xul.dll 	nsAppStartup::Run 	toolkit/components/startup/nsAppStartup.cpp:290
22 	xul.dll 	XREMain::XRE_mainRun 	toolkit/xre/nsAppRunner.cpp:3794
23 	xul.dll 	XREMain::XRE_main 	toolkit/xre/nsAppRunner.cpp:3860
24 	xul.dll 	XRE_main 	toolkit/xre/nsAppRunner.cpp:3935
25 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:105

More reports at:
https://crash-stats.mozilla.com/report/list?signature=js%3A%3ASweepAtoms%28JSRuntime*%29
https://crash-stats.mozilla.com/report/list?signature=js%3A%3ASweepAtoms

Comment 1

[Robert Kaiser]

Marking as topcrash because it's #18 on 18.0b4 desktop.

Comment 2

[Scoobidiver (away)]

It's #42 top browser crasher in 18.0.2, #24 in 19.0b5, #122 in 20.0a2, and #186 in 21.0a1.

Comment 3

[Wayne Mery (:wsmwk)]

waldo, any thoughts for this regression?

#48 crash for firefox 25.0.1. Some users who frequently crash are:
bp-f574618f-eb68-4d5d-979e-b4f982131203
bp-8f181235-376f-4657-8dcc-4675d2131206
bp-fc6ee9e0-9d74-4ab7-8be8-fa32e2131204
bp-9da5b748-34a0-4dde-bbb6-6299e2131206 who writes "started since I upgraded my cpu from an i7-950 to a i7-980X"

#166 for Thunderbird 24.1.1.  
~75% of TB crashes are in first 20 seconds. ~50% in first 15 seconds.

Comment 4

[Jeff Walden [:Waldo]]

Not really.  :-\  Nothing sticks out in the original patch, or in scanning of the current code.  Most of that change was just shifting code around -- really surprising it would have made any changes at all.

Comment 5

[Wayne Mery (:wsmwk)]

All crashes, firefox and thunderbird, startup and non-startup, and regardless of stack are at JSAtom *atom = entry.asPtr(); 

edward@3717    192 void
jwalden@113629 193 js::SweepAtoms(JSRuntime *rt)
edward@3717    194 {
jwalden@113629 195 for (AtomSet::Enum e(rt->atoms); !e.empty(); e.popFront()) {
cdleary@70155  196 AtomStateEntry entry = e.front();
wmccloskey@106717 197 JSAtom *atom = entry.asPtr(); 

FWIW, thunderbird startup crashes cluster in the 10,11,12 second range.
Firefox startup crashes have far more varied range. 

That said, some crashes are long after startup, 216 hours for example bp-47b36b3d-33ba-407b-b95f-6dc422131127. And most seem to be one-off crashes because very few comments indicate repeated crashing - bp-8f181235-376f-4657-8dcc-4675d2131206 is one repeater

Comment 6

[Wayne Mery (:wsmwk)]

No crashes newer than version 29