453193 - TM: Crash at loading page / transferring data [@ FlushNativeGlobalFrame]

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect, P1)

Description

[Alex Tayra]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre) Gecko/20080831162801 Minefield/3.1b1pre
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre) Gecko/20080831162801 Minefield/3.1b1pre

Every time I try to visit http://habrahabr.ru/ Minefield crashes. FF3\2 works perfect.

Reproducible: Always

Steps to Reproduce:
1. Go to http://habrahabr.ru/

Actual Results:  
Crash

Expected Results:  
Open site correctly..

Tracemonkey enabled

Comment 1

[Ria Klaassen (not reading all bugmail)]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1a2pre) Gecko/20080901105930 Minefield/3.1b1pre

No problemo here.

Comment 2

[Matthias Versen [:Matti]]

>Tracemonkey enabled
Then test it without Tracemonkey before you write a bug report ?

And please create a Stack Trace :
http://developer.mozilla.org/en/docs/How_to_get_a_stacktrace_with_WinDbg

Comment 3

[Hermann Schwab]

WFM both JIT enabled, no addons:
javascript.options.jit.chrome;true
javascript.options.jit.content;true

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre) Gecko/20080901033305 Minefield/3.1b1pre

WFM Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.17) Gecko/20080829 Firefox/2.0.0.17
WFM Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre) Gecko/20080902004913 SeaMonkey/2.0a1pre

Comment 4

[Alex Tayra]

Yes, it works without JIT enabled. So it's tracemonkey bug..

Comment 5

[Hermann Schwab]

(In reply to comment #4)
> Yes, it works without JIT enabled. So it's tracemonkey bug..

WORKSFORME with JIT enabaled, see my comment #3

retested today using
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre) Gecko/20080906062345 Minefield/3.1b1pre

NPSWF32.dll     Shockwave Flash 9.0 r124

Where on that page are you crashing?

Does it always crash, and when does it crash, at start loading the page, or end loading the page, or following a link from that page?
Do you have extensions installed?
Do you automatically login at that page?

Comment 6

[RFLazaro]

Using Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre) Gecko/20080908091724 Minefield/3.1b1pre

WORKS on JIT content DISABLED
CRASH on JIT Content ENABLED

Crash on loading page:
http://crash-stats.mozilla.com/report/index/293a6161-7e5f-11dd-8ab5-001cc45a2ce4
http://crash-stats.mozilla.com/report/index/a61ab9cf-7e5e-11dd-8dbc-0013211cbf8a

Comment 7

[Robert Sayre]

WFM

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre) Gecko/20080910043000 Minefield/3.1b1pre

I'll take this and reassign if need be.

Comment 8

[timeless]

Signature	FlushNativeGlobalFrame
UUID	293a6161-7e5f-11dd-8ab5-001cc45a2ce4
Time	2008-09-09 04:05:02-07
Uptime	149
Product	Firefox
Version	3.1b1pre
Build ID	20080908091724
OS	Windows NT
OS Version	5.1.2600 Service Pack 2
CPU	x86
CPU Info	GenuineIntel family 15 model 2 stepping 9
Crash Reason	EXCEPTION_ACCESS_VIOLATION
Crash Address	0x3
Comments	
Crashing Thread
Frame 	Module 	Signature [Expand] 	Source
0 	js3250.dll 	FlushNativeGlobalFrame 	js/src/jstracer.cpp:1158
1 	js3250.dll 	js_ExecuteTree 	js/src/jstracer.cpp:2391
2 	js3250.dll 	js_MonitorLoopEdge 	js/src/jstracer.cpp:2446
3 	js3250.dll 	js3250.dll@0x660a3 	
4 	js3250.dll 	js_Execute 	js/src/jsinterp.cpp:1552
5 	js3250.dll 	JS_EvaluateUCScriptForPrincipals 	js/src/jsapi.cpp:5018
6 	xul.dll 	nsJSContext::EvaluateString 	dom/src/base/nsJSEnvironment.cpp:1572
7 	xul.dll 	nsScriptLoader::EvaluateScript 	content/base/src/nsScriptLoader.cpp:594
8 	xul.dll 	nsScriptLoader::ProcessRequest 	content/base/src/nsScriptLoader.cpp:504
9 	xul.dll 	nsCOMArray_base::RemoveObject 	obj-firefox/xpcom/build/nsCOMArray.cpp:129
10 	xul.dll 	nsScriptLoader::ProcessPendingRequests 	content/base/src/nsScriptLoader.cpp:647

Comment 9

[Andreas Gal :gal]

Works for me. Could someone retest and confirm with a current build?

Comment 10

[Matthias Versen [:Matti]]

I'm crashing with  Mozilla/5.0 (Windows; U; Windows NT 6.0; rv:1.9.1b1pre) Gecko/20080922002657 SeaMonkey/2.0a1pre on the given URL.
bp-c41a1c23-88e9-11dd-bac0-001321b13766	 is the crash ID but the breakpad server is currently unhappy to show results.

Comment 11

[Andreas Gal :gal]

Could you try with this build:

ftp://ftp.mozilla.org/pub/firefox/tinderbox-builds/tracemonkey-win32/1222108770/firefox-3.1b1pre.en-US.win32.installer.exe

Comment 12

[Matthias Versen [:Matti]]

I used the .zip build and that one isn't crashing.
is that from a TM branch because that would explain that.

Comment 13

[Andreas Gal :gal]

Yes, JIT development happens in the TM branch and we merge back into trunk on a regular basis. The next merge is coming up (24h or so). Thanks for testing the TM build.