452052 - TM: Mibbit Crashes with JIT On [@ ... - ... - js_ExecuteTree]

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Ryan S. Scheel [:havvy]]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9) Gecko/2008052906 Firefox/3.0
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1a2pre) Gecko/20080824031931 Minefield/3.1a2pre

The Web-IRC client Mibbit which uses heavy AJAX and Javascript crashes with the new JIT features turned on.  The cause of this is unknown due to nobody spending time looking for the issue.  This crash ID link for this is http://crash-stats.mozilla.com/report/index/933b36d1-7290-11dd-8056-001cc45a2c28.

This here bug is more or less a crash in javascript, and needs to be fixed.  But without the needed data, it can't be fixed.  I've done as much as I can to get this bug known by you Mozilla developers with this bug.

Reproducible: Always

Steps to Reproduce:
1.  Turn on JIT in the about:config for websites.
2.  Goto http://mibbit.com
3.  Try visiting a channel you know of (no need to log on)
Actual Results:  
Firefox crashes.  :(

Expected Results:  
The server and channel should open up.

To make this bug even worse, it affects the Mibbit widget, though that was to be somewhat expected.  It's also a blocker for bug 435687 – Add Mibbit as a default IRC protocol web handler.

Comment 1

[Tobias Fischer]

I can confirm this crash using:
Build identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1a2pre) Gecko/20080825002620 Mnenhy/0.7.5.20005 SeaMonkey/2.0a1pre

With JIT content enabled SeaMonkey crashes when try to visit a channel. 

Comment 2

[Tobias Fischer]

Add an SeaMonkey-Crash: bp-85923575-729f-11dd-a073-001a4bd43e5c

The Signature is different to Firefox, SM crashes [@ jsd_FunctionCallHook ]
and the Firefox-Stack has Signature [@ @0x2683c89 ] so it might be better, to file a new Bug after a closer look into the Stacks. 

Comment 3

[timeless]

Signature	@0x2683c89
UUID	933b36d1-7290-11dd-8056-001cc45a2c28
Time	2008-08-25 03:15:39-07:00
Uptime	115
Product	Firefox
Version	3.1a2pre
Build ID	20080824031931
OS	Windows NT
OS Version	6.0.6001 Service Pack 1
CPU	x86
CPU Info	AuthenticAMD family 15 model 127 stepping 2
Crash Reason	EXCEPTION_ACCESS_VIOLATION
Crash Address	0x8
Comments	Has to do with JIT. Going to http://mibbit.com and try going to any working channel/server. Will try to get the owner of Mibbit to
0		@0x2683c89	
1		@0x4a82c9f	
2	js3250.dll	js_ExecuteTree	js/src/jstracer.cpp:1988
3	js3250.dll	js_LoopEdge	js/src/jstracer.cpp:2124
4	js3250.dll	js3250.dll@0x6c994	
5	js3250.dll	js_Invoke	js/src/jsinterp.cpp:1326
6	xul.dll	nsXPCWrappedJSClass::CallMethod	js/src/xpconnect/src/xpcwrappedjsclass.cpp:1523

Signature	jsd_FunctionCallHook
UUID	85923575-729f-11dd-a073-001a4bd43e5c
Time	2008-08-25 05:14:56-07:00
Uptime	26
Product	SeaMonkey
Version	2.0a1pre
Build ID	20080825002620
OS	Windows NT
OS Version	5.1.2600 Service Pack 3
CPU	x86
CPU Info	AuthenticAMD family 15 model 107 stepping 2
Crash Reason	EXCEPTION_ACCESS_VIOLATION
Crash Address	0x52
Comments	Crash at http://mibbit.com when try to open channel
0	jsd3250.dll	jsd_FunctionCallHook	js/jsd/jsd_step.c:283
1	js3250.dll	js_Interpret	js/src/jsinterp.cpp:2952
2	js3250.dll	js_Invoke	js/src/jsinterp.cpp:1326
3	xpc3250.dll	nsXPCWrappedJSClass::CallMethod	js/src/xpconnect/src/xpcwrappedjsclass.cpp:1523
4	xpc3250.dll	nsXPCWrappedJS::CallMethod	js/src/xpconnect/src/xpcwrappedjs.cpp:565
5	xpcom_core.dll	PrepareAndDispatch	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:114
6	xpcom_core.dll	SharedStub	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:141
7	gklayout.dll	nsPluginElement::GetDescription	dom/src/threads/nsDOMThreadService.cpp:214
8	gklayout.dll	nsEventListenerManager::HandleEventSubType	content/events/src/nsEventListenerManager.cpp:1076
9	gklayout.dll	nsEventListenerManager::HandleEvent	content/events/src/nsEventListenerManager.cpp:1181

I think the jsd one should be ignored...

Comment 4

[Andreas Gal :gal]

Tested with tracemonkey tip (tinderbox build). Please re-test and feel free to re-open if this still happens.