456635 - TM: Crash in [@ isPromoteInt(nanojit::LIns*) ] when reading wsj article

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Marcia Knous [:marcia]]

Seen while running Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b1pre) Gecko/20080922020341 Minefield/3.1b1pre. Does not crash with JIT off. Might be a dupe but I could not find the exact stack.

http://crash-stats.mozilla.com/report/index/6513f6b3-86a5-11dd-97ff-001a4bd43e5c

Comment 1

[Matthias Versen [:Matti]]

0  	libmozjs.dylib  	isPromoteInt  	 js/src/jstracer.cpp:353
1 	libmozjs.dylib 	TraceRecorder::writeBack 	js/src/jstracer.cpp:1381
2 	libmozjs.dylib 	TraceRecorder::record_JSOP_CALL 	js/src/jstracer.cpp:4811
3 	libmozjs.dylib 	js_Interpret 	js/src/jsinterp.cpp:166
4 	libmozjs.dylib 	js_Invoke 	js/src/jsinvoke.cpp:1324
5 	libmozjs.dylib 	js_fun_apply 	js/src/jsfun.cpp:1731
6 	libmozjs.dylib 	js_Interpret 	js/src/jsinterp.cpp:4960
7 	libmozjs.dylib 	js_Execute 	js/src/jsinvoke.cpp:1550
8 	libmozjs.dylib 	JS_EvaluateUCScriptForPrincipals 	js/src/jsapi.cpp:5019
9 	XUL 	nsJSContext::EvaluateString 	dom/src/base/nsJSEnvironment.cpp:1574
10 	XUL 	nsScriptLoader::EvaluateScript 	content/base/src/nsScriptLoader.cpp:594
11 	XUL 	nsScriptLoader::ProcessRequest 	content/base/src/nsScriptLoader.cpp:504
12 	XUL 	nsScriptLoader::ProcessScriptElement 	content/base/src/nsScriptLoader.cpp:458

You could try todays build because we had a merge from the TM branch.

Comment 2

[Matthias Versen [:Matti]]

still crashing after the merge with (Windows; U; Windows NT 6.0; rv:1.9.1b1pre) Gecko/20080923002844 SeaMonkey/2.0a1pre

Comment 3

[Andreas Gal :gal]

WFM with TM tip. Will close when merged into m-c.