Closed Bug 462219 Opened 17 years ago Closed 17 years ago

TM: Crash trying to log in at any vBulletin based forum when JIT content is enabled

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 461974

People

(Reporter: martijn.martijn, Unassigned)

References

(
URL
)

Details

(Keywords: crash)

Follow-up from bug 462188. Steps to reproduce: 1. Visit sandbox forum of vBulletin site in URL field above (note it seems that all websites using vBulletin appear to be affected by this regression. I've tested four that I know of.) 2. Log in with the credentials Username: "Test for Firefox" Password: "password" 3. Click the "New Thread" button Result: crash in current trunk build when JIT is enabled. Without content JIT enabled, it doesn't happen. http://crash-stats.mozilla.com/report/index/02b26173-a5eb-11dd-83e8-001cc45a2ce4 0 @0x3751cd8 1 @0x248fbff 2 js3250.dll js3250.dll@0x8af72 http://crash-stats.mozilla.com/report/pending/69bb3d5c-a5f8-11dd-8bac-001cc45a2c28
I can't even get that far. Crashes for me on Linux right at login. bp-1b9690c7-a5fc-11dd-81a1-001a4bd43e5c
Flags: blocking1.9.1?
OS: Windows XP → All
Hardware: PC → All
Either there's actually 2 different crashes here or I'm just getting a better stack: 0 @0xaf9fdcbc 1 libmozjs.so libmozjs.so@0x1dff 2 libmozjs.so js_MonitorLoopEdge js/src/jstracer.cpp:2916 3 libmozjs.so js_Interpret js/src/jsinterp.cpp:3702 4 libmozjs.so js_Invoke js/src/jsinvoke.cpp:1324 5 libmozjs.so js_InternalInvoke js/src/jsinvoke.cpp:1381 6 libmozjs.so JS_CallFunctionValue js/src/jsapi.cpp:5235 7 libxul.so nsJSContext::CallEventHandler dom/src/base/nsJSEnvironment.cpp:1985 8 libxul.so nsJSEventListener::HandleEvent dom/src/events/nsJSEventListener.cpp:247 9 libxul.so nsEventListenerManager::HandleEventSubType content/events/src/nsEventListenerManager.cpp:1091 10 libxul.so nsEventListenerManager::HandleEvent content/events/src/nsEventListenerManager.cpp:1196 11 libxul.so nsEventTargetChainItem::HandleEvent content/events/src/nsEventDispatcher.cpp:236 12 libxul.so nsEventTargetChainItem::HandleEventTargetChain content/events/src/nsEventDispatcher.cpp:300 13 libxul.so nsEventDispatcher::Dispatch content/events/src/nsEventDispatcher.cpp:514 14 libxul.so PresShell::HandleDOMEventWithTarget layout/base/nsPresShell.cpp:5983 15 libxul.so nsHTMLInputElement::PostHandleEvent content/html/content/src/nsHTMLInputElement.cpp:1849 16 libxul.so nsEventTargetChainItem::PostHandleEvent content/events/src/nsEventDispatcher.cpp:248 17 libxul.so nsEventTargetChainItem::HandleEventTargetChain content/events/src/nsEventDispatcher.cpp:303 18 libxul.so nsEventTargetChainItem::HandleEventTargetChain content/events/src/nsEventDispatcher.cpp:354 19 libxul.so nsEventDispatcher::Dispatch content/events/src/nsEventDispatcher.cpp:514 ... ... Always possible there's a crash on new thread and a completely different one on login. Here's another stack that differs after line 19: bp-ff491dbd-a5fb-11dd-ba9f-001321b13766
Crashing on login on Windows XP, this time: bp-41ae6868-a600-11dd-8c33-001cc45a2c28 bp-82b48cd4-a600-11dd-ab6c-001a4bd43ef6 I can't get past step 2 at all. Martijn, it doesn't crash for you on login but on clicking new thread?
Sorry, I gave the wrong info. Indeed, I also crash upon trying to log in. So step 3 should not exist.
Ah, ok. You just copied from bug 462188 comment 0 and left in an extra line. Anyone know why Windows apparently can't muster a stack trace but Linux doesn't seem to have a problem? (assuming the OSes don't crash at different points)
Summary: Crash trying to log in at vbulletin.com when JIT content is enabled → Crash trying to log in at any vBulletin based forum when JIT content is enabled
So I can reproduce this with an m-c build on Mac, but I get no useful stack: Program received signal EXC_BAD_ACCESS, Could not access memory. Reason: KERN_INVALID_ADDRESS at address: 0xfffffffc 0x0dbfcca7 in ?? () (gdb) bt #0 0x0dbfcca7 in ?? () #1 0x00000010 in ?? () Not useful... With a tracemonkey debug build, I don't crash.
Summary: Crash trying to log in at any vBulletin based forum when JIT content is enabled → TM: Crash trying to log in at any vBulletin based forum when JIT content is enabled
I think this might be bug 462020 which was duped to bug 461974. Maybe the fix just isn't in the nightly yet?
That fix isn't in the m-c nightlies, correct.
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1b2pre) Gecko/20081031 Minefield/3.1b2pre Crash is gone. Based on the stack here in comment 2 and the stack in bug 462020 comment 3 I'll mark this as a dupe.
Status: NEW → RESOLVED
Closed: 17 years ago
Flags: blocking1.9.1?
Resolution: --- → DUPLICATE
That, and the fact that bug 462020 is a crash on login into a vBulletin forum.
You need to log in before you can comment on or make changes to this bug.