430536 - crash [@ JS_GetFunctionName]

Status: RESOLVED DUPLICATE of bug 425266

(Core :: JavaScript Engine, defect)

Description

[Mark]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9b5) Gecko/2008032619 Firefox/3.0b5
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9b5) Gecko/2008032619 Firefox/3.0b5

I just submitted a bug. I wanted to post some more information, which was pretty difficult: 1) amount of text that can be put in the textarea is too low; 2) I could not paste large amounts of text, in that case nothing happened, I was able to paste only small sentences from dmesg output; 3) I wanted to post more information via bugzilla, but the crashreporter didn't show me the bug ID and I couldn't find it on bugzilla.

I also found this in dmesg's output:

grsec: denied resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 for /usr/opt/firefox/crashreporter[crashreporter:14488] uid/euid:1000/1000 gid/egid:1000/1000, parent /sbin/init[init:1] uid/euid:0/0 gid/egid:0/0

Reproducible: Always

Steps to Reproduce:
1. Let FF3 beta 5 crash
2. Try to paste a large amount of text
3. Submit the report



The crash I submitted that contained some lines containing the word 'PAX', when FF 3 beta 5 segfaulted (logging out of gmail, trying to load a page while gmail is also active, loading gmail, or closing the browser while have gmail loaded), I got this via dmesg:

grsec: signal 11 sent to /usr/opt/firefox/firefox-bin[firefox-bin:27536] uid/euid:1000/1000 gid/egid:1000/1000, parent /usr/opt/firefox/run-mozilla.sh[run-mozilla.sh:27530] uid/euid:1000/1000 gid/egid:1000/1000

Comment 1

[timeless]

load about:crashes to get your crash id.

note that the server seems to be having issues, so just copy your id(s) here. we'll deal w/ them later.

Comment 2

[(not currently active) Ted Mielczarek]

The Crash Reporter doesn't submit bugs, it submits crash reports. Crash reports can be found at http://crash-stats.mozilla.com/, or you can get a list of reports you've submitted from about:crashes as timeless suggests. The comment field is intentionally limited to 500 bytes, pasting dmesg output there is not helpful to us.

Comment 3

[Mark]

97a4f63a-1170-11dd-b28c-001321b13766

Comment 4

[(not currently active) Ted Mielczarek]

0	libmozjs.so	JS_GetFunctionName	 mozilla/js/src/jsapi.c:4239
1	libxul.so	jsd_GetScriptFunctionName	mozilla/js/jsd/jsd_scpt.c:461
2	libxul.so	JSD_GetScriptFunctionName	mozilla/js/jsd/jsdebug.c:291
3	libxul.so	jsdScript::jsdScript	mozilla/js/jsd/jsd_xpc.cpp:992
4	libxul.so	jsdScript::FromPtr	mozilla/js/jsd/jsd_xpc.h:155
5	libxul.so	jsdService::EnumerateScripts	mozilla/js/jsd/jsd_xpc.cpp:2712
6	libxul.so	NS_GetXPTCallStub_P	
7	libxul.so	XPCWrappedNative::CallMethod	mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:2369
8	libxul.so	XPC_WN_CallMethod	mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp:1470
9	libmozjs.so	js_Invoke	mozilla/js/src/jsinvoke.c:1287
10	libmozjs.so	js_Interpret	mozilla/js/src/jsinterp.c:4841 

Looks like jsd is on the stack.

Comment 5

[Mike Shaver (:shaver emeritus)]

Believe this was fixed post-b5, by backing out the function/object unification patch.  Mark: can you test a nightly?