Closed Bug 925749 Opened 11 years ago Closed 8 years ago

crash in js::jit::FastInvoke(JSContext*, JS::Handle<JSFunction*>, JS::CallArgs&)

Categories

(Core :: JavaScript Engine: JIT, defect)

Product:
Core
Component:
JavaScript Engine: JIT
Version:
27 Branch
Platform:
x86
All
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: tracy, Unassigned)

Details

(Keywords: crash)

Crash Data

This bug was filed from the Socorro interface and is 
report bp-44ed7855-5606-4474-b62e-b88342131010.
=============================================================

appearing as three reasons:

Windows - EXCEPTION_ACCESS_VIOLATION_READ
Linux - SIGSEGV
Mac - EXC_BAD_ACCESS / KERN_INVALID_ADDRESS

dholbert commented was hanging repeatedly

URLs are mostly facebook.

dholbert, can you comment on what you were doing when repeatedly hanging? 

Yours is the lone Linux crash report. It was with 20130930071202. Then there is a gap to the first builds that crash in this signature on Mac and Windows, 20131005030203.
I hit this crash when I was trying to rapidly switch between Facebook tabs using the keyboard shortcut cmd-option-left arrow, on Mac 10.8. (bp-d7cff55d-becd-4bea-8e13-e81792131015)
Crash Signature: [@ js::jit::FastInvoke(JSContext*, JS::Handle<JSFunction*>, JS::CallArgs&)] → [@ js::jit::FastInvoke(JSContext*, JS::Handle<JSFunction*>, JS::CallArgs&)] [@ arena_dalloc | js::jit::FastInvoke(JSContext*, JS::Handle<JSFunction*>, JS::CallArgs&) ]
FWIW, FastInvoke is just one of the places where we call into JIT code, like EnterIon/EnterBaseline etc.
Crash Signature: [@ js::jit::FastInvoke(JSContext*, JS::Handle<JSFunction*>, JS::CallArgs&)] [@ arena_dalloc | js::jit::FastInvoke(JSContext*, JS::Handle<JSFunction*>, JS::CallArgs&) ] → [@ js::jit::FastInvoke(JSContext*, JS::Handle<JSFunction*>, JS::CallArgs&)] [@ arena_dalloc | js::jit::FastInvoke(JSContext*, JS::Handle<JSFunction*>, JS::CallArgs&) ] [@ js::jit::FastInvoke] [@ arena_dalloc | js::jit::FastInvoke ]
(In reply to Jan de Mooij [:jandem] from comment #2)
> FWIW, FastInvoke is just one of the places where we call into JIT code, like
> EnterIon/EnterBaseline etc.

as such, is this actionable??

only 3 version 47 crashes in the past week https://crash-stats.mozilla.com/signature/?signature=js%3A%3Ajit%3A%3AFastInvoke&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=platform&_columns=reason&_columns=address&page=1#reports  (and none for arena_dalloc | js::jit::FastInvoke)
I see only 4 crashes today in crash-stat, which sounds below the noise level, and also on versions which are no longer supported.

Feel free to reopen this bug if any more crashes show up.
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.