https://tbpl.mozilla.org/php/getParsedLog.php?id=18730372&tree=Mozilla-Inbound Rev3 Fedora 12x64 mozilla-inbound debug test mochitest-other on 2013-01-11 14:53:08 PST for push c4db97d21a09 slave: talos-r3-fed64-005 PROCESS-CRASH | chrome://mochitests/content/chrome/toolkit/content/tests/chrome/test_popup_button.xul | application crashed [@ JSString::writeBarrierPre(JSString*)] Crash dump filename: /tmp/tmpyehEyz/minidumps/25836a5b-24e9-9da2-34a33835-25edfc14.dmp Operating system: Linux 0.0.0 Linux 2.6.31.5-127.fc12.x86_64 #1 SMP Sat Nov 7 21:11:14 EST 2009 x86_64 CPU: amd64 family 6 model 23 stepping 10 2 CPUs Crash reason: SIGSEGV Crash address: 0x0 Thread 0 (crashed) 0 libxul.so!JSString::writeBarrierPre(JSString*) [String-inl.h : 73 + 0x0] rbx = 0x00007fecfef1b980 r12 = 0x000000000a74a150 r13 = 0x0000000000000000 r14 = 0x0000000002567770 r15 = 0x0000000008830240 rip = 0x00007fed643033d7 rsp = 0x00007fff1dc6caf0 rbp = 0x00007fff1dc6cb10 Found by: given as instruction pointer in context 1 libxul.so!js::RegExpCompartment::sweep(JSRuntime*) [Barrier-inl.h : 23 + 0x8] rbx = 0x00007fff1dc6cb50 r12 = 0x000000000a74a150 r13 = 0x0000000000000000 r14 = 0x0000000002567770 r15 = 0x0000000008830240 rip = 0x00007fed645a14ee rsp = 0x00007fff1dc6cb20 rbp = 0x00007fff1dc6cbd0 Found by: call frame info 2 libxul.so!JSCompartment::sweep(js::FreeOp*, bool) [jscompartment.cpp : 673 + 0xf] rbx = 0x000000000882fca0 r12 = 0x00007fff1dc6cce0 r13 = 0x0000000000000000 r14 = 0x0000000002567b38 r15 = 0x00000000000000f1 rip = 0x00007fed64357e32 rsp = 0x00007fff1dc6cbe0 rbp = 0x00007fff1dc6ccb0 Found by: call frame info 3 libxul.so!BeginSweepingCompartmentGroup [jsgc.cpp : 3431 + 0x11] rbx = 0x0000000002567b38 r12 = 0x0000000002567770 r13 = 0x00007fff1dc6cce0 r14 = 0x000000000882fca0 r15 = 0x00000000000000f1 rip = 0x00007fed6439e8d1 rsp = 0x00007fff1dc6ccc0 rbp = 0x00007fff1dc6cd20 Found by: call frame info 4 libxul.so!IncrementalCollectSlice [jsgc.cpp : 3583 + 0x7] rbx = 0x0000000002567770 r12 = 0x0000000000000000 r13 = 0x0000000000000002 r14 = 0x0000000000000002 r15 = 0x00007fff1dc6ce10 rip = 0x00007fed6439fae1 rsp = 0x00007fff1dc6cd30 rbp = 0x00007fff1dc6ce80 Found by: call frame info 5 libxul.so!GCCycle [jsgc.cpp : 4160 + 0x10] rbx = 0x0000000002567770 r12 = 0x0000000000009c40 r13 = 0x0000000000000019 r14 = 0x0000000000000000 r15 = 0x00007fff1dc6cea0 rip = 0x00007fed643a13a8 rsp = 0x00007fff1dc6ce90 rbp = 0x00007fff1dc6cee0 Found by: call frame info 6 libxul.so!Collect [jsgc.cpp : 4278 + 0x10] rbx = 0x0000000002567770 r12 = 0x0000000000000019 r13 = 0x0000000000000000 r14 = 0x0000000002567b38

I just hit the same crash in my own build (Linux x86_64, built from https://hg.mozilla.org/integration/mozilla-inbound/rev/80d6c2450333 plus local patches), while browsing: Program /home/dbaron/bin/running-firefox/firefox (pid = 7714) received signal 11. Stack: __restore_rt (sigaction.c:0) JSString::writeBarrierPre(JSString*) (/home/dbaron/builds/ssd/mozilla-central/mozilla/js/src/vm/String-inl.h:73) js_delete<js::RegExpShared> (/home/dbaron/builds/ssd/mozilla-central/obj/firefox-debugopt/js/src/./../../dist/include/js/Utility.h:506) js::RegExpCompartment::sweep(JSRuntime*) (/home/dbaron/builds/ssd/mozilla-central/mozilla/js/src/vm/RegExpObject.cpp:690) JSCompartment::sweep(js::FreeOp*, bool) (/home/dbaron/builds/ssd/mozilla-central/mozilla/js/src/jscompartment.cpp:675) BeginSweepingCompartmentGroup (/home/dbaron/builds/ssd/mozilla-central/mozilla/js/src/jsgc.cpp:3432) BeginSweepPhase (/home/dbaron/builds/ssd/mozilla-central/mozilla/js/src/jsgc.cpp:3525) GCCycle (/home/dbaron/builds/ssd/mozilla-central/mozilla/js/src/jsgc.cpp:4161) Collect (/home/dbaron/builds/ssd/mozilla-central/mozilla/js/src/jsgc.cpp:4280) js_InvokeOperationCallback(JSContext*) (/home/dbaron/builds/ssd/mozilla-central/mozilla/js/src/jscntxt.cpp:1117) js_HandleExecutionInterrupt(JSContext*) (/home/dbaron/builds/ssd/mozilla-central/mozilla/js/src/jscntxt.cpp:1134) js::mjit::stubs::Interrupt(js::VMFrame&, unsigned char*) (/home/dbaron/builds/ssd/mozilla-central/mozilla/js/src/methodjit/StubCalls.cpp:801) JaegerInterpoline (crtstuff.c:0) js::mjit::EnterMethodJIT(JSContext*, js::StackFrame*, void*, JS::Value*, bool) (/home/dbaron/builds/ssd/mozilla-central/mozilla/js/src/methodjit/MethodJIT.cpp:1041) CheckStackAndEnterMethodJIT (/home/dbaron/builds/ssd/mozilla-central/mozilla/js/src/methodjit/MethodJIT.cpp:1100) js::mjit::JaegerShot(JSContext*, bool) (/home/dbaron/builds/ssd/mozilla-central/mozilla/js/src/methodjit/MethodJIT.cpp:1118) js::RunScript(JSContext*, JS::Handle<JSScript*>, js::StackFrame*) (/home/dbaron/builds/ssd/mozilla-central/mozilla/js/src/jsinterp.cpp:345) js::InvokeKernel(JSContext*, JS::CallArgs, js::MaybeConstruct) (/home/dbaron/builds/ssd/mozilla-central/mozilla/js/src/jsinterp.cpp:406) js::CallArgsList::setInactive() (/home/dbaron/builds/ssd/mozilla-central/mozilla/js/src/vm/Stack.h:187) js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value*, JS::Value*) (/home/dbaron/builds/ssd/mozilla-central/mozilla/js/src/jsinterp.cpp:440) JS_CallFunctionValue(JSContext*, JSObject*, JS::Value, unsigned int, JS::Value*, JS::Value*) (/home/dbaron/builds/ssd/mozilla-central/mozilla/js/src/jsapi.cpp:5829) nsJSContext::CallEventHandler(nsISupports*, JSObject*, JSObject*, nsIArray*, nsIVariant**) (/home/dbaron/builds/ssd/mozilla-central/mozilla/dom/base/nsJSEnvironment.cpp:1937) nsGlobalWindow::RunTimeoutHandler(nsTimeout*, nsIScriptContext*) (/home/dbaron/builds/ssd/mozilla-central/mozilla/dom/base/nsGlobalWindow.cpp:9763) nsGlobalWindow::RunTimeout(nsTimeout*) (/home/dbaron/builds/ssd/mozilla-central/mozilla/dom/base/nsGlobalWindow.cpp:10008) nsGlobalWindow::TimerCallback(nsITimer*, void*) (/home/dbaron/builds/ssd/mozilla-central/mozilla/dom/base/nsGlobalWindow.cpp:10275) nsTimerImpl::Fire() (/home/dbaron/builds/ssd/mozilla-central/mozilla/xpcom/threads/nsTimerImpl.cpp:483) ~nsRefPtr (/home/dbaron/builds/ssd/mozilla-central/obj/firefox-debugopt/xpcom/threads/../../dist/include/nsAutoPtr.h:875) nsThread::ProcessNextEvent(bool, bool*) (/home/dbaron/builds/ssd/mozilla-central/mozilla/xpcom/threads/nsThread.cpp:627) NS_ProcessNextEvent_P(nsIThread*, bool) (/home/dbaron/builds/ssd/mozilla-central/obj/firefox-debugopt/xpcom/build/nsThreadUtils.cpp:238) mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) (/home/dbaron/builds/ssd/mozilla-central/mozilla/ipc/glue/MessagePump.cpp:117) MessageLoop::RunInternal() (/home/dbaron/builds/ssd/mozilla-central/mozilla/ipc/chromium/src/base/message_loop.cc:216) ~AutoRunState (/home/dbaron/builds/ssd/mozilla-central/mozilla/ipc/chromium/src/base/message_loop.cc:502) nsBaseAppShell::Run() (/home/dbaron/builds/ssd/mozilla-central/mozilla/widget/xpwidgets/nsBaseAppShell.cpp:165) nsAppStartup::Run() (/home/dbaron/builds/ssd/mozilla-central/mozilla/toolkit/components/startup/nsAppStartup.cpp:289) XREMain::XRE_mainRun() (/home/dbaron/builds/ssd/mozilla-central/mozilla/toolkit/xre/nsAppRunner.cpp:3827) XREMain::XRE_main(int, char**, nsXREAppData const*) (/home/dbaron/builds/ssd/mozilla-central/mozilla/toolkit/xre/nsAppRunner.cpp:3893) XRE_main (/home/dbaron/builds/ssd/mozilla-central/mozilla/toolkit/xre/nsAppRunner.cpp:4096) do_main (/home/dbaron/builds/ssd/mozilla-central/mozilla/browser/app/nsBrowserApp.cpp:195) ~ScopedLogging (/home/dbaron/builds/ssd/mozilla-central/mozilla/browser/app/nsBrowserApp.cpp:102) __libc_start_main (/build/buildd/eglibc-2.15/csu/libc-start.c:258) _start (/home/dbaron/bin/running-firefox/firefox)

bug 820124, bug 828567, bug 799252 seem like a potential causes of this regression, based on skimming checkin logs as somebody only minimally informed

This is Bug 826581. The patch originally landed was incorrect; the fix is pending review.

Yeah, updating my tree to after the backout of bug 820124 seems to have made this go away.