984653 - crash in js::jit::NameIC::attachReadSlot(JSContext*, js::jit::IonScript*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<js::Shape*>)

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Tony Nguyen]

Attachment: logcat

This bug was filed from the Socorro interface and is 
report bp-9025228d-3fc1-4bd7-bca0-f93fc2140317.
=============================================================

I encountered this crash while navigating to the 'Content Rating Details' (ESRB) link while an app was downloading.

Repro Steps:
1) Updated Buri to BuildID: 20140317040204
2) Navigate to Marketplace 
3) Tap on esviji app
4) Tap on 'Install' button
5) Scroll down to the bottom, and tap on 'Content Rating Details' while esviji app is installing

Actual Result:
Device crashes when trying to load the ESRB webpage in Browser app

Expected Result:
Device doesn't crash when trying to load the ESRB webpage

Environmental Variables:
Device: Buri Master M-C mozRIL
BuildID: 20140317040204
Gaia: 8f802237927c7d5e024fb7dca054dd5efef6b2e6
Gecko: 25cfa01ba054
Version: 30.0a1
v1.2-device.cfg

Repro Frequency: 2/3 (67%)
Attached: logcat

Comment 1

[Jason Smith [:jsmith]]

QA Wanted to check behavior on 1.3. Pretty sure it's a regression, but let's confirm.

Comment 2

[Matthew Vaughan]

This issue does *not* reproduce on the 03/18/14 1.3 build.

Device: Buri v1.3 MOZ RIL
BuildID: 20140318004002
Gaia: 2ea2aab306bd1c941719160cdcb49ee9d755dc17
Gecko: cf2042938526
Version: 28.0
Firmware Version: V1.2-device.cfg

Comment 3

[Matthew Vaughan]

TINDERBOX:
- Last Working -
Device: Buri ENG Master v1.4 MOZ RIL
BuildID: 20140314193514
Gaia: f09ec7d9d0bb7c40998ddb6b5bf397e578add541
Gecko: 092d63342910
Version: 30.0a1
Firmware Version: V1.2-device.cfg

- First Broken -
Device: Buri ENG Master v1.4 MOZ RIL
BuildID: 20140314222112
Gaia: f09ec7d9d0bb7c40998ddb6b5bf397e578add541
Gecko: 82c90c17fc95
Version: 30.0a1
Firmware Version: V1.2-device.cfg

**This looks to be a gecko issue**
last working gaia/first broken gecko = REPRO
Gaia: f09ec7d9d0bb7c40998ddb6b5bf397e578add541
Gecko: 82c90c17fc95

first broken gaia/last working gecko = NO REPRO
Gaia: f09ec7d9d0bb7c40998ddb6b5bf397e578add541
Gecko: 092d63342910

Push log: http://hg.mozilla.org//mozilla-central/pushloghtml?fromchange=092d63342910&tochange=82c90c17fc95


MOZILLA INBOUND:
- Last Working -
Device: Buri ENG Master v1.4 MOZ RIL
BuildID: 20140314125617
Gaia: 1cef557f9e9a865d1bf49d99a8f1cca1f0f4f5c4
Gecko: b377204840b9
Version: 30.0a1
Firmware Version: V1.2-device.cfg

- First Broken -
Device: Buri ENG Master v1.4 MOZ RIL
BuildID: 20140314130018
Gaia: 1cef557f9e9a865d1bf49d99a8f1cca1f0f4f5c4
Gecko: 893b864b4b18
Version: 30.0a1
Firmware Version: V1.2-device.cfg

Push log: http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=b377204840b9&tochange=893b864b4b18

Comment 4

[Jason Smith [:jsmith]]

Caused by:

http://hg.mozilla.org/integration/mozilla-inbound/rev/893b864b4b18

Triage believes this needs to be backed out.

Flagging checkin-needed for a backout.

Comment 5

[Ryan VanderMeulen [:RyanVM]]

Terrence says that's easier said than done.

Comment 6

[Terrence Cole [:terrence]]

Well, the backout itself shouldn't be challenging. However, this patch didn't add any new mechanisms to ARM codegen, so the fact that we're only exploding there probably indicates a bug somewhere else that I happened to uncover. I guess we should backout for now and let an ARM expert try to figure out what's going on.

Comment 7

[Ryan VanderMeulen [:RyanVM]]

K, backed out.
https://hg.mozilla.org/integration/mozilla-inbound/rev/7181bf175776

Comment 8

[Jason Smith [:jsmith]]

(In reply to Ryan VanderMeulen [:RyanVM UTC-4] from comment #7)
> K, backed out.
> https://hg.mozilla.org/integration/mozilla-inbound/rev/7181bf175776

Note - we'll need to backout on Aurora as well.

Comment 9

[Ryan VanderMeulen [:RyanVM]]

Good call.
https://hg.mozilla.org/releases/mozilla-aurora/rev/0546e4e8eac0

Comment 10

[Jason Smith [:jsmith]]

This is backed out on m-c:

http://hg.mozilla.org/mozilla-central/rev/7181bf175776

Comment 11

[Terrence Cole [:terrence]]

Guessing the second patch in bug 969012 is what was causing this.