TM: Crash at loading page / transferring data [@ FlushNativeGlobalFrame]

RESOLVED WORKSFORME

Status

()

Core
JavaScript Engine
P1
critical
RESOLVED WORKSFORME
9 years ago
7 years ago

People

(Reporter: Alex Tayra, Assigned: Robert Sayre)

Tracking

({crash})

Trunk
x86
Windows XP
crash
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(crash signature, URL)

(Reporter)

Description

9 years ago
User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre) Gecko/20080831162801 Minefield/3.1b1pre
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre) Gecko/20080831162801 Minefield/3.1b1pre

Every time I try to visit http://habrahabr.ru/ Minefield crashes. FF3\2 works perfect.

Reproducible: Always

Steps to Reproduce:
1. Go to http://habrahabr.ru/

Actual Results:  
Crash

Expected Results:  
Open site correctly..

Tracemonkey enabled
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1a2pre) Gecko/20080901105930 Minefield/3.1b1pre

No problemo here.
>Tracemonkey enabled
Then test it without Tracemonkey before you write a bug report ?

And please create a Stack Trace :
http://developer.mozilla.org/en/docs/How_to_get_a_stacktrace_with_WinDbg

Comment 3

9 years ago
WFM both JIT enabled, no addons:
javascript.options.jit.chrome;true
javascript.options.jit.content;true

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre) Gecko/20080901033305 Minefield/3.1b1pre

WFM Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.17) Gecko/20080829 Firefox/2.0.0.17
WFM Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre) Gecko/20080902004913 SeaMonkey/2.0a1pre
(Reporter)

Comment 4

9 years ago
Yes, it works without JIT enabled. So it's tracemonkey bug..
(Reporter)

Updated

9 years ago
Version: unspecified → Trunk
Assignee: nobody → general
Component: General → JavaScript Engine
Product: Firefox → Core
QA Contact: general → general
Summary: Crash at loading page / tranfering data → TM: Crash at loading page / tranfering data

Comment 5

9 years ago
(In reply to comment #4)
> Yes, it works without JIT enabled. So it's tracemonkey bug..

WORKSFORME with JIT enabaled, see my comment #3

retested today using
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre) Gecko/20080906062345 Minefield/3.1b1pre

NPSWF32.dll     Shockwave Flash 9.0 r124

Where on that page are you crashing?

Does it always crash, and when does it crash, at start loading the page, or end loading the page, or following a link from that page?
Do you have extensions installed?
Do you automatically login at that page?

Comment 6

9 years ago
Using Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre) Gecko/20080908091724 Minefield/3.1b1pre

WORKS on JIT content DISABLED
CRASH on JIT Content ENABLED

Crash on loading page:
http://crash-stats.mozilla.com/report/index/293a6161-7e5f-11dd-8ab5-001cc45a2ce4
http://crash-stats.mozilla.com/report/index/a61ab9cf-7e5e-11dd-8dbc-0013211cbf8a
Summary: TM: Crash at loading page / tranfering data → TM: Crash at loading page / transferring data
(Assignee)

Comment 7

9 years ago
WFM

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre) Gecko/20080910043000 Minefield/3.1b1pre

I'll take this and reassign if need be.
Assignee: general → sayrer
Priority: -- → P1

Comment 8

9 years ago
Signature	FlushNativeGlobalFrame
UUID	293a6161-7e5f-11dd-8ab5-001cc45a2ce4
Time	2008-09-09 04:05:02-07
Uptime	149
Product	Firefox
Version	3.1b1pre
Build ID	20080908091724
OS	Windows NT
OS Version	5.1.2600 Service Pack 2
CPU	x86
CPU Info	GenuineIntel family 15 model 2 stepping 9
Crash Reason	EXCEPTION_ACCESS_VIOLATION
Crash Address	0x3
Comments	
Crashing Thread
Frame 	Module 	Signature [Expand] 	Source
0 	js3250.dll 	FlushNativeGlobalFrame 	js/src/jstracer.cpp:1158
1 	js3250.dll 	js_ExecuteTree 	js/src/jstracer.cpp:2391
2 	js3250.dll 	js_MonitorLoopEdge 	js/src/jstracer.cpp:2446
3 	js3250.dll 	js3250.dll@0x660a3 	
4 	js3250.dll 	js_Execute 	js/src/jsinterp.cpp:1552
5 	js3250.dll 	JS_EvaluateUCScriptForPrincipals 	js/src/jsapi.cpp:5018
6 	xul.dll 	nsJSContext::EvaluateString 	dom/src/base/nsJSEnvironment.cpp:1572
7 	xul.dll 	nsScriptLoader::EvaluateScript 	content/base/src/nsScriptLoader.cpp:594
8 	xul.dll 	nsScriptLoader::ProcessRequest 	content/base/src/nsScriptLoader.cpp:504
9 	xul.dll 	nsCOMArray_base::RemoveObject 	obj-firefox/xpcom/build/nsCOMArray.cpp:129
10 	xul.dll 	nsScriptLoader::ProcessPendingRequests 	content/base/src/nsScriptLoader.cpp:647
Keywords: crash
Summary: TM: Crash at loading page / transferring data → TM: Crash at loading page / transferring data [@ FlushNativeGlobalFrame]

Comment 9

9 years ago
Works for me. Could someone retest and confirm with a current build?

Updated

9 years ago
Status: UNCONFIRMED → RESOLVED
Last Resolved: 9 years ago
Resolution: --- → WORKSFORME
I'm crashing with  Mozilla/5.0 (Windows; U; Windows NT 6.0; rv:1.9.1b1pre) Gecko/20080922002657 SeaMonkey/2.0a1pre on the given URL.
bp-c41a1c23-88e9-11dd-bac0-001321b13766	 is the crash ID but the breakpad server is currently unhappy to show results.
Status: RESOLVED → UNCONFIRMED
Resolution: WORKSFORME → ---
Status: UNCONFIRMED → NEW
Ever confirmed: true

Comment 11

9 years ago
Could you try with this build:

ftp://ftp.mozilla.org/pub/firefox/tinderbox-builds/tracemonkey-win32/1222108770/firefox-3.1b1pre.en-US.win32.installer.exe
I used the .zip build and that one isn't crashing.
is that from a TM branch because that would explain that.

Comment 13

9 years ago
Yes, JIT development happens in the TM branch and we merge back into trunk on a regular basis. The next merge is coming up (24h or so). Thanks for testing the TM build.

Updated

9 years ago
Status: NEW → RESOLVED
Last Resolved: 9 years ago9 years ago
Resolution: --- → WORKSFORME
Crash Signature: [@ FlushNativeGlobalFrame]
You need to log in before you can comment on or make changes to this bug.