460875 - Crash in [@ js_TraceObject] browsing around on Cars.com with |javascript.options.jit.content| set to true

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Stephen Donner [:stephend] Not actively reading bugmail]

See http://crash-stats.mozilla.com/report/index/1f1ea68a-9eff-11dd-a8e8-001a4bd43ed6.

Summary: Crash in js_TraceObject browsing around on Cars.com with |javascript.options.jit.content| set to true

Steps to Reproduce:

1. With JIT for content enabled, load any car URL, such as http://www.cars.com/go/search/detail.jsp;?tracktype=usedcc&searchType=21&pageNumber=0&numResultsPerPage=50&largeNumResultsPerPage=0&sortorder=descending&sortfield=PRICE+descending&certifiedOnly=false&criteria=K-|E-|M-_1_|D-_7070_|N-N|R-30|I-1%2c7|P-PRICE+descending|Q-descending|Z-94086&aff=national&paId=291944052&recnum=1&leadExists=true
2. Click around the top tabs, and, if necessary, the photo galleries.

Stack:

0  	js3250.dll  	js_TraceObject  	 js/src/jsobj.cpp:5259
1 	js3250.dll 	JS_TraceChildren 	js/src/jsgc.cpp:2366
2 	js3250.dll 	js_TraceObject 	js/src/jsobj.cpp:5225
3 	js3250.dll 	JS_TraceChildren 	js/src/jsgc.cpp:2366
4 	js3250.dll 	js_TraceObject 	js/src/jsobj.cpp:5259
5 	js3250.dll 	JS_TraceChildren 	js/src/jsgc.cpp:2366
6 	js3250.dll 	js_TraceObject 	js/src/jsobj.cpp:5259
7 	js3250.dll 	JS_TraceChildren 	js/src/jsgc.cpp:2366
8 	js3250.dll 	JS_CallTracer 	js/src/jsgc.cpp:2642
9 	js3250.dll 	gc_root_traversal 	js/src/jsgc.cpp:2746
10 	js3250.dll 	JS_DHashTableEnumerate 	js/src/jsdhash.cpp:724
11 	js3250.dll 	js_TraceRuntime 	js/src/jsgc.cpp:3015
12 	js3250.dll 	js_GC 	js/src/jsgc.cpp:3415
13 	js3250.dll 	js_DestroyContext 	js/src/jscntxt.cpp:462
14 	js3250.dll 	JS_DestroyContext 	js/src/jsapi.cpp:1059
15 	xul.dll 	xul.dll@0x2b4d1d

Comment 1

[RFLazaro]

I can't replicate the crash on Windows XP using Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b2pre) Gecko/20081021 Minefield/3.1b2pre 20081021033447

Comment 2

[Marcia Knous [:marcia]]

I see the crash on mac as well, http://crash-stats.mozilla.com/report/index/fe6f49a8-a04d-11dd-95b7-001a4bd43ed6. The interesting part is the stack is slightly different each time I crash.

Comment 3

[Andreas Gal :gal]

Potentially related: https://bugzilla.mozilla.org/show_bug.cgi?id=461274

I suggest doing that bug first and see if this still happens. I am grabbing the other one with danderson.

Comment 4

[Andreas Gal :gal]

I am not able to reproduce this crash on TM tip. I will try mc nightly.

Comment 5

[Andreas Gal :gal]

I am not able to reproduce this with a MC nightly either. Since the report is from yesterday this is unlikely to be fixed in MC or TM. I just can't seem to be able to trigger it.

Comment 6

[Brendan Eich [:brendan]]

Major sleuthing, thanks to stephend and danderson, shows this a dup of bug 458851. Making a dependent of that bug for now.

/be

Comment 7

[Stephen Donner [:stephend] Not actively reading bugmail]

While I don't want to prematurely close this bug as FIXED, it certainly works for me now that things have been landing over in bug 458851.

Comment 8

[Brendan Eich [:brendan]]

stephend: are you testing tracemonkey or mozilla-central? If tracemonkey, then yes, the patch for bug 458851 definitely fixed this bug.

/be

Comment 9

[Brendan Eich [:brendan]]

IOW, the last sync between tm and m-c was just before bug 458851 was fixed in tm. We should sync again soon.

/be

Comment 10

[Stephen Donner [:stephend] Not actively reading bugmail]

(In reply to comment #8)
> stephend: are you testing tracemonkey or mozilla-central? If tracemonkey, then
> yes, the patch for bug 458851 definitely fixed this bug.
> 
> /be

mozilla-central, oddly enough; Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1b2pre) Gecko/20081029 Minefield/3.1b2pre is just fine...

Comment 11

[Stephen Donner [:stephend] Not actively reading bugmail]

This is fixed, whether by bug 458851 or some collateral fix; Brendan or Andreas: what's the right resolution to this?  Fixed, or a dupe?

Comment 12

[Brendan Eich [:brendan]]

We debugged a js_TraceObject crash that was due to bug 458851. If m-c does not have that bug's patch yet, then I don't know what else could have fixed the crash (but maybe your luck turned, and will turn back ;-).

/be

Comment 13

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED with Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1b2pre) Gecko/20081110 Minefield/3.1b2pre