454602 - TM: Crash [@ FlushNativeStackFrame] on www.liberation.fr with jit content enabled

Status: VERIFIED WORKSFORME

(Core :: JavaScript Engine, defect, P1)

Description

[Jean-Marc Desperrier]

Trying to load the www.liberation.fr web site with jit content enabled crashes.

Repro steps :
- enable content jit
- load http://www.liberation.fr/actualite/monde/350947.FR.php?rss=true&xtor=RSS-450
- firefox/seamonkey crash

This seems very similar to bug 451963 and to bug 452554, but repro steps are even easier.
The main page of the site also crashes, but I selected some sub-page on the site as it's less likely to change later.

Crash stacks :
http://crash-stats.mozilla.com/report/index/ed0577cf-7f4f-11dd-9492-001cc45a2c28
http://crash-stats.mozilla.com/report/index/5d0c4497-7f51-11dd-a9ed-001cc4e2bf68
http://crash-stats.mozilla.com/report/index/43438968-7f51-11dd-aa7e-001a4bd43e5c

I'd like someone to test on mac to see if it gives the same stack trace as bug 451963 and bug 452554.

Comment 1

[Marcia Knous [:marcia]]

Here is my Mac crash after visiting that site: http://crash-stats.mozilla.com/report/index/8c54da23-7f74-11dd-bc71-001a4bd43ef6. 

I am using Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b1pre) Gecko/20080910020330 Minefield/3.1b1pre.

Comment 2

[Marcia Knous [:marcia]]

Another site that I hit that crashes 100% of the time in this stack is sprint.com (Mac and Windows).

Comment 4

[RFLazaro]

Using Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre) Gecko/20080924033412 Minefield/3.1b1pre

WORKS: http://www.liberation.fr/
WORKS: http://www.liberation.fr/actualite/monde/350947.FR.php?rss=true&xtor=RSS-450

CRASH: http://sprint.com
http://crash-stats.mozilla.com/report/index/8212665c-8a60-11dd-a6dc-001a4bd43ed6

Comment 5

[u88484]

(In reply to comment #4)
> Using Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre)
> Gecko/20080924033412 Minefield/3.1b1pre
> 
> WORKS: http://www.liberation.fr/
> WORKS:
> http://www.liberation.fr/actualite/monde/350947.FR.php?rss=true&xtor=RSS-450
> 
> CRASH: http://sprint.com
> http://crash-stats.mozilla.com/report/index/8212665c-8a60-11dd-a6dc-001a4bd43ed6

Same results.  That is weird since they were crashing at the same place.  Maybe something changed on liberation.fr then.

Comment 6

[Andreas Gal :gal]

Fixed in TM. Merge into m-c soon.

Comment 7

[Jean-Marc Desperrier]

I confirm that the Liberation case is solved and Sprint is not.

I did not react initially on Marcia's Sprint comment and had not seen supernova's change, but even if they externally look the same, there was nothing *proving* that the root cause of the supernova and the liberation crash was the same, bug 451963 and bug 452554 also had this stack but not exactly the same cross-platform behaviour and were not solved by the same check-ins. 
And it was not the same root cause since the current version only solves the liberation case and not the sprint. 
So everyone, before duping or merging bug case be careful that it won't hinder devs from checking if they really have the same root cause. 
There was no problem this time, but I've seen it occur with some bugs in the past.

Comment 8

[u88484]

I'm reopening bug 456403 until we can verify that it is actually fixed after TM is merged into the m-c.