271795 - crash [@ js_Interpret]

Status: RESOLVED INCOMPLETE

(Core :: JavaScript Engine, defect, P5)

Description

[timeless]

Incident ID: 2181824
Stack Signature	js_Interpret 1986791e
Product ID	MozillaTrunk
Build ID	2004112306
Trigger Time	2004-11-25 16:06:58.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	js3250.dll + (00021340)
URL visited	venkman alert
User Comments	
Since Last Crash	180393 sec
Total Uptime	188309 sec
Trigger Reason	Access violation
Source File, Line No.
c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 3447
Stack Trace 	
js_Interpret 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 3447]
js_Execute 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1519]
JS_ExecuteScript 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsapi.c, line
3595]
nsJSContext::ExecuteScript 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 1152]
nsXULDocument::ExecuteScript 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 3264]
nsXULDocument::LoadScript 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 3055]
nsXULDocument::ResumeWalk 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 2773]
nsXULDocument::CachedChromeStreamListener::OnStopRequest 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 4120]
nsDocumentOpenInfo::OnStopRequest 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/uriloader/base/nsURILoader.cpp,
line 360]
nsCachedChromeChannel::HandleStopLoadEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/rdf/chrome/src/nsChromeProtocolHandler.cpp,
line 477]
PL_HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/threads/plevent.c,
line 693]
PL_ProcessPendingEvents 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/threads/plevent.c,
line 631]
_md_EventReceiverProc 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/threads/plevent.c,
line 1434]
USER32.dll + 0x30494 (0x77d70494)
USER32.dll + 0x30494 (0x77d70494)
gkwidget.dll + 0x140d0 (0x605240d0)
gkwidget.dll + 0x13fec (0x60523fec)
USER32.dll + 0x30494 (0x77d70494)
USER32.dll + 0x30494 (0x77d70494)
gkwidget.dll + 0x143d5 (0x605243d5)
_except_handler3()
kernel32.dll + 0x399f3 (0x7c8399f3)

steps:
1. inspect domi with domi
2. open venkman
3. breakpoint the caller of "chrome://inspector/content/viewers/dom/dom.js Line:
829"]
4. click to select, click the "Document - DOM Nodes" item above the left pane.
5. collapse xul:toolbox
6. tunnel down xul:box to page/tree/xul:slider
7. delete that node.
8. you're now in venkman. welcome
9. command.doCommand2 = command.doCommand
10. command.doCommand = function doCommandWrapper () {try { this.doCommand(); }
catch (e) {this.ee=e; } }
/* yes this won't work, but i did it... and these are steps...*/
11. run.
12. run.
13. do steps 7-9
14. command.doCommand = function doCommandWrapper () {try { this.doCommand2(); }
catch (e) {this.ee=e; alert(this.ee) } }
15. step
16. you're now in doCommand (anonymous), below the wrapper, go up and set a
breakpoint on the alert.
17. run
18. you're now at the alert. too bad you can't inspect this.ee or e.
19. step a lot, you'll step through accessible, possibly infinitely
20. click step out when you're tired of accessible, you should reach the rest of
the commondialog setup.
21. click run. this is about when/how i crashed.

reproducable: haven't tried. want to eat turkey.

Comment 1

[Brendan Eich [:brendan]]

Why isn't this against jsd until proven otherwise?

/be

Comment 2

[timeless]

absolute lack of jsd in the stack.

Comment 3

[Brendan Eich [:brendan]]

So?  The debugger code could still cause a crash elsewhere.

Now that you've had turkey, can you cite the line number and maybe local state?

/be

Comment 4

[timeless]

sorry, this was a talkback enabled nightly, not my own build, you'll have to ask
jay or dbaron if talkback is to be trusted, the url i'm adding to the url field
should be it.

Comment 5

[Bob Clary [:bc] (inactive)]

-> timeless

Comment 6

[Brendan Eich [:brendan]]

Fx1-era bug -- WFM or INCOMPLETE at this point -- right?

/be