Closed Bug 683664 Opened 13 years ago Closed 9 years ago

crash @ js::types::TypeScript::Sweep

Categories

(Core :: JavaScript Engine, defect)

9 Branch
defect
Not set
critical

Tracking

()

RESOLVED WORKSFORME
Tracking Status
firefox19 - affected

People

(Reporter: marcia, Unassigned)

References

Details

(Keywords: crash, regression, Whiteboard: [TI-regression][unactionable])

Crash Data

https://crash-stats.mozilla.com/report/list?signature=js::types::TypeScript::Sweep%28JSContext*,%20JSScript*%29. Low volume Windows only crash so far related to TI landing. https://crash-stats.mozilla.com/report/index/b1731643-b462-48b2-9c77-cab0d2110831 Frame Module Signature [Expand] Source 0 xul.dll js::types::TypeScript::Sweep js/src/jsinfer.cpp:5553 1 xul.dll js::mjit::ClearAllFrames js/src/methodjit/Retcon.cpp:373 2 xul.dll JSCompartment::sweep js/src/jscompartment.cpp:636 3 xul.dll SweepCrossCompartmentWrappers js/src/jsgc.cpp:2214 4 xul.dll MarkAndSweep js/src/jsgc.cpp:2390 5 xul.dll GCCycle js/src/jsgc.cpp:2685 6 nspr4.dll PR_Lock nsprpub/pr/src/threads/combined/prulock.c:233 7 xul.dll js_GC js/src/jsgc.cpp:2771 8 xul.dll XPCCallContext::XPCCallContext js/src/xpconnect/src/xpccallcontext.cpp:63 9 xul.dll JS_CompartmentGC js/src/jsapi.cpp:2603 10 xul.dll nsXPConnect::Collect js/src/xpconnect/src/nsXPConnect.cpp:414 11 xul.dll nsNavHistory::GetFrecencyTransitionBonus toolkit/components/places/nsNavHistory.h:587 12 xul.dll xul.dll@0x2c11bf 13 xul.dll nsDocument::DoNotifyPossibleTitleChange content/base/src/nsDocument.cpp:5285 14 nspr4.dll MD_CURRENT_THREAD nsprpub/pr/src/md/windows/w95thred.c:308 15 nspr4.dll PR_ExitMonitor nsprpub/pr/src/threads/prmon.c:132 16 xul.dll nsNavHistory::GetFrecencyTransitionBonus toolkit/components/places/nsNavHistory.h:587 17 xul.dll nsXPConnect::GarbageCollect js/src/xpconnect/src/nsXPConnect.cpp:422 18 xul.dll nsThread::HasPendingEvents xpcom/threads/nsThread.cpp:516 19 xul.dll nsJSContext::GarbageCollectNow dom/base/nsJSEnvironment.cpp:3182 20 xul.dll nsNavHistory::GetFrecencyTransitionBonus toolkit/components/places/nsNavHistory.h:587 21 xul.dll nsTimerImpl::Fire xpcom/threads/nsTimerImpl.cpp:424 22 xul.dll nsTimerEvent::Run xpcom/threads/nsTimerImpl.cpp:520 23 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:631 24 xul.dll xul.dll@0x13379f 25 nspr4.dll MD_CURRENT_THREAD nsprpub/pr/src/md/windows/w95thred.c:308 26 xul.dll MessageLoop::DoWork ipc/chromium/src/base/message_loop.cc:412 27 xul.dll xul.dll@0x13379f 28 xul.dll mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:134 29 xul.dll nsCommandLine::EnumerateHandlers toolkit/components/commandlines/nsCommandLine.cpp:600 30 xul.dll MessageLoop::RunHandler ipc/chromium/src/base/message_loop.cc:201 31 nspr4.dll PR_GetThreadPrivate nsprpub/pr/src/threads/prtpd.c:232 32 xul.dll MessageLoop::Run ipc/chromium/src/base/message_loop.cc:175 33 msvcr90.dll getenv_helper_nolock 34 xul.dll MessageLoop::current ipc/chromium/src/base/message_loop.cc:85 35 xul.dll nsBaseAppShell::Run widget/src/xpwidgets/nsBaseAppShell.cpp:189 36 xul.dll nsAppStartup::Run toolkit/components/startup/nsAppStartup.cpp:224 37 xul.dll XRE_main toolkit/xre/nsAppRunner.cpp:3551 38 kernel32.dll kernel32.dll@0x22f70
Crash Signature: [@ js::types::TypeScript::Sweep(JSContext*, JSScript*) ] → [@ js::types::TypeScript::Sweep(JSContext*, JSScript*)] [@ js::types::TypeScript::Sweep(js::FreeOp*, JSScript*)] [@ js::types::TypeScript::Sweep]
OS: Windows 7 → All
Hardware: x86 → All
Summary: Firefox 9.0a1 Crash [@ js::types::TypeScript::Sweep(JSContext*, JSScript*) ] → crash @ js::types::TypeScript::Sweep
Version: Trunk → 9 Branch
I was viewing pictures 19.0a1 (2012-10-18) bp-74b1eb73-3a19-4279-9a4e-d5e232121021 0 mozjs.dll js::types::TypeScript::Sweep js/src/jsinfer.cpp:6303 1 mozjs.dll JSCompartment::sweep js/src/jscompartment.cpp:594 2 mozjs.dll BeginSweepPhase js/src/jsgc.cpp:3865 3 mozjs.dll IncrementalCollectSlice js/src/jsgc.cpp:4372 4 mozjs.dll GCCycle js/src/jsgc.cpp:4549 5 mozjs.dll Collect js/src/jsgc.cpp:4663 6 mozjs.dll js::GCSlice js/src/jsgc.cpp:4703 7 mozjs.dll js::IncrementalGC js/src/jsfriendapi.cpp:172 8 xul.dll nsJSContext::GarbageCollectNow dom/base/nsJSEnvironment.cpp:2921 9 xul.dll InterSliceGCTimerFired dom/base/nsJSEnvironment.cpp:3205 10 xul.dll nsTimerImpl::Fire xpcom/threads/nsTimerImpl.cpp:472 11 xul.dll nsTimerEvent::Run xpcom/threads/nsTimerImpl.cpp:555 12 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:612 some other people's bp-d9ff226d-a12a-4603-9a79-9f1fe2121019 bp-cde7ae19-25b2-43ec-92de-b1e942121020 bp-9361add0-4bfa-4fbd-b3d0-38bcf2121019
It started spiking from 19.0a1/20121014 and is #14 top crasher over the last week. The regression range for the spike is: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=90857937b601&tochange=57304bbf9c0e It's not correlated to an extension or a DLL. More reports at: https://crash-stats.mozilla.com/report/list?signature=js%3A%3Atypes%3A%3ATypeScript%3A%3ASweep%28js%3A%3AFreeOp*%2C+JSScript*%29
David/Naveed - can you find somebody to take a look at this JS regression?
bp-d5c80ed8-9e50-4781-9b8a-e42f62121030 19.0a1 (2012-10-18) started to download a large file via web+local network from iprorecorder on iphone (two files downloaded successfully in previous few minutes)
There is no obvious culprit in the the regression range. Unfortunately without a reproducible test there isn't much we can do with this bug now other than continue to monitor it.
After 19.0a1/20121022, the crash volume decreased by 90%. The working range is: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=1c3e4cb1f754&tochange=48502b61a63e It's now #52 top crasher over the last 3 days.
It's #42 top browser crasher in 19.0.2, #16 in 20.0b5, and #30 in 21.0a2.
Keywords: topcrash
While loading Deleting Borders (http://www.deletingborders.com/), I hit this bug or bug 854319 or indefinitely hangs.
Crash Signature: [@ js::types::TypeScript::Sweep(JSContext*, JSScript*)] [@ js::types::TypeScript::Sweep(js::FreeOp*, JSScript*)] [@ js::types::TypeScript::Sweep] → [@ js::types::TypeScript::Sweep(JSContext*, JSScript*)] [@ js::types::TypeScript::Sweep(js::FreeOp*, JSScript*)] [@ js::types::TypeScript::Sweep] [@ js::types::TypeSet::sweep(JS::Zone*) ]
2011-08-31 11:57:27 PDT You marked by bug as a dupe of this bug that was report almost 2 years ago and not fixed. [url=https://bugzilla.mozilla.org/show_bug.cgi?id=895530]https://bugzilla.mozilla.org/show_bug.cgi?id=895530[/url] This is not what I call working to fix anything.
(In reply to Gary King from comment #10) > You marked by bug as a dupe of this bug that was report almost 2 years ago > and not fixed. See comment 5 if you want to get it fixed.
Whiteboard: [TI-regression] → [TI-regression][unactionable]
Current Rank (combined signatures): * Release: #44 * Beta: #32 * Aurora: #42 * Nightly: #89 This no longer qualifies as a topcrash.
Keywords: topcrash
Assignee: general → nobody
Crash Signature: [@ js::types::TypeScript::Sweep(JSContext*, JSScript*)] [@ js::types::TypeScript::Sweep(js::FreeOp*, JSScript*)] [@ js::types::TypeScript::Sweep] [@ js::types::TypeSet::sweep(JS::Zone*) ] → [@ js::types::TypeScript::Sweep(JSContext*, JSScript*)] [@ js::types::TypeScript::Sweep(js::FreeOp*, JSScript*)] [@ js::types::TypeScript::Sweep] [@ js::types::TypeSet::sweep(JS::Zone*) ] [@ js::types::TypeSet::sweep ]
looks like signature gone after version 27
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.