462020 - TM: Crash when clicking "Log in" at Spoofee forums, with JIT enabled

Status: RESOLVED DUPLICATE of bug 461974

(Core :: JavaScript Engine, defect)

Description

[Daniel Holbert [:dholbert]]

STEPS TO REPRODUCE:
1. Visit URL ( http://www.spoofee.com/forums/ )
2. Enter 'abc' (or any text) in password box in upper-right corner.
    (you can enter a user name if you want -- it doesn't matter)
3. Press "Log In"

RESULTS: Immediate crash (happens before I see the "Log In" button pop back up, from being pressed down)

Crash goes away if I disable 'javascript.options.jit.content'.

Some crash IDs for this crash (all still being processed, as of right now):
14c0dcee-a524-11dd-bc05-001a4bd43ed6
8ee756e3-a524-11dd-a026-001a4bd43e5c
ad615a7a-a524-11dd-be6a-001cc45a2ce4
dd209d70-a524-11dd-aa1a-001cc45a2ce4

Comment 1

[Daniel Holbert [:dholbert]]

Build ID:
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1b2pre) Gecko/20081028 Minefield/3.1b2pre

Comment 2

[Daniel Holbert [:dholbert]]

(In reply to comment #0)
> 14c0dcee-a524-11dd-bc05-001a4bd43ed6
> 8ee756e3-a524-11dd-a026-001a4bd43e5c
> ad615a7a-a524-11dd-be6a-001cc45a2ce4
> dd209d70-a524-11dd-aa1a-001cc45a2ce4

Here's a link to a crash report (which just finished):
http://crash-stats.mozilla.com/report/index/dd209d70-a524-11dd-aa1a-001cc45a2ce4
The crashes have different signatures, but the stacks all look the same, with the crash happening in js_MonitorLoopEdge at js/src/jstracer.cpp:2916

Comment 3

[Matthias Versen [:Matti]]

Top of the stack:
0  	 	@0xb5b9bcbc  	
1 	libmozjs.so 	libmozjs.so@0x1dff 	
2 	libmozjs.so 	js_MonitorLoopEdge 	js/src/jstracer.cpp:2916
3 	libmozjs.so 	js_Interpret 	js/src/jsinterp.cpp:3702
4 	libmozjs.so 	js_Invoke 	js/src/jsinvoke.cpp:1324
5 	libmozjs.so 	js_InternalInvoke 	js/src/jsinvoke.cpp:1381
6 	libmozjs.so 	JS_CallFunctionValue 	js/src/jsapi.cpp:5235
7 	libxul.so 	nsJSContext::CallEventHandler 	dom/src/base/nsJSEnvironment.cpp:1985
8 	libxul.so 	nsJSEventListener::HandleEvent 	dom/src/events/nsJSEventListener.cpp:247
9 	libxul.so 	nsEventListenerManager::HandleEventSubType 	content/events/src/nsEventListenerManager.cpp:1091

Comment 5

[Matthias Versen [:Matti]]

sorry for duping in a circle