Was using Tomnod, after some-time of looking at separate map tiles (http://www.tomnod.com/nod/challenge/malaysiaairsar2014/map/638584 is an example, looked at map tiles around that for about 20-25 minutes before the crash) https://crash-stats.mozilla.com/report/index/d5b55e6c-207e-4ce3-ab50-fc23a2140318
Opening this PDF with the build in PDF.JS viewer also produces a crash, which is linked against this bug from the crash report: http://people.inf.ethz.ch/markusp/teaching/263-2300-ETH-spring11/midterm/midterm_sln.pdf This is using Firefox Nightly 2014-04-12 on OSX.
Affects not only Mac OS X. Confirmed on Linux.
OS: Mac OS X → All
Does not affect Aurora.
Version: 30 Branch → 31 Branch
The crash seems to happen between nightly 2014-03-26 and 2014-04-02. Downloading the latest nightly, the crash cannot be reproduced anymore. Therefore, mark this bug as resolved/fixed.
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
I still see this crash about once a day with Beta 31 on OS X. This definitely seems like a regression in Firefox 31 because I never saw this particular stack trace until the day I upgraded Beta 30 to 31. bp-988eaefc-54b9-4278-b742-fd8382140619 6/18/14 9:26 PM bp-0e3876e6-7f87-4d4c-8c6a-5d1382140618 6/17/14 11:50 PM bp-609568a0-280b-4f14-91b2-7e5bf2140618 6/17/14 5:02 PM bp-5233a038-e806-4785-ae8c-fb0d42140615 6/15/14 1:35 AM bp-b849398f-90e2-4747-b42c-9b65b2140614 6/14/14 1:47 AM The crash seems to be correlated with browsing pinterest.com or using the Pinterest "Pin It" add-on: http://about.pinterest.com/en/goodies
I'm repro'ing this also the dat that I upgraded to Fx31
edwong/cpeterson, have you seen this on Windows? If so, can you please set MOZ_CRASHREPORTER_FULLDUMP in your environment before launching Firefox, and if you crash *don't submit the crash* (as the dump will be quite large). This isn't showing up in the general topcrash list, but it does show as the #10 mac topcrash for 31. But it also shows up in Firefox 30. I think your best bet on mac would be to run a debug build in a debugger and collect a full core on crash.
FWIW, this is the #10 Mac OS X crash in the last 7-days on Beta. This accounts of 0.11% of crashes on Beta in the last week, 0.13% of crashes in the last two weeks, and 0.14% of crashes in the last month. It looks like this is trending downward, if not stable. For this reason, I'm not sure its worth tracking but that doesn't mean it's not worth investigating. Particularly if we have people who can repro this and are willing to debug it.
Too late for 31. I guess 32 and 33 are affected. Tracking.
I see this all the time, something in my session history reproduces it semi-reliably. Anyone want to help debug it against my shist? /be
I hit this crash twice this morning in Fennec, running on an ARMv6 Galaxy Q device. I was just loading a bug on bugzilla when it happened. https://crash-stats.mozilla.com/report/index/d5fba357-53f7-451c-ac0f-a9a4c2140721 https://crash-stats.mozilla.com/report/index/0152e2a6-30b0-4a43-a613-d61d02140721
My wife's computer is running into this as well, https://crash-stats.mozilla.com/report/index/34ca5602-e202-4021-ae08-488772140731 (She does use pintrest but Facebook was the only thing open at the time of the crash).
We don't have specific steps to reproduce this crash but we have several varying scenarios on this bug. I'd like to get an engineer's perspective on what would be useful to debug this further before I dedicate QA resources.
(In reply to Anthony Hughes, QA Mentor (:ashughes) from comment #14) > We don't have specific steps to reproduce this crash but we have several > varying scenarios on this bug. I'd like to get an engineer's perspective on > what would be useful to debug this further before I dedicate QA resources. Naveed - Can you please help with additional information for Anthony?
Jan please find an owner for this.
Flags: needinfo?(nihsanullah) → needinfo?(jdemooij)
(In reply to Naveed Ihsanullah [:naveed] from comment #17) > Jan please find an owner for this. Without STR there's not much we can do. Every release has had JIT crashes show up in crash stats.. Chris, is your girlfriend still seeing this? Apparently OS X + pinterest triggers it, we should look into that. I tried Ted's get-minidump-instructions tool (to get some JIT code around the instruction pointer), but it doesn't work here, probably because the crashes are on OS X.. Brendan, can you still reproduce the crashes? Based on crash-stats URLs, I *am* able to reproduce a crash in EnterBaseline on another website. I'm investigating that one now; it could be the same issue.
Jan, I haven't been able to reproduce the crash with a debug build, but I will try again.
As we don't have STR or any concrete next steps, I'm marking this as won't fix for 32. (Final beta build before RC happens Thu.) If we can't come up with any more useful information, it may be worth resolving this bug as invalid.
Something in my session state shifted, I'm not seeing this. /be
As Lawrence suggested, I am not going to track this bug for 33 or 34.
some thunderbird userse also getting both signatures js::jit::IonCannon(JSContext*, js::RunState&) bp-d5b55e6c-207e-4ce3-ab50-fc23a2140318 EnterBaseline bp-d6738939-695a-438a-86b7-a610c2140916
Whiteboard: [DUPEME] → [DUPEME][tbird crash]
I have a thunderbird user who somewhat easily reproduce this. Perhaps I can get him to cc: the bug report. He reports works 29.0b1 fails 30.0b1 bp-e412d9d7-6c10-4abb-bbac-ec3412140922 Do you want a more refined regression range?
(In reply to Wayne Mery (:wsmwk) from comment #24) > Do you want a more refined regression range? If you can get a more refined regression range that would definitely help. We don't have a lot of information to go on. The crash report here are quite generic and we don't have STR (steps to reproduce) to try ourself. Another thing that would help is "steps to reproduce". If he can give more information about when this triggers and when not?
I've asked the user at https://support.mozilla.org/en-US/questions/1020360#answer-631956 As for steps, we don't currently have anything more than it's a startup crash.
(In reply to Wayne Mery (:wsmwk) from comment #26) > I've asked the user at > https://support.mozilla.org/en-US/questions/1020360#answer-631956 30.0a1 from .../2014-03-18-03-02-03-comm-central/ runs 31.0a1 from .../2014-03-19-03-02-02-comm-central/ crashes http://hg.mozilla.org/comm-central/pushloghtml?startdate=2014-03-18+03%3A05%3A00&enddate=2014-03-19+03%3A05%3A00 http://hg.mozilla.org/mozilla-central/pushloghtml?startdate=2014-03-18+03%3A05%3A00&enddate=2014-03-19+03%3A05%3A00
Reporter adds ... (the *first*) 30.0a2 fails from http://ftp.mozilla.org/pub/mozilla.org/thunderbird/nightly/2014/03/2014-03-18-05-44-44-comm-aurora/ This failing 30.0a2 is built on the *same* day as the last 30.0a1 which *works*. 30.0a2 was built from ... email@example.com Tue Mar 18 08:36:04 2014 +0000 166a3e8cac27 Mark Banner — Added tag AURORA_BASE_20140318 for changeset 465fb05fd061 a=auroramerge DONTBUILD CLOSED TREE So reporter's added info roughly cuts in the regression range? http://hg.mozilla.org/mozilla-central/pushloghtml?startdate=2014-03-18+03%3A02%3A00&enddate=2014-03-18+05%3A44%3A00
Looking at the regression range and the fact this is IonMonkey related, this could be any of the following: > 405082f9ce44 Terrence Cole — Bug 984684 - Do not fire barriers on shared atoms; r=bhackett > 6311a62c5901 Terrence Cole — Bug 957723 - Decommit unused portions of the nursery; r=jonco > ce6a8fa5db7d Brian Hackett — Bug 979480 - Don't store array buffer contents in elements, r=sfink. > b239389ec1e6 Steve Fink — Bug 981809 - Postbarrier WeakMapPtr keys, r=terrence > ed7130b21a68 Terrence Cole — Bug 957723 - Decommit unused portions of the nursery; r=jonco > 0ae9c4eef8d6 Jon Coppeard — Bug 959787 - Handlify some friend and debug APIs r=sfink r=bholley > 9f41c59d6a59 Jon Coppeard — Bug 959787 - Handlify JS_ExecuteScript, JS_EvaluateScript and other JS APIs r=sfink r=bz (Most unlikely it could also be one of the following) > 32c15c55685d Peter Van der Beken — Bug 983620 - Remove the unused aScope argument from WrapGlobalObject. r=bz. > 8aca83520a91 Peter Van der Beken — Bug 983619 - Add Window.getInterface/QueryInterface to WebIDL. r=bz. > 570a5c5c8e38 Peter Van der Beken — Bug 982114 - Deal with new DOM binding objects for Window in more places. r=bz. > f61df670d962 Peter Van der Beken — Bug 982112 - Make accesscheck code deal with WebIDL bindings. r=bz.
I started seeing this crash again: once on 1/8 and then about 1–5 times per day between 1/18 and 1/25. No crashes since them. This is probably triggered by Pinterest pinning or leaving a Pinterest page open for a long time.
Crash Signature: [@ js::jit::IonCannon(JSContext*, js::RunState&) ] → [@ js::jit::IonCannon(JSContext*, js::RunState&) ] [@ js::jit::IonCannon ]
(In reply to Chris Peterson [:cpeterson] from comment #30) > I started seeing this crash again: once on 1/8 and then about 1–5 times per > day between 1/18 and 1/25. No crashes since them. This is probably triggered > by Pinterest pinning or leaving a Pinterest page open for a long time. crash IDs? 90% of crashes are Mac, send place is android. js::jit::IonCannon(JSContext*, js::RunState&) is on the rise per the graph for https://crash-stats.mozilla.com/signature/?date=%3E2015-09-01&signature=js%3A%3Ajit%3A%3AIonCannon%28JSContext*%2C+js%3A%3ARunState%26%29#graphs (In mid-october it was tripple sept 1's rate) ... until the signature refactor came in https://crash-stats.mozilla.com/signature/?date=%3E2015-09-01&signature=js%3A%3Ajit%3A%3AIonCannon&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=platform&_columns=reason&_columns=address&page=1#graphs where the rate is still higher I had a look at all the bugs of comment 29. None have open regressions marked against them
Wayne, here are my IonCannon crash IDs: bp-3eb65314-1fdb-42aa-ae4d-c4e1c2150126 (2015-01-24) bp-5563788e-64c1-48cd-b80d-43ec72150124 bp-78455bf1-0ea5-438e-a364-48e532150124 bp-cc0b7c1a-802b-4896-9c2d-4ed392150122 bp-0ccd9ce0-7f35-4358-9d06-672a62150122 bp-56d15283-415b-4efc-b7ea-3c4592150121 bp-80c5653f-0c0c-4147-9330-b22fb2150121 bp-0c09e074-dcdf-441c-9d0a-05e5a2150121 bp-fe77baa3-8390-4b58-9508-0ab9b2150121 bp-193ef24a-22bd-4fc9-bf87-081bf2150121 bp-3d7caad9-115c-4b1f-9d8c-35a072150121 bp-2b5dc803-f719-4be9-a25d-7f2d72150119 bp-17be0dc1-3e0f-40a4-b856-8de1d2150119 bp-867c9ea2-6725-4b65-86fd-0fec72150119 bp-9c8e70eb-71f0-4080-b932-a63772150109 bp-e25a18a3-80ea-42d6-9a88-5e6c52141223 (2014-12-23)
I started getting a crash here consistently on today's Nightly (2016-03-21) on Mac using Google Inbox. https://crash-stats.mozilla.com/report/index/1e8e2fc0-953a-4983-8fd7-de2322160322
Crash volume for signature 'js::jit::IonCannon': - nightly (version 50): 0 crash from 2016-06-06. - aurora (version 49): 4 crashes from 2016-06-07. - beta (version 48): 19 crashes from 2016-06-06. - release (version 47): 139 crashes from 2016-05-31. - esr (version 45): 391 crashes from 2016-04-07. Crash volume on the last weeks: Week N-1 Week N-2 Week N-3 Week N-4 Week N-5 Week N-6 Week N-7 - nightly 0 0 0 0 0 0 0 - aurora 1 0 2 0 0 0 0 - beta 3 2 0 0 11 2 0 - release 17 27 18 24 27 16 3 - esr 34 32 34 33 32 40 36 Affected platforms: Windows, Mac OS X, Linux
(Still no STR, alas.)
Priority: -- → P3
Crash volume for signature 'js::jit::IonCannon': - nightly (version 52): 2 crashes from 2016-09-19. - aurora (version 51): 26 crashes from 2016-09-19. - beta (version 50): 12 crashes from 2016-09-20. - release (version 49): 94 crashes from 2016-09-05. - esr (version 45): 431 crashes from 2016-07-25. Crash volume on the last weeks (Week N is from 10-17 to 10-23): W. N-1 W. N-2 W. N-3 W. N-4 - nightly 0 1 0 1 - aurora 11 7 2 3 - beta 5 3 2 1 - release 19 26 25 11 - esr 50 36 35 50 Affected platforms: Windows, Mac OS X, Linux Crash rank on the last 7 days: Browser Content Plugin - nightly - aurora #143 #395 - beta #2633 #3663 - release #2186 #800 - esr #195
Assignee: jdemooij → nobody
Whiteboard: [DUPEME][tbird crash] → [DUPEME][tbird crash][#jsapi:crashes-retriage]
Closing as there doesn't seem to be anything here still worth tracking separately. The meta-bug for current JIT crash signatures is Bug 858032.
Status: REOPENED → RESOLVED
Last Resolved: 5 years ago → a year ago
Resolution: --- → INCOMPLETE
Whiteboard: [DUPEME][tbird crash][#jsapi:crashes-retriage] → [DUPEME][tbird crash]
You need to log in before you can comment on or make changes to this bug.