470607 - TM: crash [@ fastcopy_I]

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[(mostly gone) XtC4UaLL [:xtc4uall]]

load given url -> crash.
disabling JIT helps.
maybe latest TM merge into both repos is related?!

Shiretoko/3.1b3pre ID:20081220041002:
bp-3d5d2299-d15e-4be9-b1d3-d06ca2081220

Minefield/3.2a1pre ID:20081220033344:
bp-f466e5ef-a482-4c8c-98e2-4593d2081220

Signature	fastcopy_I
UUID	f466e5ef-a482-4c8c-98e2-4593d2081220
Time	2008-12-20 16:36:27-08
Uptime	118
Last Crash	183 seconds before submission
Product	Firefox
Version	3.2a1pre
Build ID	20081220033344
Branch	1.9.2
OS	Windows NT
OS Version	5.1.2600 Service Pack 3
CPU	x86
CPU Info	GenuineIntel family 15 model 2 stepping 9
Crash Reason	EXCEPTION_ACCESS_VIOLATION
Crash Address	0x3ac000

Frame 	Module 	Signature 	Source
0 	mozcrt19.dll 	fastcopy_I 	
1 	mozcrt19.dll 	_VEC_memcpy 	
2 	mozcrt19.dll 	huge_malloc 	obj-firefox/memory/jemalloc/src/jemalloc.c:4797
3 	js3250.dll 	array_join_sub 	js/src/jsarray.cpp:1395
4 	js3250.dll 	array_join 	js/src/jsarray.cpp:1580
5 	js3250.dll 	js_Interpret 	js/src/jsinterp.cpp:5122
6 	js3250.dll 	js_Execute 	js/src/jsinterp.cpp:1562
7 	js3250.dll 	obj_eval 	js/src/jsobj.cpp:1345
8 	js3250.dll 	js_Invoke 	js/src/jsinterp.cpp:1316
9 	js3250.dll 	js_Interpret 	js/src/jsinterp.cpp:5139
10 	js3250.dll 	js_Execute 	js/src/jsinterp.cpp:1562
11 	js3250.dll 	JS_EvaluateUCScriptForPrincipals 	js/src/jsapi.cpp:5192
12 	xul.dll 	nsJSContext::EvaluateString(nsAString_internal const&,void*,nsIPrincipal*,char const*,unsigned int,unsigned int,nsAString_internal*,int*) 	dom/src/base/nsJSEnvironment.cpp:1588
13 	xul.dll 	nsScriptLoader::EvaluateScript(nsScriptLoadRequest*,nsString const&) 	content/base/src/nsScriptLoader.cpp:653
14 	xul.dll 	nsScriptLoader::ProcessRequest(nsScriptLoadRequest*) 	content/base/src/nsScriptLoader.cpp:567
15 	xul.dll 	nsScriptLoader::ProcessScriptElement(nsIScriptElement*) 	content/base/src/nsScriptLoader.cpp:521

Comment 1

[Tyler Downer [He/Him]]

Confirm this with Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2a1pre) Gecko/20081220 Minefield/3.2a1pre.
Crash reports:
bp-4171ab22-496a-49cc-a8d0-bf8a02081220
bp-d889580d-a9c0-4e74-a9d4-aa4b62081220
bp-579b2b1f-0810-4e38-996d-1f1a62081220
This is happening on Wordpress.com, editing a post.
number 19 topcrash.

Comment 2

[(mostly gone) XtC4UaLL [:xtc4uall]]

from http://crash-stats.mozilla.com/report/list?product=Firefox&product=SeaMonkey&product=Sunbird&product=Thunderbird&branch=1.9.2&query_search=signature&query_type=contains&query=fastcopy_I&date=&range_value=3&range_unit=weeks&do_query=1&signature=fastcopy_I

you can see:
- first report with this signature is from dec. 9th
- all crash reports are identical upto frame 5 and differ beyond (-> separate bugs?)

Comment 3

[(mostly gone) XtC4UaLL [:xtc4uall]]

so, the cdfreaks.com example still crashes using Firefox 3.2a1pre build 20081224034752 with a different sig (bp-1b7b4f66-cb6a-44b1-a591-b62b72081224 [@ memcpy]), but it does not using a recent TM build:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2a1pre) Gecko/20081224 Minefield/3.2a1pre ID:20081224021447
Built from http://hg.mozilla.org/tracemonkey/rev/09997a70e4fb

Tyler, can you re-check if that's true for your examples too?

Comment 4

[Tyler Downer [He/Him]]

bp-b984029c-80d2-42f6-8d21-5c7d92081224 is the crash on Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2a1pre) Gecko/20081224 Minefield/3.2a1pre ID:20081224034752. Wordpress.com, edit post. This could be a diffeent issue as well.

Comment 5

[(mostly gone) XtC4UaLL [:xtc4uall]]

so, wordpress is still crashing with a recent TraceMonkey build (https://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/tracemonkey-win32/)? if yes, please file a new bug for that.

Comment 6

[(mostly gone) XtC4UaLL [:xtc4uall]]

this (cdfreaks.com example) is WFM now after the latest TM merge, i.e. with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2a1pre) Gecko/20081226 Minefield/3.2a1pre ID:20081226033733