917594 - crash in js::ShapeTable::search(int, bool)

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

This bug was filed from the Socorro interface and is 
report bp-3a0c63a8-17a7-4dc8-886d-4596e2130916.
=============================================================
Crashing Thread
Frame 	Module 	Signature 	Source
0 	libxul.so 	js::ShapeTable::search(int, bool) 	js/src/vm/Shape.cpp
1 	libxul.so 	js::ObjectImpl::nativeLookup(js::ExclusiveContext*, int) 	js/src/vm/Shape.h
2 	libxul.so 	js::baseops::LookupProperty<(js::AllowGC)1u> 	js/src/jsobj.cpp
3 	libxul.so 	JSObject::lookupGeneric(JSContext*, JS::Handle<JSObject*>, JS::Handle<int>, JS::MutableHandle<JSObject*>, JS::MutableHandle<js::Shape*>) 	js/src/jsobj.cpp
4 	libxul.so 	JS_HasPropertyById(JSContext*, JSObject*, int, bool*) 	js/src/jsapi.cpp
5 	libxul.so 	JS_HasProperty(JSContext*, JSObject*, char const*, bool*) 	js/src/jsapi.cpp
6 	libxul.so 	mozilla::dom::workers::EventListenerManager::DispatchEvent(JSContext*, mozilla::dom::workers::EventTarget const&, JSObject*, mozilla::ErrorResult&) const 	dom/workers/EventListenerManager.cpp
7 	libxul.so 	mozilla::dom::EventTargetBinding_workers::dispatchEvent 	dom/workers/EventTarget.h
8 	libxul.so 	mozilla::dom::EventTargetBinding_workers::genericMethod 	/builds/slave/b2g_m-cen_hamachi_ntly-0000000/build/objdir-gecko/dom/bindings/EventTargetBinding.cpp
9 	libxul.so 	js::Invoke 	js/src/jscntxtinlines.h
10 	libxul.so 	JS_CallFunctionName(JSContext*, JSObject*, char const*, unsigned int, JS::Value*, JS::Value*) 	js/src/jsapi.cpp
11 	libxul.so 	mozilla::dom::workers::events::DispatchEventToTarget(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, bool*) 	dom/workers/Events.cpp
12 	libxul.so 	EventRunnable::WorkerRun 	dom/workers/XMLHttpRequest.cpp
13 	libxul.so 	mozilla::dom::workers::WorkerRunnable::Run() 	dom/workers/WorkerPrivate.cpp
14 	libxul.so 	mozilla::dom::workers::WorkerPrivate::DoRunLoop(JSContext*) 	dom/workers/WorkerPrivate.cpp
15 	libxul.so 	WorkerThreadRunnable::Run 	dom/workers/RuntimeService.cpp
16 	libxul.so 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp
17 	libxul.so 	NS_ProcessNextEvent(nsIThread*, bool) 	xpcom/glue/nsThreadUtils.cpp
18 	libxul.so 	nsThread::ThreadFunc(void*) 	xpcom/threads/nsThread.cpp
19 	libnss3.so 	_pt_root 	nsprpub/pr/src/pthreads/ptthread.c
20 	libc.so 	__thread_entry 	bionic/libc/bionic/pthread.c
21 	libc.so 	pthread_create 	bionic/libc/bionic/pthread.c
22 		@0x43dcd002 	

Happens in Calendar app for b2g

Comment 1

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

Note: this crash happens on multiple devices.  This stack is more towards b2g, though the js::ShapeTable::search signature has been seen in multiple platforms (bug 812319,bug 842097,bug 851806 )

cc'ed jsmith and james lal in hopes that they might have an idea on how to reproduce the crash based on the stack.

Comment 2

[Jason Smith [:jsmith]]

(In reply to Naoki Hirata :nhirata (please use needinfo instead of cc) from comment #1)
> Note: this crash happens on multiple devices.  This stack is more towards
> b2g, though the js::ShapeTable::search signature has been seen in multiple
> platforms (bug 812319,bug 842097,bug 851806 )
> 
> cc'ed jsmith and james lal in hopes that they might have an idea on how to
> reproduce the crash based on the stack.

There's a full test pass going on right now to test the calendar, so if we see something during the test pass, then we'll know if we managed to be able to reproduce.

Comment 3

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

Is this really happening on b2g-18, or is that a mistake?

Comment 4

[Boris Zbarsky [:bzbarsky]]

Is this fixed now that bug 918450 is fixed?

Comment 5

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

This should be a 26 bug.  This crash still occurs : 
https://crash-stats.mozilla.com/report/index/3bf13953-f3be-4e7d-84fb-c839c2130923

Comment 6

[Boris Zbarsky [:bzbarsky]]

Does it occur after today's landing of bug 918450 on Aurora?

Comment 8

[Jason Smith [:jsmith]]

FWIW - the dupe confirms this can be reproduced with the calendar app.

QA Wanted also for comment 6 - try using the STR in bug 919673 to reproduce before and after bug 918450 lands.

Comment 9

[Sarah Parsons]

Unable to reproduce this issue per comment 8 using the STR from bug 919673 on the Buri 1.2 Aurora Build ID: 20130929004004

Environmental Variables
Build ID: 20130929004004
Gecko: http://hg.mozilla.org/releases/mozilla-aurora/rev/48faa2668dd8
Gaia: N/A
Platform Version: 26.0a2

Comment 10

[Jason Smith [:jsmith]]

Works for me per comment 9 then.

Comment 11

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

Sorry, I had to relook at this crash, it is no longer occuring in socorro.

Comment 12

[Kyle Wooten]

Thanks!