Closed Bug 982453 Opened 11 years ago Closed 10 years ago

Intermittent svg/viewBox-valid-02.xhtml | application crashed [@ 0x10]

Categories

(Core :: JavaScript: GC, defect)

Product:
Core
Component:
JavaScript: GC
Version:
29 Branch
Platform:
ARM
Android
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: KWierso, Unassigned)

Details

(Keywords: crash, intermittent-failure)

https://tbpl.mozilla.org/php/getParsedLog.php?id=35969073&tree=Mozilla-Inbound slave: tegra-220 REFTEST TEST-PASS | http://10.26.84.23:30220/tests/layout/reftests/svg/viewBox-valid-01.svg | image comparison (==) REFTEST INFO | Loading a blank page REFTEST TEST-END | http://10.26.84.23:30220/tests/layout/reftests/svg/viewBox-valid-01.svg REFTEST TEST-START | http://10.26.84.23:30220/tests/layout/reftests/svg/viewBox-valid-02.xhtml REFTEST TEST-LOAD | http://10.26.84.23:30220/tests/layout/reftests/svg/viewBox-valid-02.xhtml | 1022 / 2410 (42%) REFTEST TEST-PASS | http://10.26.84.23:30220/tests/layout/reftests/svg/viewBox-valid-02.xhtml | image comparison (==) REFTEST INFO | Loading a blank page INFO | automation.py | Application ran for: 0:12:25.319617 INFO | zombiecheck | Reading PID log: /tmp/tmplV3ggMpidlog /data/anr/traces.txt not found mozcrash INFO | Downloading symbols from: http://ftp.mozilla.org/pub/mozilla.org/mobile/tinderbox-builds/mozilla-inbound-android-armv6/1394580427/fennec-30.0a1.en-US.android-arm-armv6.crashreporter-symbols.zip PROCESS-CRASH | http://10.26.84.23:30220/tests/layout/reftests/svg/viewBox-valid-02.xhtml | application crashed [@ 0x10] Crash dump filename: /tmp/tmpG8KAQt/40bdacf6-3315-3008-390d7bdb-7e5e72aa.dmp Operating system: Android 0.0.0 Linux 2.6.32.9-00002-gd8084dc-dirty #1 SMP PREEMPT Wed Feb 2 11:32:06 PST 2011 armv7l nvidia/harmony/harmony/harmony:2.2/FRF91/20110202.102810:eng/test-keys CPU: arm 2 CPUs Crash reason: SIGSEGV Crash address: 0x10 Thread 6 (crashed) 0 0x10 r4 = 0x483b8950 r5 = 0x5a5a5a5a r6 = 0x00000001 r7 = 0x5880e1cc r8 = 0x00000000 r9 = 0x00014a08 r10 = 0x4f3ff180 fp = 0x00005555 sp = 0x4f3ff0a8 lr = 0x550f4678 pc = 0x00000010 Found by: given as instruction pointer in context 1 org.mozilla.fennec-1.apk + 0x18a5a58 sp = 0x4f3ff0ac pc = 0x5a5a5a5a Found by: stack scanning 2 libxul.so!js::ReadBarriered<js::GlobalObject>::get() const [Barrier.h:89b07f1c81ee : 198 + 0x6] sp = 0x4f3ff0b8 pc = 0x550f5978 Found by: stack scanning 3 libxul.so!ScanShape [Barrier.h:89b07f1c81ee : 1203 + 0x6] r4 = 0x60ba5040 sp = 0x4f3ff0c8 pc = 0x550f61b8 Found by: call frame info 4 libxul.so!js::GCMarker::drainMarkStack(js::SliceBudget&) [Marking.cpp:89b07f1c81ee : 930 + 0xa] r4 = 0x60b81180 r5 = 0x5880e1cc r6 = 0x60ba5040 r7 = 0x5fc1b040 r8 = 0x00000001 sp = 0x4f3ff0e0 pc = 0x550f93b0 Found by: call frame info
More stack: { Crash reason: SIGSEGV Crash address: 0x10 Thread 6 (crashed) 0 0x10 r4 = 0x483b8950 r5 = 0x5a5a5a5a r6 = 0x00000001 r7 = 0x5880e1cc r8 = 0x00000000 r9 = 0x00014a08 r10 = 0x4f3ff180 fp = 0x00005555 sp = 0x4f3ff0a8 lr = 0x550f4678 pc = 0x00000010 Found by: given as instruction pointer in context 1 org.mozilla.fennec-1.apk + 0x18a5a58 sp = 0x4f3ff0ac pc = 0x5a5a5a5a Found by: stack scanning 2 libxul.so!js::ReadBarriered<js::GlobalObject>::get() const [Barrier.h:89b07f1c81ee : 198 + 0x6] sp = 0x4f3ff0b8 pc = 0x550f5978 Found by: stack scanning 3 libxul.so!ScanShape [Barrier.h:89b07f1c81ee : 1203 + 0x6] r4 = 0x60ba5040 sp = 0x4f3ff0c8 pc = 0x550f61b8 Found by: call frame info 4 libxul.so!js::GCMarker::drainMarkStack(js::SliceBudget&) [Marking.cpp:89b07f1c81ee : 930 + 0xa] r4 = 0x60b81180 r5 = 0x5880e1cc r6 = 0x60ba5040 r7 = 0x5fc1b040 r8 = 0x00000001 sp = 0x4f3ff0e0 pc = 0x550f93b0 Found by: call frame info 5 libxul.so!IncrementalCollectSlice [jsgc.cpp:89b07f1c81ee : 4067 + 0xa] r4 = 0x00000001 r5 = 0x4f3ff180 r6 = 0x5ab6946c r7 = 0x5ab6946c r8 = 0x00000fff r9 = 0x00000000 r10 = 0x5880e288 fp = 0x5880e000 sp = 0x4f3ff118 pc = 0x5529b064 Found by: call frame info 6 libxul.so!GCCycle [jsgc.cpp:89b07f1c81ee : 4791 + 0x1e] r4 = 0x00004e20 r5 = 0x00000000 r6 = 0x5880e000 r7 = 0x5580298c r8 = 0x00000000 r9 = 0x00000000 r10 = 0x00000000 fp = 0x558029a4 sp = 0x4f3ff258 pc = 0x5529d110 Found by: call frame info 7 libxul.so!Collect [jsgc.cpp:89b07f1c81ee : 4929 + 0x16] r4 = 0x00000001 r5 = 0x00000000 r6 = 0x5880e000 r7 = 0x00000001 r8 = 0x00000000 r9 = 0x00000001 r10 = 0x5880e288 fp = 0x00000000 sp = 0x4f3ff298 pc = 0x5529d6f4 Found by: call frame info 8 libxul.so!js::MaybeGC(JSContext*) [jsgc.cpp:89b07f1c81ee : 4859 + 0x26] r4 = 0x00000000 r5 = 0x00004e20 r6 = 0x00000000 r7 = 0x41464000 r8 = 0x5880e000 r9 = 0x589a8230 r10 = 0x5c79e800 fp = 0x00000000 sp = 0x4f3ff2f0 pc = 0x552a3044 Found by: call frame info 9 libxul.so!mozilla::AutoCxPusher::~AutoCxPusher() [nsCxPusher.cpp:89b07f1c81ee : 144 + 0x12] r4 = 0x4f3ff3c0 r5 = 0x5b073a80 r6 = 0x5c722000 r7 = 0x58c5ffb0 r8 = 0x00000001 r9 = 0x589a8230 r10 = 0x00000001 fp = 0x00000000 sp = 0x4f3ff318 pc = 0x5448e3c8 Found by: call frame info 10 libxul.so!mozilla::Maybe<mozilla::AutoCxPusher>::~Maybe() [Maybe.h:89b07f1c81ee : 41 + 0x12] r4 = 0x4f3ff3c0 r5 = 0x5b073a80 r6 = 0x5c722000 r7 = 0x58c5ffb0 r8 = 0x00000001 r9 = 0x589a8230 r10 = 0x00000001 fp = 0x00000000 sp = 0x4f3ff328 pc = 0x53c3e0a8 Found by: call frame info 11 libxul.so!nsGlobalWindow::SetNewDocument(nsIDocument*, nsISupports*, bool) [nsCxPusher.h:89b07f1c81ee : 63 + 0x6] r4 = 0x58c5d7d0 r5 = 0x5b073a80 r6 = 0x5c722000 r7 = 0x58c5ffb0 r8 = 0x00000001 r9 = 0x589a8230 r10 = 0x00000001 fp = 0x00000000 sp = 0x4f3ff330 pc = 0x54512844 Found by: call frame info 12 libxul.so!nsDocumentViewer::InitInternal(nsIWidget*, nsISupports*, nsIntRect const&, bool, bool, bool) [nsDocumentViewer.cpp:89b07f1c81ee : 894 + 0x16] r4 = 0x5c798c18 r5 = 0x54bf1240 r6 = 0x5c86d0c0 r7 = 0x00000001 r8 = 0x00000001 r9 = 0x54bf1240 r10 = 0x00000001 fp = 0x00000000 sp = 0x4f3ff418 pc = 0x54987d00 Found by: call frame info 13 libxul.so!nsDocumentViewer::Init(nsIWidget*, nsIntRect const&) [nsDocumentViewer.cpp:89b07f1c81ee : 635 + 0x12] r4 = 0x5c798c00 r5 = 0x4f3ff52c r6 = 0x00000000 r7 = 0x4f3ff49c r8 = 0xff00ff00 r9 = 0x00000320 r10 = 0x5c798d44 fp = 0x000003e8 sp = 0x4f3ff470 pc = 0x5498808c Found by: call frame info 14 libxul.so!nsDocShell::SetupNewViewer(nsIContentViewer*) [nsDocShell.cpp:89b07f1c81ee : 8588 + 0x12] r4 = 0x5c798c00 r5 = 0x4f3ff52c r6 = 0x00000000 r7 = 0x4f3ff49c r8 = 0xff00ff00 r9 = 0x00000320 r10 = 0x5c798d44 fp = 0x000003e8 sp = 0x4f3ff488 pc = 0x54befae8 Found by: call frame info 15 libxul.so!nsDocShell::Embed(nsIContentViewer*, char const*, nsISupports*) [nsDocShell.cpp:89b07f1c81ee : 6590 + 0x12] r4 = 0x5c798c00 r5 = 0x5c86d0c0 r6 = 0x5c8385b0 r7 = 0x4f3ff5e8 r8 = 0x00000000 r9 = 0x53c537e4 r10 = 0x4f3ff5dc fp = 0x00000001 sp = 0x4f3ff5a8 pc = 0x54bf96a0 Found by: call frame info 16 libxul.so!nsDocShell::CreateContentViewer(char const*, nsIRequest*, nsIStreamListener**) [nsDocShell.cpp:89b07f1c81ee : 8383 + 0x1e] r4 = 0x5c798c00 r5 = 0x4f3ff5f4 r6 = 0x5c8385b0 r7 = 0x4f3ff5e8 r8 = 0x00000000 r9 = 0x53c537e4 r10 = 0x4f3ff5dc fp = 0x00000001 sp = 0x4f3ff5c0 pc = 0x54bfb30c Found by: call frame info 17 libxul.so!nsDSURIContentListener::DoContent(char const*, bool, nsIRequest*, nsIStreamListener**, bool*) [nsDSURIContentListener.cpp:89b07f1c81ee : 122 + 0x1a] r4 = 0x00000000 r5 = 0x5c2bb490 r6 = 0x5c8385b0 r7 = 0x4f3ff62c r8 = 0x5cd19c24 r9 = 0x55850c80 r10 = 0x4f3ff67f fp = 0x5d27b2e8 sp = 0x4f3ff628 pc = 0x54c028e8 Found by: call frame info 18 libxul.so!nsDocumentOpenInfo::TryContentListener(nsIURIContentListener*, nsIChannel*) [nsURILoader.cpp:89b07f1c81ee : 681 + 0x16] r4 = 0x5cd19c24 r5 = 0x5c8385b0 r6 = 0x5c2bb490 r7 = 0x00000000 r8 = 0x4f3ff688 r9 = 0x54c027f4 r10 = 0x4f3ff67f fp = 0x00000000 sp = 0x4f3ff668 pc = 0x54003078 Found by: call frame info 19 libxul.so!nsDocumentOpenInfo::DispatchContent(nsIRequest*, nsISupports*) [nsURILoader.cpp:89b07f1c81ee : 382 + 0xa] r4 = 0x5cd19c10 r5 = 0x5c8385b0 r6 = 0x4f3ff7b8 r7 = 0x5cd19c30 r8 = 0x5cd19c10 r9 = 0x00000000 r10 = 0x4f3ff6f0 fp = 0x55850c80 sp = 0x4f3ff6c8 pc = 0x54003204 Found by: call frame info 20 libxul.so!nsDocumentOpenInfo::OnStartRequest(nsIRequest*, nsISupports*) [nsURILoader.cpp:89b07f1c81ee : 258 + 0xe] r4 = 0x00000000 r5 = 0x5c8385b0 r6 = 0x4f3ff7b8 r7 = 0x00000000 r8 = 0x5cd19c10 r9 = 0x00000000 r10 = 0x00000001 fp = 0x00000000 sp = 0x4f3ff7b0 pc = 0x54003890 Found by: call frame info 21 libxul.so!nsBaseChannel::OnStartRequest(nsIRequest*, nsISupports*) [nsBaseChannel.cpp:89b07f1c81ee : 715 + 0x12] r4 = 0x5c838580 r5 = 0x5c8385e4 r6 = 0x5b2efc9c r7 = 0x00000001 r8 = 0x4f002274 r9 = 0x00000000 r10 = 0x00000001 fp = 0x00000000 sp = 0x4f3ff7e0 pc = 0x53c4f848 Found by: call frame info 22 libxul.so!nsInputStreamPump::OnStateStart() [nsInputStreamPump.cpp:89b07f1c81ee : 517 + 0x12] r4 = 0x5b2efc40 r5 = 0x00000000 r6 = 0x5b2efc9c r7 = 0x00000001 r8 = 0x4f002274 r9 = 0x00000000 r10 = 0x00000001 fp = 0x00000000 sp = 0x4f3ff7f8 pc = 0x53c4fad8 Found by: call frame info 23 libxul.so!nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream*) [nsInputStreamPump.cpp:89b07f1c81ee : 431 + 0x6] r4 = 0x5b2efc40 r5 = 0x00000000 r6 = 0x5b2efc9c r7 = 0x00000001 r8 = 0x4f002274 r9 = 0x00000000 r10 = 0x00000001 fp = 0x00000000 sp = 0x4f3ff818 pc = 0x53c554fc Found by: call frame info 24 libxul.so!nsInputStreamReadyEvent::Run() + 0x2a r4 = 0x5d252360 r5 = 0x00000000 r6 = 0x4f3ff854 r7 = 0x4f3ff88f r8 = 0x4f002274 r9 = 0x00000000 r10 = 0x00000001 fp = 0x00000000 sp = 0x4f3ff838 pc = 0x53bf2a34 Found by: call frame info 25 libxul.so!nsThread::ProcessNextEvent(bool, bool*) [nsThread.cpp:89b07f1c81ee : 694 + 0xa] r4 = 0x4f002240 r5 = 0x00000000 r6 = 0x4f3ff854 r7 = 0x4f3ff88f r8 = 0x4f002274 r9 = 0x00000000 r10 = 0x00000001 fp = 0x00000000 sp = 0x4f3ff840 pc = 0x53c0148c Found by: call frame info 26 libxul.so!NS_ProcessNextEvent(nsIThread*, bool) [nsThreadUtils.cpp:89b07f1c81ee : 263 + 0x12] r4 = 0x00000000 r5 = 0x4f0171a0 r6 = 0x55850c80 r7 = 0x00000001 r8 = 0x4f001fb0 r9 = 0x5589cf38 r10 = 0x4f3ff91c fp = 0x00000000 sp = 0x4f3ff888 pc = 0x53bbb14c Found by: call frame info } There's no SVG code in the stack -- looks like this is a crash in JS garbage-collection code (where the GC is triggered by the nsCxPusher going out of scope in nsGlobalWindow::SetNewDocument. The stack shows Maybe<mozilla::AutoCxPusher> because that's what nsCxPusher contains.) Reclassifying as JS bug.
Component: SVG → JavaScript Engine
Component: JavaScript Engine → JavaScript: GC
Inactive; closing (see bug 1180138).
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.