Closed Bug 882433 Opened 11 years ago Closed 11 years ago

crash in js::ion::InlineFrameIteratorMaybeGC

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Version:
24 Branch
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 883973
Tracking Flags:
Tracking Status
firefox23 --- unaffected
firefox24 --- affected

People

(Reporter: scoobidiver, Unassigned)

References

(
URL
)

Details

(4 keywords)

Crash Data

It's currently #2 top crasher in 24.0a1/20130612 and first showed up in this build. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=86413e921d5d&tochange=0414d6d0f60d
I think it's a regression from bug 859609.

Signature 	js::ion::InlineFrameIteratorMaybeGC<int>::findNextFrame() More Reports Search
UUID	7c471cb8-c80c-44cb-86e2-ecfd72130612
Date Processed	2013-06-12 19:03:23
Uptime	677
Last Crash	3.6 days before submission
Install Age	2.3 hours since version was first installed.
Install Time	2013-06-12 16:45:29
Product	Firefox
Version	24.0a1
Build ID	20130612031138
Release Channel	nightly
OS	Windows NT
OS Version	6.1.7601 Service Pack 1
Build Architecture	x86
Build Architecture Info	GenuineIntel family 6 model 23 stepping 10
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0xffffffffffffff95
User Comments	Crashed on google maps after getting directions
App Notes 	
AdapterVendorID: 0x10de, AdapterDeviceID: 0x1244, AdapterSubsysID: 15563842, AdapterDriverVersion: 9.18.13.1422
D2D? D2D+ DWrite? DWrite+ D3D10 Layers? D3D10 Layers+ 
Processor Notes 	sp-processor01_phx1_mozilla_com_14226:2012
EMCheckCompatibility	True
Adapter Vendor ID	0x10de
Adapter Device ID	0x1244
Total Virtual Memory	4294836224
Available Virtual Memory	3567226880
System Memory Use Percentage	27
Available Page File	10941681664
Available Physical Memory	4671070208

Frame 	Module 	Signature 	Source
0 	mozjs.dll 	js::ion::InlineFrameIteratorMaybeGC<1>::findNextFrame 	js/src/ion/IonFrames.cpp:1270
1 	mozjs.dll 	js::ion::InlineFrameIteratorMaybeGC<1>::InlineFrameIteratorMaybeGC<1> 	js/src/ion/IonFrameIterator-inl.h:64
2 	mozjs.dll 	js::ion::GetPcScript 	js/src/ion/IonFrames.cpp:1019
3 	mozjs.dll 	js::GetPropertyHelper 	js/src/jsobj.cpp:4008
4 	mozjs.dll 	js::ion::GetPropertyIC::update 	js/src/ion/IonCaches.cpp:1513
5 	mozjs.dll 	js_math_round 	js/src/jsmath.cpp:664
6 		@0x1b8da9d0 	

More reports at:
https://crash-stats.mozilla.com/report/list?signature=js%3A%3Aion%3A%3AInlineFrameIteratorMaybeGC%3Cint%3E%3A%3AfindNextFrame%28%29
More reports also at:
https://crash-stats.mozilla.com/report/list?signature=js%3A%3Aion%3A%3AInlineFrameIteratorMaybeGC%3C%28js%3A%3AAllowGC%291%3E%3A%3AfindNextFrame%28%29
Crash Signature: [@ js::ion::InlineFrameIteratorMaybeGC<int>::findNextFrame()] → [@ js::ion::InlineFrameIteratorMaybeGC<int>::findNextFrame()] [@ js::ion::InlineFrameIteratorMaybeGC<(js::AllowGC)1>::findNextFrame() ]
OS: Windows 7 → All
Hardware: x86 → All
Crash Signature: [@ js::ion::InlineFrameIteratorMaybeGC<int>::findNextFrame()] [@ js::ion::InlineFrameIteratorMaybeGC<(js::AllowGC)1>::findNextFrame() ] → [@ js::ion::InlineFrameIteratorMaybeGC<int>::findNextFrame()] [@ js::ion::InlineFrameIteratorMaybeGC<(js::AllowGC)1>::findNextFrame() ] [@ js::ion::SnapshotReader::readSlot() ]
Crash Signature: [@ js::ion::InlineFrameIteratorMaybeGC<int>::findNextFrame()] [@ js::ion::InlineFrameIteratorMaybeGC<(js::AllowGC)1>::findNextFrame() ] [@ js::ion::SnapshotReader::readSlot() ] → [@ js::ion::InlineFrameIteratorMaybeGC<int>::findNextFrame()] [@ js::ion::InlineFrameIteratorMaybeGC<(js::AllowGC)1>::findNextFrame() ] [@ js::ion::SnapshotReader::readSlot() ] [@ js::ion::CompactBufferReader::readSigned() ]
Kannan can you please help with investigation here given this is a reproducible topcrash and may be a regression from bug 859609 ?
Flags: needinfo?(kvijayan)
I have a pressing issue with another s-c bug to deal with, but I can look at this later today.
Flags: needinfo?(kvijayan)
(In reply to Robert Kaiser (:kairo@mozilla.com) [away until early June] from comment #4)
> Is
> https://crash-stats.mozilla.com/report/
> list?signature=js%3A%3Aion%3A%3ASnapshotIterator%3A%3AslotValue%28js%3A%3Aion
> %3A%3ASnapshotReader%3A%3ASlot%20const%26%29 the same issue?
It's bug 883562.
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → DUPLICATE
Crash Signature: [@ js::ion::InlineFrameIteratorMaybeGC<int>::findNextFrame()] [@ js::ion::InlineFrameIteratorMaybeGC<(js::AllowGC)1>::findNextFrame() ] [@ js::ion::SnapshotReader::readSlot() ] [@ js::ion::CompactBufferReader::readSigned() ] → [@ js::ion::InlineFrameIteratorMaybeGC<int>::findNextFrame()] [@ js::ion::InlineFrameIteratorMaybeGC<(js::AllowGC)1>::findNextFrame() ] [@ js::ion::SnapshotReader::readSlot() ] [@ js::ion::CompactBufferReader::readSigned() ] [@ js::GetPropertyHelper(J…
tracked in duped of bug
tracking-firefox24: + → ---
You need to log in before you can comment on or make changes to this bug.