417819 - Applets crash the browser [@ ClaimTitle][@ JS_SetPrototype]

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Aravind Gottipati [:aravind]]

I am using the latest trunk in linux (debian sid).  I have the latest jdk from SUN (1.6.0_04-b12).  I have three addons installed (adblock plus, flashblock, dom inspector). The browser crashes instantly when I try any of the applets there with the addons enabled.

When I disable those three addons, I can get the applets to work sometimes, but it still crashes within a minute.  Here are the crash reports I submitted.

d840f661-dc19-11dc-814c-001a4bd43e5c
812f61ae-dc19-11dc-a1fd-001a4bd43ed6
feda11fd-dc15-11dc-9e4e-001a4bd43ed6

Comment 1

[Reed Loden [:reed]]

Not sure if this is a JS Engine issue or XPConnect or something else, but frames point to some JS code at least, so I'll send it there for starters.

Comment 2

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Latest crash id: bp-d840f661-dc19-11dc-814c-001a4bd43e5c

0  	ClaimTitle  	 mozilla/js/src/jslock.c:329
1 	js_LockTitle 	mozilla/js/src/jslock.c:1081
2 	js_LockObj 	mozilla/js/src/jslock.c:1241
3 	JS_SetPrototype 	mozilla/js/src/jsapi.c:2846
4 	nsHTMLPluginObjElementSH::PostCreate(nsIXPConnectWrappedNative*, JSContext*, JSObject*) 	mozilla/dom/src/base/nsDOMClassInfo.cpp:8834
5 	XPCWrappedNative::GetNewOrUsed(XPCCallContext&, nsISupports*, XPCWrappedNativeScope*, XPCNativeInterface*, int, XPCWrappedNative**) 	mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:537
6 	XPCWrappedNative::GetNewOrUsed(XPCCallContext&, nsISupports*, XPCWrappedNativeScope*, XPCNativeInterface*, int, XPCWrappedNative**) 	mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:407
7 	XPCConvert::NativeInterface2JSObject(XPCCallContext&, nsIXPConnectJSObjectHolder**, nsISupports*, nsID const*, JSObject*, int, int, unsigned int*) 	mozilla/js/src/xpconnect/src/xpcconvert.cpp:1106
8 	XPCConvert::NativeData2JS(XPCCallContext&, long*, void const*, nsXPTType const&, nsID const*, JSObject*, unsigned int*) 	mozilla/js/src/xpconnect/src/xpcconvert.cpp:479
9 	XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) 	mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:2424
10 	XPCWrappedNative::GetAttribute(XPCCallContext&) 	mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp:2225
11 	XPC_WN_GetterSetter(JSContext*, JSObject*, unsigned int, long*, long*) 	mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp:1502

Comment 3

[Brendan Eich [:brendan]]

Attachment: fix

Regression from patch for bug 408871 -- sorry about that!

/be

Comment 5

[Brendan Eich [:brendan]]

Comment on attachment 303627 [details] [diff] [review]
fix

shaver can r+ too, gotta get this in.

/be

Comment 6

[Brendan Eich [:brendan]]

Fixed:

js/src/jsapi.c 3.415

shaver, please review when you can.

/be

Comment 7

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Aravind, please check if this is fixed for you with the todays nightly build.

Comment 8

[Aravind Gottipati [:aravind]]

Nope, still crashed.  I did re-enabled my addons, not sure if that has something to do with this.  Here is the crash report bp-39e22af0-dca4-11dc-9838-001a4bd43e5c

Comment 9

[Aravind Gottipati [:aravind]]

(In reply to comment #8)
> Nope, still crashed.  I did re-enabled my addons, not sure if that has
> something to do with this.  Here is the crash report
> bp-39e22af0-dca4-11dc-9838-001a4bd43e5c
> 

Crashes even when all the extensions are disabled.

Comment 10

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

That looks like a different crash, something in the guts of the JVM.  Probably want a different bug to track that with Sun.

Comment 11

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

Comment on attachment 303627 [details] [diff] [review]
fix

r=shaver; this would have bit us when arrays landed, too.

Comment 12

[Aravind Gottipati [:aravind]]

Yeah, I tried jdk 1.4 and that seems to be working okay, so seems like this is a problem with the latest 1.6 jdks.  marking this fixed.

Comment 13

[Brendan Eich [:brendan]]

Aravind: could you please file a new bug on the 1.6 jdk crash? Maybe it's only a Sun bug, but we should track it somewhere.

/be

Comment 14

[Aravind Gottipati [:aravind]]

(In reply to comment #13)
> Aravind: could you please file a new bug on the 1.6 jdk crash? Maybe it's only
> a Sun bug, but we should track it somewhere.

Sure, filed bug 417996