Closed Bug 984653 Opened 6 years ago Closed 6 years ago

crash in js::jit::NameIC::attachReadSlot(JSContext*, js::jit::IonScript*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<js::Shape*>)

Categories

(Core :: JavaScript Engine, defect, critical)

30 Branch
ARM
Gonk (Firefox OS)
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla31
blocking-b2g 1.4+
Tracking Status
b2g-v1.3 --- unaffected
b2g-v1.3T --- unaffected
b2g-v1.4 --- fixed
b2g-v2.0 --- fixed

People

(Reporter: tnguyen, Unassigned)

References

Details

(Keywords: crash, regression, reproducible, Whiteboard: dogfood1.4 [osrestartcrash] [b2g-crash])

Crash Data

Attachments

(1 file)

36.60 KB, text/plain
Details
Attached file logcat
This bug was filed from the Socorro interface and is 
report bp-9025228d-3fc1-4bd7-bca0-f93fc2140317.
=============================================================

I encountered this crash while navigating to the 'Content Rating Details' (ESRB) link while an app was downloading.

Repro Steps:
1) Updated Buri to BuildID: 20140317040204
2) Navigate to Marketplace 
3) Tap on esviji app
4) Tap on 'Install' button
5) Scroll down to the bottom, and tap on 'Content Rating Details' while esviji app is installing

Actual Result:
Device crashes when trying to load the ESRB webpage in Browser app

Expected Result:
Device doesn't crash when trying to load the ESRB webpage

Environmental Variables:
Device: Buri Master M-C mozRIL
BuildID: 20140317040204
Gaia: 8f802237927c7d5e024fb7dca054dd5efef6b2e6
Gecko: 25cfa01ba054
Version: 30.0a1
v1.2-device.cfg

Repro Frequency: 2/3 (67%)
Attached: logcat
QA Wanted to check behavior on 1.3. Pretty sure it's a regression, but let's confirm.
blocking-b2g: --- → 1.4?
Component: Performance → JavaScript Engine
Product: Firefox OS → Core
Whiteboard: dogfood1.4 → dogfood1.4 [osrestartcrash]
Version: unspecified → 30 Branch
Whiteboard: dogfood1.4 [osrestartcrash] → dogfood1.4 [osrestartcrash] [b2g-crash]
This issue does *not* reproduce on the 03/18/14 1.3 build.

Device: Buri v1.3 MOZ RIL
BuildID: 20140318004002
Gaia: 2ea2aab306bd1c941719160cdcb49ee9d755dc17
Gecko: cf2042938526
Version: 28.0
Firmware Version: V1.2-device.cfg
Keywords: qawanted
QA Contact: mvaughan
TINDERBOX:
- Last Working -
Device: Buri ENG Master v1.4 MOZ RIL
BuildID: 20140314193514
Gaia: f09ec7d9d0bb7c40998ddb6b5bf397e578add541
Gecko: 092d63342910
Version: 30.0a1
Firmware Version: V1.2-device.cfg

- First Broken -
Device: Buri ENG Master v1.4 MOZ RIL
BuildID: 20140314222112
Gaia: f09ec7d9d0bb7c40998ddb6b5bf397e578add541
Gecko: 82c90c17fc95
Version: 30.0a1
Firmware Version: V1.2-device.cfg

**This looks to be a gecko issue**
last working gaia/first broken gecko = REPRO
Gaia: f09ec7d9d0bb7c40998ddb6b5bf397e578add541
Gecko: 82c90c17fc95

first broken gaia/last working gecko = NO REPRO
Gaia: f09ec7d9d0bb7c40998ddb6b5bf397e578add541
Gecko: 092d63342910

Push log: http://hg.mozilla.org//mozilla-central/pushloghtml?fromchange=092d63342910&tochange=82c90c17fc95


MOZILLA INBOUND:
- Last Working -
Device: Buri ENG Master v1.4 MOZ RIL
BuildID: 20140314125617
Gaia: 1cef557f9e9a865d1bf49d99a8f1cca1f0f4f5c4
Gecko: b377204840b9
Version: 30.0a1
Firmware Version: V1.2-device.cfg

- First Broken -
Device: Buri ENG Master v1.4 MOZ RIL
BuildID: 20140314130018
Gaia: 1cef557f9e9a865d1bf49d99a8f1cca1f0f4f5c4
Gecko: 893b864b4b18
Version: 30.0a1
Firmware Version: V1.2-device.cfg

Push log: http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=b377204840b9&tochange=893b864b4b18
Blocks: 969012
blocking-b2g: 1.4? → 1.4+
Caused by:

http://hg.mozilla.org/integration/mozilla-inbound/rev/893b864b4b18

Triage believes this needs to be backed out.

Flagging checkin-needed for a backout.
Keywords: checkin-needed
Terrence says that's easier said than done.
Flags: needinfo?(terrence)
Keywords: checkin-needed
Well, the backout itself shouldn't be challenging. However, this patch didn't add any new mechanisms to ARM codegen, so the fact that we're only exploding there probably indicates a bug somewhere else that I happened to uncover. I guess we should backout for now and let an ARM expert try to figure out what's going on.
Flags: needinfo?(terrence) → needinfo?(mrosenberg)
(In reply to Ryan VanderMeulen [:RyanVM UTC-4] from comment #7)
> K, backed out.
> https://hg.mozilla.org/integration/mozilla-inbound/rev/7181bf175776

Note - we'll need to backout on Aurora as well.
This is backed out on m-c:

http://hg.mozilla.org/mozilla-central/rev/7181bf175776
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla31
Guessing the second patch in bug 969012 is what was causing this.
Flags: needinfo?(mrosenberg)
You need to log in before you can comment on or make changes to this bug.