Closed Bug 915814 Opened 11 years ago Closed 8 years ago

crash in js::jit::LinearScanAllocator::assign(js::jit::LAllocation)

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Version:
22 Branch
Platform:
x86
Windows 8
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED INVALID

People

(Reporter: ted, Unassigned)

References

(
URL
)

Details

(Keywords: crash)

Crash Data

I crashed twice just now using yesterday's nightly. This bug was filed from the Socorro interface and is report bp-aa58f878-f1a6-4f6d-877d-2edff2130912. ============================================================= Frame Module Signature Source 0 mozjs.dll js::jit::LinearScanAllocator::assign(js::jit::LAllocation) js/src/jit/LinearScan.cpp 1 mozjs.dll js::jit::LinearScanAllocator::spill() js/src/jit/LinearScan.cpp 2 mozjs.dll js::jit::LinearScanAllocator::allocateRegisters() js/src/jit/LinearScan.cpp 3 mozjs.dll js::jit::LinearScanAllocator::go() js/src/jit/LinearScan.cpp 4 mozjs.dll js::jit::GenerateLIR(js::jit::MIRGenerator *) js/src/jit/Ion.cpp 5 mozjs.dll js::jit::CompileBackEnd(js::jit::MIRGenerator *,js::jit::MacroAssembler *) js/src/jit/Ion.cpp 6 mozjs.dll js::jit::IonCompile js/src/jit/Ion.cpp 7 mozjs.dll js::jit::CompileFunctionForBaseline(JSContext *,JS::Handle<JSScript *>,js::jit::BaselineFrame *,bool) js/src/jit/Ion.cpp 8 mozjs.dll js::jit::EnsureCanEnterIon js/src/jit/BaselineIC.cpp 9 mozjs.dll js::jit::DoUseCountFallback js/src/jit/BaselineIC.cpp 10 @0x35 Other crash report: https://crash-stats.mozilla.com/report/index/1f37284a-580d-4a5a-a34e-f80812130912 The URL in question was loaded both times, so it's fairly suspect.
According to about:crashes, I've hit this about 5 - 10 times today. Each time, it seems to occur when I change focus back from some other application back to UX Nightly. As soon as I refocus the UX Nightly window, I crash. Just a casual observation.
Flags: needinfo?(jdemooij)
I just hit this again, on Facebook this time. I suspect this is only low-volume because it's Nightly-only and only triggers on certain scripts. If this makes it to beta I'd expect it to blow up in volume. https://crash-stats.mozilla.com/report/index/b22e50eb-c2c1-4be0-91f4-f94fb2130917
This is likely bug 917401. Ted and Mike, do you have the profiler enabled?
(In reply to Jan de Mooij [:jandem] from comment #5) > This is likely bug 917401. Ted and Mike, do you have the profiler enabled? Oh I see you also filed that bug. In the past we've seen crashes in LinearScanAllocator::assign when register pressure is too high and there's no register available. Let's see what bug 917401 does to these crashes.
Yes, I do have the profiler enabled, and I've hit both of these crashes a fair bit recently. Hopefully that bug fixes it!
Yes, I too have the profiler enabled. Thanks for the heads up about bug 917401!
I disabled the profiler and thought that the problem was alleviated but I just hit the same crash. This is pretty serious!
OS: Windows NT → Windows 8
Clearing needinfo. If anybody is still seeing this and can reproduce it reliably, please let me know.
Flags: needinfo?(jdemooij)
(In reply to Jan de Mooij [:jandem] from comment #11) > Clearing needinfo. If anybody is still seeing this and can reproduce it > reliably, please let me know. Can you check out this bug and see if it a dupe? https://bugzilla.mozilla.org/show_bug.cgi?id=1011793#c3
Flags: needinfo?(jdemooij)
(In reply to Chris More [:cmore] from comment #12) > Can you check out this bug and see if it a dupe? > > https://bugzilla.mozilla.org/show_bug.cgi?id=1011793#c3 Looking at that bug now..
Flags: needinfo?(jdemooij)
Assignee: general → nobody
Interestingly I just hit this again as a content process crash in my e10s-enabled Nightly: https://crash-stats.mozilla.com/report/index/9f634777-e0a0-451a-bbb7-effd32141125 (Yes, I still have the profiler installed.)
I just got this with and old version of profiler installed on current Thunderbird nightly https://crash-stats.mozilla.com/report/index/2c675e95-d71e-4886-bd3b-8f22b2141130
Crash Signature: [@ js::jit::LinearScanAllocator::assign(js::jit::LAllocation)] → [@ js::jit::LinearScanAllocator::assign(js::jit::LAllocation)] [@ js::jit::LinearScanAllocator::assign]
LSRA is gone, no new activity for two years, closing.
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → INVALID
You need to log in before you can comment on or make changes to this bug.