481519 - Crashes in [@ js_SynthesizeFrame]

Status: RESOLVED DUPLICATE of bug 481444

(Core :: JavaScript Engine, defect)

Description

[Henrik Skupin [:whimboo][⌚️UTC+1] (away from Feb 12th - Feb 22nd)]

There is a new top crasher #3 visible on 1.9.1b3pre which happens in js_SynthesizeFrame. Latest builds still crash in this stack:

0  	js3250.dll  	js_SynthesizeFrame  	js/src/jstracer.cpp:3111
1 	js3250.dll 	LeaveTree 	js/src/jstracer.cpp:4081
2 	js3250.dll 	js_DeepBail 	js/src/jstracer.cpp:4679
3 	js3250.dll 	js3250.dll@0x778ea 	
4 	xul.dll 	jsd_ObjectHook 	js/jsd/jsd_obj.c:171
5 	js3250.dll 	js3250.dll@0x74252

No helpful comments available for now.

Comment 1

[Henrik Skupin [:whimboo][⌚️UTC+1] (away from Feb 12th - Feb 22nd)]

By analyzing the crash reports this should be a regression which started 02/25 this year on 1.9.1.

http://crash-stats.mozilla.com/report/list?product=Firefox&branch=1.9.1&version=Firefox%3A3.1b3pre&query_search=signature&query_type=exact&query=js_SynthesizeFrame&date=2009-02-25&range_value=1&range_unit=weeks&do_query=1&signature=js_SynthesizeFrame

Comment 2

[Andreas Gal :gal]

It looks like we try to deep bail from NewObject on trace since jsd is involved. We don't expect to do that (bailExit probably NULL) and die. When hitting a jsd hook we should fall off trace or make the NewInstance part of NewObject RETRY.

3  	libmozjs.dylib  	JS_FrameIterator  	js/src/jsdbgapi.cpp:981
4 	XUL 	jsd_ObjectHook 	js/jsd/jsd_obj.c:136
5 	libmozjs.dylib 	js_NewObjectWithGivenProto 	js/src/jsobj.cpp:2932