478318 - TM: Crash if HOTLOOP is set to 1 [@ TypeMap::captureTypes]

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[David Mandelin [:dmandelin]]

STR: 

1. Make it say

#define HOTLOOP 1

in jstracer.cpp.

2. Start up a browser and do stuff with js. You probably won't be able to load even a single page but http://jsmsxdemo.googlepages.com/jsmsx.html should quickly crash in any case.

Stack trace:

Process:         firefox-bin [58226]
Path:            /Users/dmandelin/builds/tm_o/dist/Minefield.app/Contents/MacOS/firefox-bin
Identifier:      org.mozilla.firefox
Version:         3.2a1pre (3.2a1pre)
Code Type:       X86 (Native)
Parent Process:  launchd [1]

Date/Time:       2009-02-12 17:38:21.575 -0800
OS Version:      Mac OS X 10.5.6 (9G55)
Report Version:  6

Exception Type:  EXC_BAD_ACCESS (SIGBUS)
Exception Codes: KERN_PROTECTION_FAILURE at 0x0000000000000004
Crashed Thread:  0

Thread 0 Crashed:
0   libmozjs.dylib                	0x001ce09d TypeMap::captureTypes(JSContext*, Queue<unsigned short>&, unsigned int) + 27 (jstracer.h:124)
1   libmozjs.dylib                	0x001cf46c js_RecordTree(JSContext*, JSTraceMonitor*, nanojit::Fragment*, nanojit::Fragment*, unsigned int, Queue<unsigned short>*) + 294
2   libmozjs.dylib                	0x001cff03 js_MonitorLoopEdge(JSContext*, unsigned int&) + 525
3   libmozjs.dylib                	0x00168379 js_Interpret + 44569 (jsinterp.cpp:3725)
4   libmozjs.dylib                	0x0016a9bd js_Execute + 559 (jsinterp.cpp:1567)
5   libmozjs.dylib                	0x00133c37 JS_EvaluateUCScriptForPrincipals + 211 (jsapi.cpp:5250)

Comment 1

[Jesse Ruderman]

I set HOTLOOP to 1, recompiled, and browsed a bit in a debug build without crashing.

Tested Gmail, Google Reader, http://jsmsxdemo.googlepages.com/jsmsx.html, Slashdot, and Bugzilla ;)