463105 - TM: Firefox crash after a while with JIT enabled

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1b2pre) Gecko/20081104 Minefield/3.1b2pre
Build Identifier: 

After opening the testcase and waiting about 10 seconds, Firefox crashes

Reproducible: Always

Steps to Reproduce:
1. Open URL
2. Wait about 5-20 seconds
3.
Actual Results:  
Firefox crashes after a while


Happens only with JIT enabled (content). Tested both on Linux and Windows with last nightly build

Comment 1

[Jan de Mooij]

Crash report: http://crash-stats.mozilla.com/report/index/3b7ba600-aab6-11dd-9afd-001cc45a2c28

Frame  	Module  	Signature [Expand]  	Source
0 	js3250.dll 	JS_CallTracer 	js/src/jsgc.cpp:2604
1 	js3250.dll 	js_TraceObject 	js/src/jsobj.cpp:5249
2 	js3250.dll 	JS_TraceChildren 	js/src/jsgc.cpp:2366
3 	js3250.dll 	JS_CallTracer 	js/src/jsgc.cpp:2642
4 	js3250.dll 	js_TraceObject 	js/src/jsobj.cpp:5249
5 	js3250.dll 	JS_TraceChildren 	js/src/jsgc.cpp:2366
6 	js3250.dll 	JS_CallTracer 	js/src/jsgc.cpp:2642
7 	js3250.dll 	js_TraceObject 	js/src/jsobj.cpp:5249
8 	js3250.dll 	JS_TraceChildren 	js/src/jsgc.cpp:2366
9 	js3250.dll 	JS_CallTracer 	js/src/jsgc.cpp:2642
10 	js3250.dll 	js_TraceObject 	js/src/jsobj.cpp:5249
11 	js3250.dll 	JS_TraceChildren 	js/src/jsgc.cpp:2366
12 	js3250.dll 	JS_CallTracer 	js/src/jsgc.cpp:2642
13 	xul.dll 	XPC_WN_Shared_Trace 	js/src/xpconnect/src/xpcwrappednativejsops.cpp:705

Comment 2

[Jan de Mooij]

Attachment: testcase

Simple testcase. Warning: may crash your browser

Comment 3

[Andreas Gal :gal]

Confirmed with an older tracemonkey build. WFM with tracemonkey-tip. Will not close until we synced with central.