453772 - TM: Browser crash on closing south park episode player [@ js_AttemptCompilation]

Status: RESOLVED INVALID

(Core :: JavaScript Engine, defect)

Description

[atkunal]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.1) Gecko/2008070208 Firefox/3.0.1
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.1) Gecko/2008070208 Firefox/3.0.1

Error seen twice with Firefox 3. If you open an episode in a new window on southparkstudios, once the episode is done playing, closing the newly opened window results in the entire browser getting closed.

Reproducible: Always

Steps to Reproduce:
1. Go to southparkstudios.com
2. Play any episode, let the whole thing play
3. Close the window in which the episode is playing
Actual Results:  
The entire browser closed.

Expected Results:  
Only that particular window should have closed.

Comment 1

[Matthias Versen [:Matti]]

read http://mversen.de/crash/

Comment 2

[juan becerra [:juanb]]

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b4pre) Gecko/20090410 Shiretoko/3.5b4pre
vm Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b4pre) Gecko/20090410 Shiretoko/3.5b4pre (.NET CLR 3.5.30729) with Flash 10.0 r22

I can reproduce the crash reliably using personal profile or new profiles, by just attempting to watch a full episode.

http://crash-stats.mozilla.com/report/index/6252e402-b1f1-4cb9-9cd3-33d242090409 (on Mac)
http://crash-stats.mozilla.com/report/index/08be8cce-137b-43d8-acb4-126c02090410 (on Windows)

Firefox 3.0.9pre seems to work.

Comment 3

[Matthias Versen [:Matti]]

0  	js3250.dll  	js_AttemptCompilation  	js/src/jstracer.cpp:556
1 	js3250.dll 	TraceRecorder::closeLoop 	js/src/jstracer.cpp:2663
2 	js3250.dll 	js_CloseLoop 	js/src/jstracer.cpp:3572
3 	js3250.dll 	js_RecordLoopEdge 	js/src/jstracer.cpp:3607
4 	js3250.dll 	js3250.dll@0x6b7bc 	

0  	libmozjs.dylib  	js_AttemptCompilation  	js/src/jstracer.cpp:556
1 	libmozjs.dylib 	TraceRecorder::closeLoop 	js/src/jstracer.cpp:2663
2 	libmozjs.dylib 	js_CloseLoop 	js/src/jstracer.cpp:3572
3 	libmozjs.dylib 	js_RecordLoopEdge 	js/src/jstracer.cpp:3607
4 	libmozjs.dylib 	js_MonitorLoopEdge 	js/src/jstracer.cpp:4234
5 	libmozjs.dylib 	js_Interpret 	js/src/jsinterp.cpp:3136
6 	libmozjs.dylib 	js_Execute 	js/src/jsinterp.cpp:1590
7 	libmozjs.dylib 	JS_EvaluateUCScriptForPrincipals 	js/src/jsapi.cpp:5109
8 	XUL 	nsJSContext::EvaluateString 	dom/src/base/nsJSEnvironment.cpp:1601
9 	XUL 	nsScriptLoader::EvaluateScript 	content/base/src/nsScriptLoader.cpp:686
10 	XUL 	nsScriptLoader::ProcessRequest 	content/base/src/nsScriptLoader.cpp:600
11 	XUL 	nsScriptLoader::ProcessScriptElement 	content/base/src/nsScriptLoader.cpp:554 


That is a crash in TM but the reporter is using Gecko1.9.0 without jit.
Either you are seeing a different crash or the stack is misleading.
Juan: Do you get the crash if you disable the jit

Comment 4

[juan becerra [:juanb]]

I used a the default settings, which have content jit enabled in Shiretoko. It looks to be a different bug than the one reported originally. When I disable content jit, I get no crash.

Comment 5

[Andreas Gal :gal]

We changed the underlying code a lot. I think this is invalid now.