452140 - TM: Crash after authenticating to Zimbra webmail, "Advanced (Ajax)" version, with Tracing turned on

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Bret Reckard]

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1a2pre) Gecko/20080825074258 Minefield/3.1a2pre

Steps:
1) Turn JIT on in about:config settings
2) Select "Advanced (Ajax)" presentation option
3) Authenticate to mail.mozilla.com with username and password
4) Browser authenticates to server and loads the web app.  
5) Browser crashes with no other user input

Same steps do not crash the browser with JIT turned off

Crash Report ID: cbd97b70-72e0-11dd-aebb-001a4bd43ed6

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

This looks like a crash in compiled code (when I hit this in my debugger, I get a corrupted stack).

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

We're crashing on a NULL dslots deref, brendan/shaver noticed that there's no shape guard in some GETPROP cases.

Comment 3

[Brendan Eich [:brendan]]

Attachment: proposed fix

Better to read the new version of the function without diffing. Let me excerpt that in a few.

/be

Comment 4

[Brendan Eich [:brendan]]

Comment on attachment 335624 [details] [diff] [review]
proposed fix

Better patch coming.

/be

Comment 5

[Brendan Eich [:brendan]]

Attachment: better, embed remote prototype as literal

Comment 6

[Mike Shaver (:shaver emeritus)]

Comment on attachment 335642 [details] [diff] [review]
better, embed remote prototype as literal

r=shaver with assertion of in-requestness and a bug filed for the FIXME.

Comment 7

[Brendan Eich [:brendan]]

Fixed on tracemonkey:

http://hg.mozilla.org/tracemonkey/index.cgi/rev/18d1c1eda9aa

Waiting for green after my flamethrower practice before landing on m-c.

/be

Comment 8

[Brendan Eich [:brendan]]

Fixed on mozilla-central:

http://hg.mozilla.org/mozilla-central/index.cgi/rev/dc4ae0b32c4d

/be

Comment 9

[Bret Reckard]

My Zimbra is back and happily tracing.  Thanks!