404655 - FoxyTunes crashes on latest trunk [@ js_LookupLocal]

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P2)

Description

[Steve England [:stevee]]

1. New profile, start firefox.
2. Install foxytunes from http://downloads.foxytunes.com/firefox/FoxyTunes_2.9.6.1.xpi
3. Restart firefox

No crash: 20071119_0736_firefox-3.0b2pre.en-US.win32
Crash: 20071119_0916_firefox-3.0b2pre.en-US.win32

Due to bug 398609

Comment 1

[Brian Crowder]

Thanks, Gavin.  For some reason I only had a "blocking-firefox3" selection available there.

Comment 2

[Steve England [:stevee]]

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9b2pre) Gecko/2007112205 Minefield/3.0b2pre

Still seeing this, even after the landing of bug 404499. I should have mentioned that another patch was also in the range I found - bug 399589.

Checkins to module PhoenixTinderbox between 2007-11-19 07:36 and 2007-11-19 09:15 : 
http://bonsai.mozilla.org/cvsquery.cgi?module=PhoenixTinderbox&date=explicit&mindate=1195486560&maxdate=1195492559

I submitted some breakpad crash reports with the nightly zip and a copy of dbghelp.dll in the dir (to make bp works on win2k) - but none have come through yet:

http://crash-stats.mozilla.com/report/index/b8a63347-991c-11dc-857a-001a4bd43ed6
http://crash-stats.mozilla.com/report/index/b6556fa1-991c-11dc-b48d-001a4bd43e5c
http://crash-stats.mozilla.com/report/index/b2563799-991c-11dc-a062-001a4bd43e5c
http://crash-stats.mozilla.com/report/index/af74d111-991c-11dc-b5cf-001a4bd43ef6
http://crash-stats.mozilla.com/report/index/ad071123-991c-11dc-9261-001a4bd43ef6

Comment 3

[Steve England [:stevee]]

UUID	b8a63347-991c-11dc-857a-001a4bd43ed6
Time	2007-11-22 09:02:10-08:00
Build ID	2007112205
OS	Windows NT
OS Version	5.0.2195 Service Pack 4
CPU	x86
CPU Info	AuthenticAMD family 6 model 8 stepping 1
Crash Reason	EXCEPTION_ACCESS_VIOLATION
Crash Address	0x8
Stack Traces
Stack of Crashing Thread
frame 	signature 	source
0 	js_LookupLocal 	mozilla/js/src/jsfun.c:2282
1 	BindNameToSlot 	mozilla/js/src/jsemit.c:1985
2 	EmitNameOp 	mozilla/js/src/jsemit.c:2238
3 	js_EmitTree 	mozilla/js/src/jsemit.c:6240
4 	js_EmitTree 	mozilla/js/src/jsemit.c:5692
5 	js_EmitTree 	mozilla/js/src/jsemit.c:5651
6 	js_EmitTree 	mozilla/js/src/jsemit.c:4142
7 	Statements 	mozilla/js/src/jsparse.c:1504
8 	js_CompileScript 	mozilla/js/src/jsparse.c:594
9 	JS_CompileUCScriptForPrincipals 	mozilla/js/src/jsapi.c:4447
10 	JS_EvaluateUCScriptForPrincipals 	mozilla/js/src/jsapi.c:4867
11 	JS_EvaluateScriptForPrincipals 	mozilla/js/src/jsapi.c:4836
12 	mozJSSubScriptLoader::LoadSubScript(unsigned short const*) 	mozilla/js/src/xpconnect/loader/mozJSSubScriptLoader.cpp:283
13 	NS_InvokeByIndex_P 	mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:101
14 	AutoJSSuspendRequest::SuspendRequest() 	mozilla/js/src/xpconnect/src/xpcprivate.h:3361
15 	XPCConvert::NativeInterface2JSObject(XPCCallContext&, nsIXPConnectJSObjectHolder**, nsISupports*, nsID const*, JSObject*, int, int, unsigned int*) 	mozilla/js/src/xpconnect/src/xpcconvert.cpp:1147

Comment 4

[Steve England [:stevee]]

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9b2pre) Gecko/2007120804 Minefield/3.0b2pre

I believe this now WFM, although I don't know when it did start working again.

Comment 5

[Steve England [:stevee]]

Still Crashes: 20071129_0151_firefox-3.0b2pre.en-US.win32
Now Works: 20071129_0655_firefox-3.0b2pre.en-US.win32

Checkins to module PhoenixTinderbox between 2007-11-29 01:51 and 2007-11-29 06:54 : 
http://bonsai.mozilla.org/cvsquery.cgi?module=PhoenixTinderbox&date=explicit&mindate=1196329860&maxdate=1196348099

Fixed by bug 404935.

I never know to marked such bugs FIXED or dupe of bug 404935, so I will leave that to someone else.

Comment 6

[Bob Clary [:bc] (inactive)]

Ok, I'll make the call. Fixed by  bug 404935 per Steve.

Comment 7

[Carsten Book [:Tomcat]]

verified per comment #5