crash in js::jit::FastInvoke(JSContext*, JS::Handle<JSFunction*>, JS::CallArgs&)

RESOLVED WORKSFORME

Status

()

Core
JavaScript Engine: JIT
--
critical
RESOLVED WORKSFORME
4 years ago
a year ago

People

(Reporter: tracy, Unassigned)

Tracking

({crash})

27 Branch
x86
All
crash
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

(Reporter)

Description

4 years ago
This bug was filed from the Socorro interface and is 
report bp-44ed7855-5606-4474-b62e-b88342131010.
=============================================================

appearing as three reasons:

Windows - EXCEPTION_ACCESS_VIOLATION_READ
Linux - SIGSEGV
Mac - EXC_BAD_ACCESS / KERN_INVALID_ADDRESS

dholbert commented was hanging repeatedly

URLs are mostly facebook.

dholbert, can you comment on what you were doing when repeatedly hanging? 

Yours is the lone Linux crash report. It was with 20130930071202. Then there is a gap to the first builds that crash in this signature on Mac and Windows, 20131005030203.
I hit this crash when I was trying to rapidly switch between Facebook tabs using the keyboard shortcut cmd-option-left arrow, on Mac 10.8. (bp-d7cff55d-becd-4bea-8e13-e81792131015)
Crash Signature: [@ js::jit::FastInvoke(JSContext*, JS::Handle<JSFunction*>, JS::CallArgs&)] → [@ js::jit::FastInvoke(JSContext*, JS::Handle<JSFunction*>, JS::CallArgs&)] [@ arena_dalloc | js::jit::FastInvoke(JSContext*, JS::Handle<JSFunction*>, JS::CallArgs&) ]
FWIW, FastInvoke is just one of the places where we call into JIT code, like EnterIon/EnterBaseline etc.

Updated

2 years ago
Crash Signature: [@ js::jit::FastInvoke(JSContext*, JS::Handle<JSFunction*>, JS::CallArgs&)] [@ arena_dalloc | js::jit::FastInvoke(JSContext*, JS::Handle<JSFunction*>, JS::CallArgs&) ] → [@ js::jit::FastInvoke(JSContext*, JS::Handle<JSFunction*>, JS::CallArgs&)] [@ arena_dalloc | js::jit::FastInvoke(JSContext*, JS::Handle<JSFunction*>, JS::CallArgs&) ] [@ js::jit::FastInvoke] [@ arena_dalloc | js::jit::FastInvoke ]

Comment 3

2 years ago
(In reply to Jan de Mooij [:jandem] from comment #2)
> FWIW, FastInvoke is just one of the places where we call into JIT code, like
> EnterIon/EnterBaseline etc.

as such, is this actionable??

only 3 version 47 crashes in the past week https://crash-stats.mozilla.com/signature/?signature=js%3A%3Ajit%3A%3AFastInvoke&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=platform&_columns=reason&_columns=address&page=1#reports  (and none for arena_dalloc | js::jit::FastInvoke)
I see only 4 crashes today in crash-stat, which sounds below the noise level, and also on versions which are no longer supported.

Feel free to reopen this bug if any more crashes show up.
Status: NEW → RESOLVED
Last Resolved: a year ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.