Closed Bug 882433 Opened 11 years ago Closed 11 years ago

crash in js::ion::InlineFrameIteratorMaybeGC

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Version:
24 Branch
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 883973
Tracking Flags:
Tracking Status
firefox23 --- unaffected
firefox24 --- affected

People

(Reporter: scoobidiver, Unassigned)

References

(
URL
)

Details

(4 keywords)

Crash Data

It's currently #2 top crasher in 24.0a1/20130612 and first showed up in this build. The regression range is: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=86413e921d5d&tochange=0414d6d0f60d I think it's a regression from bug 859609. Signature js::ion::InlineFrameIteratorMaybeGC<int>::findNextFrame() More Reports Search UUID 7c471cb8-c80c-44cb-86e2-ecfd72130612 Date Processed 2013-06-12 19:03:23 Uptime 677 Last Crash 3.6 days before submission Install Age 2.3 hours since version was first installed. Install Time 2013-06-12 16:45:29 Product Firefox Version 24.0a1 Build ID 20130612031138 Release Channel nightly OS Windows NT OS Version 6.1.7601 Service Pack 1 Build Architecture x86 Build Architecture Info GenuineIntel family 6 model 23 stepping 10 Crash Reason EXCEPTION_ACCESS_VIOLATION_READ Crash Address 0xffffffffffffff95 User Comments Crashed on google maps after getting directions App Notes AdapterVendorID: 0x10de, AdapterDeviceID: 0x1244, AdapterSubsysID: 15563842, AdapterDriverVersion: 9.18.13.1422 D2D? D2D+ DWrite? DWrite+ D3D10 Layers? D3D10 Layers+ Processor Notes sp-processor01_phx1_mozilla_com_14226:2012 EMCheckCompatibility True Adapter Vendor ID 0x10de Adapter Device ID 0x1244 Total Virtual Memory 4294836224 Available Virtual Memory 3567226880 System Memory Use Percentage 27 Available Page File 10941681664 Available Physical Memory 4671070208 Frame Module Signature Source 0 mozjs.dll js::ion::InlineFrameIteratorMaybeGC<1>::findNextFrame js/src/ion/IonFrames.cpp:1270 1 mozjs.dll js::ion::InlineFrameIteratorMaybeGC<1>::InlineFrameIteratorMaybeGC<1> js/src/ion/IonFrameIterator-inl.h:64 2 mozjs.dll js::ion::GetPcScript js/src/ion/IonFrames.cpp:1019 3 mozjs.dll js::GetPropertyHelper js/src/jsobj.cpp:4008 4 mozjs.dll js::ion::GetPropertyIC::update js/src/ion/IonCaches.cpp:1513 5 mozjs.dll js_math_round js/src/jsmath.cpp:664 6 @0x1b8da9d0 More reports at: https://crash-stats.mozilla.com/report/list?signature=js%3A%3Aion%3A%3AInlineFrameIteratorMaybeGC%3Cint%3E%3A%3AfindNextFrame%28%29
More reports also at: https://crash-stats.mozilla.com/report/list?signature=js%3A%3Aion%3A%3AInlineFrameIteratorMaybeGC%3C%28js%3A%3AAllowGC%291%3E%3A%3AfindNextFrame%28%29
Crash Signature: [@ js::ion::InlineFrameIteratorMaybeGC<int>::findNextFrame()] → [@ js::ion::InlineFrameIteratorMaybeGC<int>::findNextFrame()] [@ js::ion::InlineFrameIteratorMaybeGC<(js::AllowGC)1>::findNextFrame() ]
OS: Windows 7 → All
Hardware: x86 → All
Crash Signature: [@ js::ion::InlineFrameIteratorMaybeGC<int>::findNextFrame()] [@ js::ion::InlineFrameIteratorMaybeGC<(js::AllowGC)1>::findNextFrame() ] → [@ js::ion::InlineFrameIteratorMaybeGC<int>::findNextFrame()] [@ js::ion::InlineFrameIteratorMaybeGC<(js::AllowGC)1>::findNextFrame() ] [@ js::ion::SnapshotReader::readSlot() ]
Crash Signature: [@ js::ion::InlineFrameIteratorMaybeGC<int>::findNextFrame()] [@ js::ion::InlineFrameIteratorMaybeGC<(js::AllowGC)1>::findNextFrame() ] [@ js::ion::SnapshotReader::readSlot() ] → [@ js::ion::InlineFrameIteratorMaybeGC<int>::findNextFrame()] [@ js::ion::InlineFrameIteratorMaybeGC<(js::AllowGC)1>::findNextFrame() ] [@ js::ion::SnapshotReader::readSlot() ] [@ js::ion::CompactBufferReader::readSigned() ]
Kannan can you please help with investigation here given this is a reproducible topcrash and may be a regression from bug 859609 ?
Flags: needinfo?(kvijayan)
I have a pressing issue with another s-c bug to deal with, but I can look at this later today.
Flags: needinfo?(kvijayan)
(In reply to Robert Kaiser (:kairo@mozilla.com) [away until early June] from comment #4) > Is > https://crash-stats.mozilla.com/report/ > list?signature=js%3A%3Aion%3A%3ASnapshotIterator%3A%3AslotValue%28js%3A%3Aion > %3A%3ASnapshotReader%3A%3ASlot%20const%26%29 the same issue? It's bug 883562.
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → DUPLICATE
Crash Signature: [@ js::ion::InlineFrameIteratorMaybeGC<int>::findNextFrame()] [@ js::ion::InlineFrameIteratorMaybeGC<(js::AllowGC)1>::findNextFrame() ] [@ js::ion::SnapshotReader::readSlot() ] [@ js::ion::CompactBufferReader::readSigned() ] → [@ js::ion::InlineFrameIteratorMaybeGC<int>::findNextFrame()] [@ js::ion::InlineFrameIteratorMaybeGC<(js::AllowGC)1>::findNextFrame() ] [@ js::ion::SnapshotReader::readSlot() ] [@ js::ion::CompactBufferReader::readSigned() ] [@ js::GetPropertyHelper(J…
tracked in duped of bug
tracking-firefox24: + → ---
You need to log in before you can comment on or make changes to this bug.