817408 - Intermittent shutdown crash [@ js::gc::MarkXML]

Status: RESOLVED INVALID

(Core :: JavaScript Engine, defect)

Description

[Ryan VanderMeulen [:RyanVM]]

https://tbpl.mozilla.org/php/getParsedLog.php?id=17532624&tree=Firefox

Android Armv6 Tegra 250 mozilla-central opt test jsreftest-3 on 2012-12-02 02:01:10 PST for push 0352a32fde64
slave: tegra-120

REFTEST FINISHED: Slowest test took 18996ms (http://10.250.48.214:30120/jsreftest/tests/jsreftest.html?test=js1_8_5/extensions/recursion.js)
REFTEST INFO | Result summary:
REFTEST INFO | Successful: 2927 (2927 pass, 0 load only)
REFTEST INFO | Unexpected: 0 (0 unexpected fail, 0 unexpected pass, 0 unexpected asserts, 0 unexpected fixed asserts, 0 failed load, 0 exception)
REFTEST INFO | Known problems: 564 (20 known fail, 0 known asserts, 387 random, 149 skipped, 8 slow)
REFTEST INFO | Total canvas count = 0
REFTEST TEST-START | Shutdown

INFO | automation.py | Application ran for: 0:08:05.688953
INFO | automation.py | Reading PID log: /tmp/tmpbML8J_pidlog
getting files in '/mnt/sdcard/tests/reftest/profile/minidumps/'
Downloading symbols from: http://ftp-scl3.mozilla.com/pub/mozilla.org/mobile/tinderbox-builds/mozilla-central-android-armv6/1354439024/fennec-20.0a1.en-US.android-arm-armv6.crashreporter-symbols.zip
PROCESS-CRASH | Shutdown | application crashed [@ js::gc::MarkXML(JSTracer*, js::EncapsulatedPtr<JSXML, unsigned int>*, char const*)]
Crash dump filename: /tmp/tmpWub2XM/366d4a39-2336-f0bf-2a1bee6c-123040c2.dmp
Operating system: Android
                  0.0.0 Linux 2.6.32.9-00002-gd8084dc-dirty #1 SMP PREEMPT Wed Feb 2 11:32:06 PST 2011 armv7l nvidia/harmony/harmony/harmony:2.2/FRF91/20110202.102810:eng/test-keys
CPU: arm
     0 CPUs

Crash reason:  SIGSEGV
Crash address: 0x384adfa3

Thread 5 (crashed)
 0  libxul.so!js::gc::MarkXML(JSTracer*, js::EncapsulatedPtr<JSXML, unsigned int>*, char const*) [jscompartment.h : 254 + 0x0]
     r4 = 0x50625118    r5 = 0x55a6c000    r6 = 0x4e208728    r7 = 0x558d65c8
     r8 = 0x558da4b0    r9 = 0x506251e0   r10 = 0x558da030    fp = 0x558d9010
     sp = 0x4e2085f8    lr = 0x53eac35c    pc = 0x53f55c8c
    Found by: given as instruction pointer in context
 1  libxul.so!js_TraceXML(JSTracer*, JSXML*) [jsxml.cpp : 7258 + 0x12]
     r4 = 0x558d9010    r5 = 0x50625118    r6 = 0x4e208728    r7 = 0x558d65c8
     r8 = 0x558da4b0    r9 = 0x506251e0   r10 = 0x558da030    fp = 0x558d9010
     sp = 0x4e208608    pc = 0x53eac35c
    Found by: call frame info
 2  libxul.so!js::GCMarker::drainMarkStack(js::SliceBudget&) [Marking.cpp : 1057 + 0xa]
     r4 = 0x00000001    r5 = 0x50625118    r6 = 0x4e208728    r7 = 0x558d65c8
     r8 = 0x558da4b0    r9 = 0x506251e0   r10 = 0x558da030    fp = 0x558d9010
     sp = 0x4e208620    pc = 0x53f5d168
    Found by: call frame info
 3  libxul.so!IncrementalCollectSlice [jsgc.cpp : 3770 + 0xa]
     r4 = 0x50625000    r5 = 0x00000002    r6 = 0x5717095c    r7 = 0x5717095c
     r8 = 0x00009c40    r9 = 0x506251e0   r10 = 0x00000000    fp = 0x00000002
     sp = 0x4e208680    pc = 0x53daf918
    Found by: call frame info
 4  libxul.so!GCCycle [jsgc.cpp : 4006 + 0x1e]
     r4 = 0x50625000    r5 = 0x5430e02c    r6 = 0x00000000    r7 = 0x5430e014
     r8 = 0x00009c40    r9 = 0x00000000   r10 = 0x506251e0    fp = 0x50625000
     sp = 0x4e208788    pc = 0x53db17b8
    Found by: call frame info
 5  libxul.so!js::GCSlice [jsgc.cpp : 4124 + 0x16]
     r4 = 0x50625000    r5 = 0x506251e0    r6 = 0x00000019    r7 = 0x00000000
     r8 = 0x00000000    r9 = 0x00000000   r10 = 0x00000002    fp = 0x0011e998
     sp = 0x4e2087b8    pc = 0x53db3540
    Found by: call frame info
 6  libxul.so!js::IncrementalGC(JSRuntime*, js::gcreason::Reason, long long) [jsfriendapi.cpp : 190 + 0xe]
     r4 = 0x00000019    r5 = 0x00000000    r6 = 0x00000000    r7 = 0x00000001
     r8 = 0x00000028    r9 = 0x00000000   r10 = 0x544fba90    fp = 0x0011e998
     sp = 0x4e2087e8    pc = 0x53d9e3d0
    Found by: call frame info

Comment 1

[Tom S. (please needinfo tschuster)]

E4X is gone.