1026134 - crash in JSObject::changeProperty<int>(js::ExclusiveContext*, JS::Handle<JSObject*>, JS::Handle<js::Shape*>, unsigned int, unsigned int, bool (*)(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>...

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine: JIT, defect)

Description

[juan becerra [:juanb]]

This bug was filed from the Socorro interface and is 
report bp-e2d71c0b-be21-4d7d-b70f-a1d982140613.
=============================================================

This started appearing in Fx32 Aurora on 6/13, and it is mostly happening on XP. There are few dupes. Many of the reported URLs are http://www.t-mobile.hu/ 

More reports can be found here: https://crash-stats.mozilla.com/report/list?product=Firefox&signature=JSObject%3A%3AchangeProperty%3Cint%3E%28js%3A%3AExclusiveContext*%2C+JS%3A%3AHandle%3CJSObject*%3E%2C+JS%3A%3AHandle%3Cjs%3A%3AShape*%3E%2C+unsigned+int%2C+unsigned+int%2C+bool+%28*%29%28JSContext*%2C+JS%3A%3AHandle%3CJSObject*%3E%2C+JS%3A%3AHandle%3Cjsid%3E%2C+JS%3A%3AMutableHandle%3CJS%3A%3AValue%3E%29%2C+bool+%28*%29%28JSContext*%2C+JS%3A%3AHandle... 

This signature could be related to https://bugzilla.mozilla.org/show_bug.cgi?id=1024678

0 		@0x1251e36e 	
1 	mozjs.dll 	JSObject::changeProperty<0>(js::ExclusiveContext *,JS::Handle<JSObject *>,JS::Handle<js::Shape *>,unsigned int,unsigned int,bool (*)(JSContext *,JS::Handle<JSObject *>,JS::Handle<jsid>,JS::MutableHandle<JS::Value>),bool (*)(JSContext *,JS::Handle<JSObject *>,JS::Handle<jsid>,bool,JS::MutableHandle<JS::Value>)) 	js/src/vm/Shape.cpp
2 	mozjs.dll 	js::irregexp::ExecuteCode(JSContext *,js::jit::JitCode *,wchar_t const *,unsigned int,unsigned int,js::MatchPairs *) 	js/src/irregexp/RegExpEngine.cpp
3 	mozjs.dll 	ExecuteRegExpImpl 	js/src/builtin/RegExp.cpp
4 	mozjs.dll 	js::ExecuteRegExp(JSContext *,JS::Handle<JSObject *>,JS::Handle<JSString *>,js::MatchConduit &,js::RegExpStaticsUpdate) 	js/src/builtin/RegExp.cpp
5 	mozjs.dll 	regexp_exec_impl 	js/src/builtin/RegExp.cpp
6 	mozjs.dll 	regexp_exec_impl 	js/src/builtin/RegExp.cpp
7 		@0x100d7de4

Comment 1

[(Away)]

ILLEGAL_INSTRUCTION in JIT code doing things like: movsd   mmword ptr [esp+30h],xmm6

These ought to go away after bug 1024678 gets uplift approval.

Comment 2

[Jan de Mooij [:jandem]]

(In reply to David Major [:dmajor] from comment #1)
> ILLEGAL_INSTRUCTION in JIT code doing things like: movsd   mmword ptr
> [esp+30h],xmm6
> 
> These ought to go away after bug 1024678 gets uplift approval.

Yeah let's close this. I also don't see any crashes in the past 7 days for this crash signature URL.