818986 - Intermittent crash in test_a4_tone.html [@ libc.so + 0xf264 | js::ion::AssemblerBufferWithConstantPool<...>::finishPool()]

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Ed Morley [:emorley]]

Android Tegra 250 mozilla-inbound opt test mochitest-2 on 2012-12-02 20:11:17 PST for push abf833bf24de

slave: tegra-229

https://tbpl.mozilla.org/php/getParsedLog.php?id=17547670&tree=Mozilla-Inbound

{
PROCESS-CRASH | /tests/content/media/test/test_a4_tone.html | application crashed [@ libc.so + 0xf264]
Crash dump filename: /tmp/tmpNMy46a/6774ceb2-6880-f4f6-54f948b2-614c22c4.dmp
Operating system: Android
                  0.0.0 Linux 2.6.32.9-00002-gd8084dc-dirty #1 SMP PREEMPT Wed Feb 2 11:32:06 PST 2011 armv7l nvidia/harmony/harmony/harmony:2.2/FRF91/20110202.102810:eng/test-keys
CPU: arm
     0 CPUs

Crash reason:  SIGSEGV
Crash address: 0x0

Thread 4 (crashed)
 0  libc.so + 0xf264
     r4 = 0x5e063800    r5 = 0x00000000    r6 = 0x4e94a988    r7 = 0x4e94a988
     r8 = 0x00000000    r9 = 0x7ff80000   r10 = 0x0000000e    fp = 0x00000670
     sp = 0x4e94a930    lr = 0x55642497    pc = 0xafd0f264
    Found by: given as instruction pointer in context
 1  libxul.so!js::ion::AssemblerBufferWithConstantPool<1024, 4, js::ion::Instruction, js::ion::Assembler, 1>::finishPool() [IonAssemblerBufferWithConstantPools.h : 732 + 0xf]
     sp = 0x4e94a958    pc = 0x55642497
    Found by: stack scanning
 2  libxul.so!js::ion::AssemblerBufferWithConstantPool<1024, 4, js::ion::Instruction, js::ion::Assembler, 1>::insertEntryForwards(unsigned int, unsigned char*, js::ion::Pool*, unsigned char*) [IonAssemblerBufferWithConstantPools.h : 498 + 0x5]
     r4 = 0x58b29220    r5 = 0x58b291c8    r6 = 0x00000008    r7 = 0x000077ba
     r8 = 0x00000000    r9 = 0x00000500   r10 = 0x00000af8    fp = 0x00000bb8
     sp = 0x4e94b1e0    pc = 0x556439ef
    Found by: call frame info
 3  libxul.so!js::ion::AssemblerBufferWithConstantPool<1024, 4, js::ion::Instruction, js::ion::Assembler, 1>::insertEntryBackwards(unsigned int, unsigned char*, js::ion::Pool*, unsigned char*) [IonAssemblerBufferWithConstantPools.h : 499 + 0xb]
     r4 = 0x58b29220    r5 = 0x58b291c8    r6 = 0x4e94b260    r7 = 0x00000014
     r8 = 0x00000000    r9 = 0x58b29aa0   r10 = 0x00000500    fp = 0x00000af8
     sp = 0x4e94b230    pc = 0x55640ce3
    Found by: call frame info
 4  libxul.so!js::ion::Assembler::as_FImm64Pool(js::ion::VFPRegister, double, js::ion::AssemblerBufferWithConstantPool<1024, 4, js::ion::Instruction, js::ion::Assembler, 1>::PoolEntry*, js::ion::Assembler::Condition) [IonAssemblerBufferWithConstantPools.h : 448 + 0x9]
     r4 = 0x58b29030    r5 = 0x4e94b27c    r6 = 0x58b29220    r7 = 0x58b291c8
     r8 = 0x00000000    r9 = 0x00000003   r10 = 0x4e94b954    fp = 0x59574834
     sp = 0x4e94b260    pc = 0x55644d0b
    Found by: call frame info
 5  libxul.so!js::ion::MacroAssemblerARMCompat::loadStaticDouble(double const*, js::ion::FloatRegister const&) [MacroAssembler-arm.cpp : 2322 + 0x9]
     r4 = 0xe0000000    r5 = 0x00000003    r6 = 0x4e94b2b8    r7 = 0x00000006
     r8 = 0x00000010    r9 = 0x00000003   r10 = 0x4e94b954    fp = 0x59574834
     sp = 0x4e94b2a0    pc = 0x55648c09
    Found by: call frame info
 6  libxul.so!js::ion::MacroAssembler::loadFromTypedArray<js::ion::BaseIndex> [IonMacroAssembler.cpp : 200 + 0x11]
     r4 = 0x58b29030    r5 = 0x00000003    r6 = 0x4e94b2b8    r7 = 0x00000006
     r8 = 0x00000010    r9 = 0x00000003   r10 = 0x4e94b954    fp = 0x59574834
     sp = 0x4e94b2b0    pc = 0x555f6747
    Found by: call frame info
 7  libxul.so!js::ion::CodeGenerator::visitLoadTypedArrayElement(js::ion::LLoadTypedArrayElement*) [CodeGenerator.cpp : 3971 + 0xf]
     r4 = 0x5940c218    r5 = 0x58b29000    r6 = 0x4e94b330    r7 = 0x00000006
     r8 = 0x00000010    r9 = 0x00000003   r10 = 0x4e94b954    fp = 0x59574834
     sp = 0x4e94b308    pc = 0x556aaf5d
    Found by: call frame info
 8  libxul.so!js::ion::LLoadTypedArrayElement::accept(js::ion::LInstructionVisitor*) [LIR-Common.h : 2381 + 0xb]
}

Comment 1

[Ed Morley [:emorley]]

Resolving WFM keyword:intermittent-failure bugs last modified >3 months ago, whose whiteboard contains none of:
{random,disabled,marked,fuzzy,todo,fails,failing,annotated,time-bomb,leave open}

There will inevitably be some false positives; for that (and the bugspam) I apologise. Filter on orangewfm.