1183086 - crash in js::SavedStacks::saveCurrentStack(JSContext*, JS::MutableHandle<T>, unsigned int)

Status: RESOLVED DUPLICATE of bug 1174593

(Core :: Audio/Video, defect)

Description

[Robert Kaiser]

[Tracking Requested - why for this release]:

This bug was filed from the Socorro interface and is 
report bp-7acf3c70-ad02-414e-a045-5940b2150713.
=============================================================

Top Stack Frames:
0 	xul.dll 	js::SavedStacks::saveCurrentStack(JSContext*, JS::MutableHandle<js::SavedFrame*>, unsigned int) 	js/src/vm/SavedStacks.cpp
1 	xul.dll 	mozilla::dom::exceptions::JSStackFrame::CreateStack(JSContext*, int) 	dom/bindings/Exceptions.cpp
2 	xul.dll 	mozilla::dom::GetCurrentJSStack() 	dom/bindings/Exceptions.cpp
3 	mozglue.dll 	moz_xmalloc 	memory/mozalloc/mozalloc.cpp
4 	xul.dll 	mozilla::dom::DOMException::Create(nsresult, nsACString_internal const&) 	dom/base/DOMException.cpp
5 	xul.dll 	mozilla::dom::DetailedPromise::MaybeReject(nsresult, nsACString_internal const&) 	dom/media/eme/DetailedPromise.cpp
6 	xul.dll 	mozilla::dom::MediaKeySystemAccessManager::PendingRequest::RejectPromise(nsCString const&) 	dom/media/eme/MediaKeySystemAccessManager.cpp
7 	xul.dll 	mozilla::dom::MediaKeySystemAccessManager::Shutdown() 	dom/media/eme/MediaKeySystemAccessManager.cpp
8 	xul.dll 	mozilla::dom::Navigator::Invalidate() 	dom/base/Navigator.cpp
9 	xul.dll 	nsGlobalWindow::FreeInnerObjects() 	dom/base/nsGlobalWindow.cpp
10 	xul.dll 	nsGlobalWindow::SetNewDocument(nsIDocument*, nsISupports*, bool) 	dom/base/nsGlobalWindow.cpp
[...]

I'm filing this in Video/Audio because EME is on the stack and the URLs are all Netflix.

That said, the fact that we crash might be a JS issue, not sure.

This is happening with low volume in 39 and 40 beta, but has made a significant entry into in Dev Edition 41 on 2015-07-07. Because of that, requesting tracking only for 41.

For more reports and stats, click the link in the Crash Signature field on this bug.

Comment 1

[(Away)]

|compartment| is null at JS::CaptureCurrentStack. (The crash address, 0x88, is the offset of savedStacks_.creatingSavedFrame within a JSCompartment)

Interesting that Netflix seems to trigger this. Maybe whatever state caused the rejected promise is also responsible for the null compartment?

(Guessing on the needinfo; feel free to redirect)

Comment 2

[Bobby Holley (:bholley)]

Is this a dupe of bug 1174593?

Comment 3

[(Away)]

Yep.

Comment 4

[Kate Glazko]

Marked as a duplicated in 1174593, which is already fixed in 41.