Two instances: once in https://tbpl.mozilla.org/?rev=e0ae39a3298e which merged a bunch of JS pushes from mozilla-inbound including https://hg.mozilla.org/mozilla-central/rev/ae2293392154 which I'd like to blame since LifoAlloc is visible in the stack, then again in https://tbpl.mozilla.org/?tree=Mozilla-Inbound&onlyunstarred=1&rev=69369e7dad6c further up mozilla-inbound. https://tbpl.mozilla.org/php/getParsedLog.php?id=6798142&tree=Firefox Rev3 WINNT 6.1 mozilla-central debug test jsreftest on 2011-10-11 18:08:51 PDT for push e0ae39a3298e REFTEST TEST-START | file:///c:/talos-slave/test/build/jsreftest/tests/jsreftest.html?test=js1_5/extensions/regress-347306-02.js | 1924 / 3362 (57%) ++DOMWINDOW == 74 (0C4302D8) [serial = 3638] [outer = 0935D210] BUGNUMBER: 347306 STATUS: toSource should not be O(N**2) Size: 1000, Time: 11 ms TEST-UNEXPECTED-FAIL | file:///c:/talos-slave/test/build/jsreftest/tests/jsreftest.html?test=js1_5/extensions/regress-347306-02.js | application timed out after 330 seconds with no output INFO | automation.py | Application ran for: 0:21:33.389000 INFO | automation.py | Reading PID log: c:\users\cltbld\appdata\local\temp\tmpsh4wd0pidlog PROCESS-CRASH | file:///c:/talos-slave/test/build/jsreftest/tests/jsreftest.html?test=js1_5/extensions/regress-347306-02.js | application crashed (minidump found) Crash dump filename: c:\users\cltbld\appdata\local\temp\tmp0cxyqs\minidumps\0844b5fd-0f92-4791-9d53-65009a1f0190.dmp Operating system: Windows NT 6.1.7600 CPU: x86 GenuineIntel family 6 model 23 stepping 10 2 CPUs Crash reason: EXCEPTION_ACCESS_VIOLATION_WRITE Crash address: 0x0 Thread 17 (crashed) 0 crashinjectdll.dll!CrashingThread(void *) [crashinjectdll.cpp:e0ae39a3298e : 13 + 0x0] eip = 0x6fef103c esp = 0x0d38f848 ebp = 0x0d38f850 ebx = 0x00000000 esi = 0x00000000 edi = 0x00000000 eax = 0x76e31162 ecx = 0x00000000 edx = 0x6fef100a efl = 0x00010246 Found by: given as instruction pointer in context 1 kernel32.dll + 0x51173 eip = 0x76e31174 esp = 0x0d38f84c ebp = 0x0d38f850 Found by: call frame info 2 ntdll.dll + 0x5b3f4 eip = 0x7741b3f5 esp = 0x0d38f858 ebp = 0x0d38f890 Found by: previous frame's frame pointer 3 ntdll.dll + 0x5b3c7 eip = 0x7741b3c8 esp = 0x0d38f898 ebp = 0x0d38f8a8 Found by: previous frame's frame pointer Thread 0 0 msvcr80d.dll + 0x3beef eip = 0x6e90beef esp = 0x0028b168 ebp = 0x0028b184 ebx = 0x47738070 esi = 0x47710040 edi = 0x4ae8ec50 eax = 0xcdcdcdcd ecx = 0x032204fc edx = 0x00000000 efl = 0x00010206 Found by: given as instruction pointer in context 1 mozjs.dll!js::detail::BumpChunk::tryAlloc(unsigned int) [LifoAlloc.h:e0ae39a3298e : 149 + 0x7] eip = 0x6c7470fc esp = 0x0028b18c ebp = 0x0028b19c Found by: previous frame's frame pointer 2 mozjs.dll!js::LifoAlloc::alloc(unsigned int) [LifoAlloc.h:e0ae39a3298e : 224 + 0x10] eip = 0x6c747187 esp = 0x0028b1a4 ebp = 0x0028b1b0 ebx = 0x0000001d Found by: call frame info 3 mozjs.dll!NewOrRecycledNode [jsparse.cpp:e0ae39a3298e : 671 + 0xc] ... https://tbpl.mozilla.org/php/getParsedLog.php?id=6804179&tree=Mozilla-Inbound Rev3 WINNT 6.1 mozilla-inbound debug test jsreftest on 2011-10-11 23:29:50 PDT for push 69369e7dad6c REFTEST TEST-START | file:///c:/talos-slave/test/build/jsreftest/tests/jsreftest.html?test=js1_5/extensions/regress-347306-02.js | 1926 / 3364 (57%) ++DOMWINDOW == 74 (07CBFE60) [serial = 3642] [outer = 0766FBC8] BUGNUMBER: 347306 STATUS: toSource should not be O(N**2) Size: 1000, Time: 11 ms TEST-UNEXPECTED-FAIL | file:///c:/talos-slave/test/build/jsreftest/tests/jsreftest.html?test=js1_5/extensions/regress-347306-02.js | application timed out after 330 seconds with no output INFO | automation.py | Application ran for: 0:21:27.680000 INFO | automation.py | Reading PID log: c:\users\cltbld\appdata\local\temp\tmpnlvjimpidlog PROCESS-CRASH | file:///c:/talos-slave/test/build/jsreftest/tests/jsreftest.html?test=js1_5/extensions/regress-347306-02.js | application crashed (minidump found) Crash dump filename: c:\users\cltbld\appdata\local\temp\tmpn7t5og\minidumps\57a7f9bc-1be8-4aee-b95f-415a7dc32a5b.dmp Operating system: Windows NT 6.1.7600 CPU: x86 GenuineIntel family 6 model 23 stepping 10 2 CPUs Crash reason: EXCEPTION_ACCESS_VIOLATION_WRITE Crash address: 0x0 Thread 17 (crashed) 0 crashinjectdll.dll!CrashingThread(void *) [crashinjectdll.cpp:69369e7dad6c : 13 + 0x0] eip = 0x7246103c esp = 0x0753f860 ebp = 0x0753f868 ebx = 0x00000000 esi = 0x00000000 edi = 0x00000000 eax = 0x75da1162 ecx = 0x00000000 edx = 0x7246100a efl = 0x00010246 Found by: given as instruction pointer in context 1 kernel32.dll + 0x51173 eip = 0x75da1174 esp = 0x0753f864 ebp = 0x0753f868 Found by: call frame info 2 ntdll.dll + 0x5b3f4 eip = 0x76ecb3f5 esp = 0x0753f870 ebp = 0x0753f8a8 Found by: previous frame's frame pointer 3 ntdll.dll + 0x5b3c7 eip = 0x76ecb3c8 esp = 0x0753f8b0 ebp = 0x0753f8c0 Found by: previous frame's frame pointer Thread 0 0 msvcr80d.dll + 0x3beef eip = 0x71aabeef esp = 0x002ab290 ebp = 0x002ab2ac ebx = 0x41907e30 esi = 0x418e0040 edi = 0x4e3c85f0 eax = 0xcdcdcdcd ecx = 0x00d45e94 edx = 0x00000000 efl = 0x00010206 Found by: given as instruction pointer in context 1 mozjs.dll!js::detail::BumpChunk::tryAlloc(unsigned int) [LifoAlloc.h:69369e7dad6c : 149 + 0x7] eip = 0x68bb71bc esp = 0x002ab2b4 ebp = 0x002ab2c4 Found by: previous frame's frame pointer 2 mozjs.dll!js::LifoAlloc::alloc(unsigned int) [LifoAlloc.h:69369e7dad6c : 224 + 0x10] eip = 0x68bb7247 esp = 0x002ab2cc ebp = 0x002ab2d8 ebx = 0x0000001d Found by: call frame info 3 mozjs.dll!NewOrRecycledNode [jsparse.cpp:69369e7dad6c : 671 + 0xc] ...

Whoops, the conditional was the wrong way around. We were just doing a ton of memsets for no raisin (hence the timeout).

Comment on attachment 566580 [details] [diff] [review] Swap "clobber" conditional. >+#ifdef DEBUG >+ /* Clobber the now-free space. */ >+ if (bump < prevBump) >+ memset(bump, 0xcd, limit - bump); >+#endif I know we release the LifoAlloc infrequently (compared to very-frequent bumps), but just to prevent possible future headache, it would be nice to only memset the range (prevBump - bump). Similarly, it would be nice to keep the clobbering when we grow by memseting (bump - prevBump).