Closed Bug 794947 Opened 12 years ago Closed 12 years ago

Today's nightly (9/27/12) is extremely crashy in GMail, fixed by disabling ionmonkey

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86_64
All
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla18
Tracking Flags:
Tracking Status
firefox18 - ---

People

(Reporter: bent.mozilla, Assigned: billm)

References

Details

(Keywords: crash)

Crash Data

Attachments

(1 file)

patch
(deleted), patch
billm
: review+
Details | Diff | Splinter Review
I'm running today's nightly build on windows (9/27/12, built from b038e9e2023f). I was going through my GMail by clicking on a message and then clicking the 'next message' button on the upper right. I'd be able to go through about five emails before crashing. Crash reports: bp-57e44689-5958-45ff-8fa9-306752120927 bp-3c1dabf1-7d17-4d3a-8a5a-dcd612120927 bp-8857347c-86c4-43e4-b74c-230cb2120927 bp-312c1676-5d9d-47a6-af03-c44d62120927 I set 'javascript.options.ion.content' to false and the crash no longer happens.
It's probably related to bug 794907. The regression range is: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=ca4af4af5334&tochange=b038e9e2023f It might be a regression from bug 790051.
Severity: normal → critical
Keywords: crash
The mac builds are also crashing for me when loading gmail. After restarting, my gmail pinned tab starts to load and immediately after the progress bar finishes and shows the list of messages, Nightly crashes. nightly build on os x 9/27/12 http://hg.mozilla.org/mozilla-central/rev/b038e9e2023f The crash reports are much less useful in finding this bug report though. Starting in safe mode doesn't crash and javascript.options.ion.content to false also doesn't crash. [@ @0x12cdcefb5 ] https://crash-stats.mozilla.com/report/index/bp-acedc214-a078-47a6-a259-f185b2120927 [@ @0x12becc7d5 ] https://crash-stats.mozilla.com/report/index/bp-0824dc54-997a-47fe-9d8a-a12df2120927 [@ @0x1057bd975 ] https://crash-stats.mozilla.com/report/index/bp-31614e7b-f731-4c8a-9623-04fc92120927 [@ @0x11e6cc125 ] https://crash-stats.mozilla.com/report/index/bp-a7b775aa-1de7-425c-b0c5-92e292120927 [@ @0x11e65a3b5 ] https://crash-stats.mozilla.com/report/index/bp-1707318e-9bdc-40e2-92c1-5cd062120927
OS: Windows 7 → All
Crashes on a new Nightly profile too: [@ @0x11b8ec71d ] https://crash-stats.mozilla.com/report/index/bp-10ffdd39-ec5a-49ec-907c-5e8652120927 However the first load of gmail worked fine. It only crashed after restarting Firefox.
Looking into this now.
Assignee: general → dvander
Status: NEW → ASSIGNED
This sounds like a regression from bug 787856. I probably missed a place in IonMonkey where we're using the proto of an object that might be a CCW.
I've also been crashing in gmail after updating, and disabling ionmonkey fixed it. However, the reports look different: bp-c83b0258-aab8-48b1-a032-8229d2120927 bp-94b0e120-dfea-4e48-aa9a-8fb172120927 bp-4a236cbb-56a3-4a42-bac9-12b072120927
Blocks: 787856
Crash Signature: [@ js::ObjectImpl::nativeLookup(JSContext*, int)] [@ JSObject::getGeneric(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<int>, JS::MutableHandle<JS::Value>)] [@ js::CrossCompartmentWrapper::call(JSContext*, JSObject*, unsigned int …
Crash Signature: JS::Value*)] → JS::Value*)] [@ js::baseops::LookupProperty] [@ PR_SetThreadPrivate | EnterIon]
Bill bisected this to verify comment #5
Assignee: dvander → wmccloskey
Attached patch patch (deleted) — — Splinter Review
This patch fixes the problem for me. I got an r+ from dvander at the office while the power was out. https://hg.mozilla.org/mozilla-central/rev/64558e8ed723
Attachment #665744 - Flags: review+
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla18
Flags: in-testsuite+
Everything seems to work great for me today, thanks for the quick work guys!
Depends on: 814177
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: