844506 - crash in js::ion::LiveRangeAllocator

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Ravi Pina [:ravi]]

This bug was filed from the Socorro interface and is 
report bp-6cdca583-2f88-4dda-aacc-8d4902130223 .
============================================================= 

The same crash happened when clicking between folders in Zimbra.  I haven't been able to reproduce the specific condition for the crash, but the 3 times it was selecting different folders.

Other two:

https://crash-stats.mozilla.com/report/index/bp-6cdca583-2f88-4dda-aacc-8d4902130223
https://crash-stats.mozilla.com/report/index/bp-2245de2f-7186-4a61-a525-237ba2130223

Built from http://hg.mozilla.org/mozilla-central/rev/08a034e1d43a

I wasn't sure if this should be filed in Core Javascript or not so am placing here for triage assistance.

Comment 1

[John Daggett (:jtd)]

I've run into this multiple times today, usually with just a single window open with a Zimbra tab and a gmail tab.

Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:22.0) Gecko/20130224 Firefox/22.0

Comment 2

[John Daggett (:jtd)]

Steps to reproduce:

1. Open Zimbra mail
2. Click on a folder
3. Click on a message in that folder
4. Click on the Inbox folder
5. Repeat steps 2-4 until crash occurs

Sometimes happens the first time, sometimes it takes a few iterations.

Comment 3

[John Daggett (:jtd)]

Any feedback from JS guys?  Can you at least reproduce this?  It would help to know if this is something specific to my machine/profile or whether others see the same behavior.

Comment 4

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Sorry, I tried the STR (and repeated 10 times) and I didn't get a crash. Maybe try it with a fresh profile and see if it still happens? It also might be related to some aspect of your Zimbra account.

Comment 5

[Scoobidiver (away)]

It first showed up in 22.0a1/20130223 (hit by two users in that build) with the stack trace above. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=885cde564ff3&tochange=08a034e1d43a
I suspect bug 843038.

More reports at:
https://crash-stats.mozilla.com/report/list?signature=js%3A%3Aion%3A%3ALiveRangeAllocator%3Cjs%3A%3Aion%3A%3ALinearScanVirtualRegister%3E%3A%3AbuildLivenessInfo%28%29

Comment 6

[Jan de Mooij [:jandem]]

I can't reproduce it either. It would be great if people who can reproduce this could try a debug build (to see if it hits an assert somewhere) or get a good stack trace.

Comment 7

[Tony Chung [:tchung]]

ragavan reported the following similar stacks today, which he mentioned using facebook.  not sure what the steps are, but he said it was against the apr 26 nightly on mac, just having facebook open and crashes.

Frame 	Module 	Signature 	Source
0 	XUL 	js::ion::LiveRangeAllocator<js::ion::LinearScanVirtualRegister>::buildLivenessIn 	js/src/ion/LiveRangeAllocator.h:403
1 	XUL 	js::ion::LinearScanAllocator::go 	js/src/ion/LinearScan.cpp:1136
2 	XUL 	js::ion::GenerateLIR 	js/src/ion/Ion.cpp:1128

bp-df31b628-2cd2-4170-a050-a88ca2130426    4/26/13 1:47 PM
bp-04bf1a79-3d47-4d55-84d6-5418b2130426    4/26/13 1:38 PM
bp-57488521-4ae6-4c0b-bfde-536762130426    4/26/13 1:33 PM
bp-7b79e9cd-c8f1-4ae1-8d40-ee1a62130426    4/26/13 1:32 PM
bp-8556f9eb-ad72-42bd-87d9-331752130426    4/26/13 1:32 PM
bp-7552edf0-bbff-4977-a61f-5173d2130426    4/26/13 1:17 PM
862C519D-A322-4452-A053-733BD488E0BD     4/26/13 1:17 PM
bp-5156c0a5-5ac2-4402-be42-5905f2130426    4/26/13 12:28 PM
bp-aa516be3-1919-4a1e-be8c-352432130426    4/26/13 12:28 PM
bp-68dffb70-61f4-44fe-960f-7c9662130426    4/26/13 12:27 PM
bp-c30e02ac-3abd-43ac-b308-dd8f92130426    4/26/13 11:59 AM
bp-03ae3aae-cd59-426b-ba38-781122130426    4/26/13 11:41 AM
bp-b037758b-5a11-42fa-a422-d12752130426    4/26/13 9:40 AM

Comment 8

[Paul O'Shannessy [:zpao] (not bugmail, email directly)]

I've hit this a bunch after updating Nightly this morning from some build last week :/ Same stack as Ragavan.

bp-daac0216-d2a1-4573-987e-dbf712130429
bp-fba6d03f-32d8-4261-95dc-74d172130429
bp-fe9def8a-239b-4499-a70e-baaa62130429

Brian, based on 865373, possibly bug 865635 triggered this?

Comment 9

[Brian Hackett [Laid off!]]

What happens if you use a current nightly?  Those build ids are from 4/26, and per bug 865373 comment 3 this crash should be fixed in builds dated 4/27 or later.

Comment 10

[Paul O'Shannessy [:zpao] (not bugmail, email directly)]

Ah, looks like my Nightly didn't update all the way but I though it had (and at least one of those crashes was from UX branch which is likely behind). Current Nightly hasn't crashed with the same session it was, so probably ok. Sorry for the confusion!

Comment 11

[Scoobidiver (away)]

Ravi, is it still reproducible in Aurora and Nightly?

Comment 12

[Ravi Pina [:ravi]]

I haven't run into the problem for some time now.  Perhaps it was fixed at some point  I guess I'll close as WORKSFORME.