831018 - crash in js::IsWrapper

Status: RESOLVED DUPLICATE of bug 851934

(Core :: JavaScript Engine, defect)

Description

[Scoobidiver (away)]

It's #97 browser crasher in 20.0a2 and #90 in 21.0a1.
It first showed up in 20.0a1/20121219 but has been discontinuous across builds. The regression range might be:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=2e70b718903a&tochange=bfd85c9652fa

Signature 	js::IsWrapper(JSObject*) More Reports Search
UUID	190cfa63-d5c3-47ab-9e0d-4f84c2130115
Date Processed	2013-01-15 21:56:39
Uptime	2387
Last Crash	40.2 minutes before submission
Install Age	39.8 minutes since version was first installed.
Install Time	2013-01-15 21:16:40
Product	Firefox
Version	21.0a1
Build ID	20130115030936
Release Channel	nightly
OS	Windows NT
OS Version	6.2.9200
Build Architecture	x86
Build Architecture Info	AuthenticAMD family 15 model 95 stepping 3
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x0
App Notes 	
AdapterVendorID: 0x10de, AdapterDeviceID: 0x10c3, AdapterSubsysID: 00000000, AdapterDriverVersion: 9.18.13.1090
D2D? D2D+ DWrite? DWrite+ D3D10 Layers? D3D10 Layers+ 
Processor Notes 	
EMCheckCompatibility	True
Adapter Vendor ID	0x10de
Adapter Device ID	0x10c3
Total Virtual Memory	2147352576
Available Virtual Memory	1525915648
System Memory Use Percentage	38
Available Page File	2191781888
Available Physical Memory	1971920896

Frame 	Module 	Signature 	Source
0 	mozjs.dll 	js::IsWrapper 	js/src/jswrapper.h:250
1 	mozjs.dll 	js::mjit::stubs::ValueToBoolean 	js/src/methodjit/StubCalls.cpp:458
2 	mozjs.dll 	js::mjit::EnterMethodJIT 	js/src/methodjit/MethodJIT.cpp:1041
3 	mozjs.dll 	CheckStackAndEnterMethodJIT 	js/src/methodjit/MethodJIT.cpp:1099
4 	mozjs.dll 	js::ion::CanEnterAtBranch 	js/src/ion/Ion.cpp:1451
5 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:1405
6 	mozjs.dll 	js::RunScript 	js/src/jsinterp.cpp:340
7 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:406
8 	mozjs.dll 	js::Invoke 	js/src/jsinterp.h:112
9 	mozjs.dll 	js_fun_apply 	js/src/jsfun.cpp:967
10 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:391
11 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:2385
12 	mozjs.dll 	js::RunScript 	js/src/jsinterp.cpp:340
13 	mozjs.dll 	js::analyze::ScriptAnalysis::needsArgsObj 	js/src/jsanalyze.cpp:1900
14 	mozjs.dll 	js::ContextStack::ensureOnTop 	js/src/vm/Stack.cpp:949
15 	mozjs.dll 	js::Invoke 	js/src/jsinterp.h:112
16 	mozjs.dll 	js_fun_apply 	js/src/jsfun.cpp:967
17 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:391
18 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:2385
19 	mozjs.dll 	js::RunScript 	js/src/jsinterp.cpp:340
20 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:406
21 	mozjs.dll 	js::Invoke 	js/src/jsinterp.h:112
22 	mozjs.dll 	js_fun_apply 	js/src/jsfun.cpp:967
23 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:391
24 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:2385
25 	mozjs.dll 	js::RunScript 	js/src/jsinterp.cpp:340
26 	mozjs.dll 	UncachedInlineCall 	js/src/methodjit/InvokeHelpers.cpp:398
27 	mozjs.dll 	js::mjit::stubs::UncachedCallHelper 	js/src/methodjit/InvokeHelpers.cpp:493
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=js%3A%3AIsWrapper%28JSObject*%29

Comment 1

[Scoobidiver (away)]

It's #12 top browser crasher in 20.0a2.
It started spiking in Aurora around February 17 or 20.0a2/20130217. I don't know whether it's an external cause or a second regression in Aurora.

Comment 2

[Lukas Blakk [:lsblakk] use ?needinfo]

Let's see what happens on 20.0b1 to determine if this is a spike still or not.

Comment 3

[Alex Keybl [:akeybl]]

#45 in 20.0b1

Comment 4

[Scoobidiver (away)]

It's #13 top browser crasher in 20.0b5 and #48 in 21.0a2.

Comment 5

[Alex Keybl [:akeybl]]

David - do you think this is a build-specific PGO issue, given the fact that this is a crash spike? If so, can we disable PGO for any impacted functionality?

Comment 6

[Alex Keybl [:akeybl]]

(In reply to Alex Keybl [:akeybl] from comment #5)
> David - do you think this is a build-specific PGO issue, given the fact that
> this is a crash spike? If so, can we disable PGO for any impacted
> functionality?

got my wires crossed - s/David/Naveed/

Comment 7

[Naveed Ihsanullah [:naveed]]

This maybe PGO related. Unfortunately the stack isn't sufficient for us to determine which method to disable PGO for. It will take an investigation and that cannot be done in a few hours. Handing this off to Sean to fix for the next cycle.

Comment 8

[Scoobidiver (away)]

Every comments talk about sending an email in Hotmail/Outlook so it's likely a duplicate of bug 851934 (only the first frame is missing).

Comment 9

[Lukas Blakk [:lsblakk] use ?needinfo]

Wontfixing for 20 - also please mark this a dupe if it's confirmed this is the same as bug 851934.