470485 - TM: Firefox 3.1b2 crash [@ nanojit::LirBufWriter::insImm(int) ]

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect, P2)

Description

[chris hofmann]

crash with this stack trace currently ranks #3 in the top crash list for fx3.1b2

windodws version of the stacktrace looks like

0  	js3250.dll  	nanojit::LirBufWriter::insImm  	js/src/nanojit/LIR.cpp:434
1 	js3250.dll 	nanojit::CseFilter::insImm 	js/src/nanojit/LIR.cpp:1901
2 	js3250.dll 	js3250.dll@0xac773

Mac version looks like

0  	libmozjs.dylib  	nanojit::LirBufWriter::insImm  	js/src/nanojit/LIR.cpp:614
1 	libmozjs.dylib 	nanojit::CseFilter::insImm 	js/src/nanojit/LIR.cpp:1901
2 	libmozjs.dylib 	nanojit::LirWriter::insLoad 	js/src/nanojit/LIR.cpp:970
3 	libmozjs.dylib 	TraceRecorder::test_property_cache 	js/src/jstracer.cpp:4848
4 	libmozjs.dylib 	TraceRecorder::prop 	js/src/jstracer.cpp:6550
5 	libmozjs.dylib 	TraceRecorder::getProp 	js/src/jstracer.cpp:6681
6 	libmozjs.dylib 	TraceRecorder::getProp 	js/src/jstracer.cpp:6696
7 	libmozjs.dylib 	TraceRecorder::record_JSOP_GETPROP 	js/src/jstracer.cpp:6112
8 	libmozjs.dylib 	js_Interpret 	js/src/jsinterp.cpp:170
9 	libmozjs.dylib 	js_Execute 	js/src/jsinvoke.cpp:1559
10 	libmozjs.dylib 	JS_EvaluateUCScriptForPrincipals 	js/src/jsapi.cpp:5187
11 	XUL 	nsJSContext::EvaluateString 	dom/src/base/nsJSEnvironment.cpp:1586
12 	XUL 	nsScriptLoader::EvaluateScript 	content/base/src/nsScriptLoader.cpp:665
13 	XUL 	nsScriptLoader::ProcessRequest 	content/base/src/nsScriptLoader.cpp:579
14 	XUL 	nsScriptLoader::ProcessScriptElement 	content/base/src/nsScriptLoader.cpp:533
15 	XUL 	nsScriptElement::MaybeProcessScript 	content/base/src/nsScriptElement.cpp:188
16 	XUL 	nsHTMLScriptElement::MaybeProcessScript 	content/html/content/src/nsHTMLScriptElement.cpp:548
17 	XUL 	HTMLContentSink::ProcessSCRIPTEndTag 	content/html/document/src/nsHTMLContentSink.cpp:3134
18 	XUL 	SinkContext::CloseContainer 	content/html/document/src/nsHTMLContentSink.cpp:1020
19 	XUL 	HTMLContentSink::CloseContainer 	content/html/document/src/nsHTMLContentSink.cpp:2385
20 	XUL 	CNavDTD::CloseContainer 	parser/htmlparser/src/CNavDTD.cpp:2800
21 	XUL 	CNavDTD::HandleEndToken 	parser/htmlparser/src/CNavDTD.cpp:1679
22 	XUL 	CNavDTD::HandleToken 	parser/htmlparser/src/CNavDTD.cpp:760
23 	XUL 	CNavDTD::BuildModel 	parser/htmlparser/src/CNavDTD.cpp:332
24 	XUL 	nsParser::BuildModel 	parser/htmlparser/src/nsParser.cpp:2352
25 	XUL 	nsParser::ResumeParse 	parser/htmlparser/src/nsParser.cpp:2221
26 	XUL 	nsParser::ContinueInterruptedParsing 	parser/htmlparser/src/nsParser.cpp:1728
27 	XUL 	nsRunnableMethod<nsContentSink>::Run 	content/base/src/nsContentSink.cpp:264
28 	XUL 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:510
29 	XUL 	NS_ProcessPendingEvents_P 	nsThreadUtils.cpp:180
30 	XUL 	nsBaseAppShell::NativeEventCallback 	widget/src/xpwidgets/nsBaseAppShell.cpp:121
31 	XUL 	nsAppShell::ProcessGeckoEvents 	widget/src/cocoa/nsAppShell.mm:373
32 	CoreFoundation 	CoreFoundation@0x735f4 	
33 	CoreFoundation 	CoreFoundation@0x73cd7 	
34 	HIToolbox 	HIToolbox@0x302bf 	
35 	HIToolbox 	HIToolbox@0x300d8 	
36 	HIToolbox 	HIToolbox@0x2ff4c 	
37 	AppKit 	AppKit@0x40d7c 	
38 	AppKit 	AppKit@0x4062f 	
39 	JavaEmbeddingPlugin 	-[MyNSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] 	Controller.m:205
40 	AppKit 	AppKit@0x3966a 	
41 	XUL 	nsAppShell::Run 	widget/src/cocoa/nsAppShell.mm:692
42 	XUL 	nsAppStartup::Run 	toolkit/components/startup/src/nsAppStartup.cpp:192
43 	XUL 	XRE_main 	toolkit/xre/nsAppRunner.cpp:3264
44 	firefox-bin 	main 	browser/app/nsBrowserApp.cpp:156
45 	firefox-bin 	_start 	
46 	firefox-bin 	start 	
47 		@0x1

the top of the stacks in bug 456981 look similar, but maybe this problem is different or has morfed.

not many comments to go on:

* Crashes when I click the first Google result for kmplayer, pretty sure it's only when Adblock is enabled.

* Assim que cliquei para execuar um vídeo da Tv Uol (tv.uol.com.br) o FF fechou e aparaceu essa janela do Crash reporter

* Mozilla stürzt immer bei softonic.de ab!

Comment 1

[Martijn Wargers (dead)]

Isn't this a duplicate of bug 467007?

Comment 2

[Andreas Gal :gal]

This is really old. 462027 might be a dup indeed, thats a good guess. Does this still show up in our top crashes?

Comment 3

[Mike Beltzner [:beltzner, not reading bugmail]]

Blocking, though the resolution might be a dupe. Chofmann: got an answer for Andreas in comment #2?

Comment 4

[Andreas Gal :gal]

Is there any chance to get a test case for this? If we make bugs without test case blockers it will be hard to close them.

Comment 5

[Martijn Wargers (dead)]

Isn't this bug 467007 then?

Comment 6

[chris hofmann]

server problems make it hard to do much widespread analysis to see where or
where we might not be crashing right now.   The best I could do is to see that
we got 6 crashes with this stack signature in the last hour, and all those
users were running beta2.  That might indicate it's been fixed by another
patch, but the sample size is really small.   getting beta 3 out will confirm. 
I'd say give this the minus, and we can re-eval when we do analysis on beta3.

Comment 7

[Andreas Gal :gal]

Ok, chris want to assign the bug to yourself then and close or request blocking depending on b3 data once available? I suggest removing blocking until then, but let beltzner do that if he agrees.

Comment 8

[chris hofmann]

re: comment 7:

sounds like a plan.

Comment 9

[Robert Sayre]

I don't see this in b3.