Closed Bug 1175680 Opened 9 years ago Closed 9 years ago

Intermittent test_Range-surroundContents.html | application crashed [@ js::jit::RObjectState::recover] (Assertion failure: (object->as<UnboxedPlainObject>().setValue(cx, properties[i], val)), at js/src/jit/Recover.cpp:1386)

Categories

(Core :: JavaScript Engine: JIT, defect)

Product:
Core
Component:
JavaScript Engine: JIT
Platform:
ARM
Android
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1175233
Tracking Flags:
Tracking Status
firefox41 --- affected

People

(Reporter: RyanVM, Unassigned)

Details

(Keywords: assertion, crash, intermittent-failure)

10:25:53 INFO - 21 INFO TEST-START | dom/imptests/html/dom/ranges/test_Range-surroundContents.html 10:28:19 INFO - INFO | automation.py | Application ran for: 0:12:59.096006 10:28:19 INFO - INFO | zombiecheck | Reading PID log: /tmp/tmpsJQ3jmpidlog 10:28:19 INFO - Contents of /data/anr/traces.txt: 10:28:19 INFO - /data/tombstones does not exist; tombstone check skipped 10:28:26 INFO - mozcrash Saved minidump as /builds/slave/test/build/blobber_upload_dir/28c176c0-5de9-1af8-47f3b206-398c3ad9.dmp 10:28:26 INFO - mozcrash Saved app info as /builds/slave/test/build/blobber_upload_dir/28c176c0-5de9-1af8-47f3b206-398c3ad9.extra 10:28:26 WARNING - PROCESS-CRASH | dom/imptests/html/dom/ranges/test_Range-surroundContents.html | application crashed [@ js::jit::RObjectState::recover] 10:28:26 INFO - Crash dump filename: /tmp/tmpFHYzEn/28c176c0-5de9-1af8-47f3b206-398c3ad9.dmp 10:28:26 INFO - Operating system: Android 10:28:26 INFO - 0.0.0 Linux 2.6.29-gea477bb #1 Wed Sep 26 11:04:45 PDT 2012 armv7l generic/sdk/generic:4.3.1/JLS36I/eng.gbrown.20150308.182649:eng/test-keys 10:28:26 INFO - CPU: arm 10:28:26 INFO - 0 CPUs 10:28:26 INFO - Crash reason: SIGSEGV 10:28:26 INFO - Crash address: 0x0 10:28:26 INFO - Thread 12 (crashed) 10:28:26 INFO - 0 libxul.so!js::jit::RObjectState::recover [Recover.cpp:89fa4cae20d1 : 1386 + 0x2] 10:28:26 INFO - r4 = 0x60748ae0 r5 = 0x52afcdf0 r6 = 0x52afcd48 r7 = 0x52afcd58 10:28:26 INFO - r8 = 0x00000000 r9 = 0x00000000 r10 = 0x5ac544f0 fp = 0x6a35c100 10:28:26 INFO - sp = 0x52afcd28 lr = 0x59fef20d pc = 0x5a058468 10:28:26 INFO - Found by: given as instruction pointer in context 10:28:26 INFO - 1 libxul.so!js::jit::SnapshotIterator::computeInstructionResults [JitFrames.cpp:89fa4cae20d1 : 2259 + 0x9] 10:28:26 INFO - r4 = 0x00000001 r5 = 0x52afdbe8 r6 = 0x52afcdb8 r7 = 0x52afce40 10:28:26 INFO - r8 = 0x60748ae0 r9 = 0x00000000 r10 = 0x52afce28 fp = 0x52afcdf0 10:28:26 INFO - sp = 0x52afcdb8 pc = 0x59fce60b 10:28:26 INFO - Found by: call frame info 10:28:26 INFO - 2 libxul.so!js::jit::SnapshotIterator::initInstructionResults [JitFrames.cpp:89fa4cae20d1 : 2213 + 0xb] 10:28:26 INFO - r4 = 0x60748ae0 r5 = 0x52afd3b8 r6 = 0x52afdbe8 r7 = 0x6f733c00 10:28:26 INFO - r8 = 0x52afd340 r9 = 0x52afd918 r10 = 0x52afcfbc fp = 0x00000000 10:28:26 INFO - sp = 0x52afcf88 pc = 0x59fd1309 10:28:26 INFO - Found by: call frame info 10:28:26 INFO - 3 libxul.so!js::jit::BailoutIonToBaseline [BaselineBailouts.cpp:89fa4cae20d1 : 436 + 0x3] 10:28:26 INFO - r4 = 0x00000001 r5 = 0xffffff82 r6 = 0x00000000 r7 = 0x52afd2a8 10:28:26 INFO - r8 = 0x52afd574 r9 = 0x52afdb78 r10 = 0x52afd3b8 fp = 0x60748ae0 10:28:26 INFO - sp = 0x52afd160 pc = 0x59f6d6cf 10:28:26 INFO - Found by: call frame info 10:28:26 INFO - 4 libxul.so!js::jit::InvalidationBailout [Bailouts.cpp:89fa4cae20d1 : 130 + 0xb] 10:28:26 INFO - r4 = 0x52afd918 r5 = 0x52afd574 r6 = 0x60748ae0 r7 = 0x00000001 10:28:26 INFO - r8 = 0x52afd6c0 r9 = 0x00000000 r10 = 0x52afd58c fp = 0x52afd930 10:28:26 INFO - sp = 0x52afd558 pc = 0x59f7004f 10:28:26 INFO - Found by: call frame info 10:28:26 INFO - 5 0x5df56876 10:28:26 INFO - r4 = 0x52afd804 r5 = 0x52afd7e8 r6 = 0x52afd7e4 r7 = 0x70872220 10:28:26 INFO - r8 = 0x5ad1c000 r9 = 0x6207c558 r10 = 0x7255ead0 fp = 0x52afd930 10:28:26 INFO - sp = 0x52afd6c0 pc = 0x5df56878 10:28:26 INFO - Found by: call frame info 10:29:32 INFO - 06-17 10:28:13.265 F/MOZ_Assert( 749): Assertion failure: (object->as<UnboxedPlainObject>().setValue(cx, properties[i], val)), at /builds/slave/fx-team-and-api-11-d-000000000/build/src/js/src/jit/Recover.cpp:1386
This issue is a duplicate of Bug 1174180, and it should be fixed by either Bug 1174322, or Bug 1175233.
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.