484590 - FF35b4pre crashes [@ LeaveTree ]

Status: RESOLVED DUPLICATE of bug 480301

(Core :: JavaScript Engine, defect)

Description

[IlkkaP]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1b4pre) Gecko/20090321 Shiretoko/3.5b4pre (.NET CLR 3.5.30729)
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1b4pre) Gecko/20090321 Shiretoko/3.5b4pre (.NET CLR 3.5.30729)

From the latest update, the www.cnn.com (at least todays version) crashes FF.

Crash report:
http://crash-stats.mozilla.com/report/index/ef7abe03-3cb9-4a04-a2eb-64c8c2090321?p=1

Reproducible: Always

Steps to Reproduce:
1. Go to www.cnn.com
2. wait
3. Crash
Actual Results:  
Crash

Expected Results:  
...

Filed crash reports:
http://crash-stats.mozilla.com/report/index/ef7abe03-3cb9-4a04-a2eb-64c8c2090321?p=1
(first one)

Comment 1

[Matthias Versen [:Matti]]

0  	js3250.dll  	LeaveTree  	js/src/jstracer.cpp:4153
1 	js3250.dll 	js_DeepBail 	js/src/jstracer.cpp:4679
2 	js3250.dll 	js3250.dll@0x779dc 	
3 	xul.dll 	jsd_ObjectHook 	js/jsd/jsd_obj.c:171
4 	js3250.dll 	js3250.dll@0x7445a

Comment 2

[Andreas Gal :gal]

Note jsd involvement. I remember a similar bug recently that jorendorff fixed.

Comment 3

[Matthias Versen [:Matti]]

I bet you mean bug 481444

Comment 4

[Alexander Yuan]

For me, this reproduces at http://cms.csuglab.cornell.edu/web/guest/?action=loginview

Comment 5

[Andreas Gal :gal]

sayrer, could you try this and confirm? (cycling a new build here, can't run minefield right now)

Comment 6

[Robert Sayre]

I'll leave this until tomorrow... I think my merge will fix it (note the crash is Shiretoko, not Minefield).

Comment 7

[Shawn Wilsher :sdwilsh]

Seeing this on tinderbox (a lot), so confirming.  Stacks aren't totally the same though, so I hope I'm not hijacking...

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1239835237.1239838964.6004.gz&fulltext=1
Linux talos mozilla-central fast qm-plinux-fast03 on 2009/04/15 15:40:37

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1239831859.1239838056.4854.gz&fulltext=1
Linux talos mozilla-central fast qm-plinux-fast03 on 2009/04/15 14:44:19

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1239828414.1239832472.27992.gz&fulltext=1
MacOSX Darwin 8.8.1 talos mozilla-central qm-pmac-trunk03 on 2009/04/15 13:46:54

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1239828414.1239832472.27992.gz&fulltext=1
MacOSX Darwin 8.8.1 talos mozilla-central qm-pmac-trunk03 on 2009/04/15 13:46:54

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1239826031.1239830120.23791.gz&fulltext=1
Linux talos mozilla-central fast qm-plinux-fast03 on 2009/04/15 13:07:11

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1239808615.1239820419.8403.gz&fulltext=1
WINNT 5.1 talos mozilla-central qm-pxp-trunk02 on 2009/04/15 08:16:55

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1239801395.1239808341.18575.gz&fulltext=1
Linux talos mozilla-central fast qm-plinux-fast03 on 2009/04/15 06:16:35

Comment 8

[Shawn Wilsher :sdwilsh]

Apparently the backout of bug 480301 should fix the crashes I mentioned in comment 7.  Assuming they are the same as this bug, this may be considered closed.  I'll let the JS team decide that.

Comment 9

[Michael Kraft [:morac]]

Attachment: Test Case which will cause crash

I saw this crash when I ran my old test case to bug 420869.  The attached script will crash Firefox 3.4b4pre Gecko/20090422.  

http://crash-stats.mozilla.com/report/index/918af82f-0f7c-42aa-a6a1-e71972090422


It will not crash the nightly trunk Gecko/20090422 load so it's been fixed on on trunk branch, but not on the 1.9.1 branch.

Comment 10

[Michael Kraft [:morac]]

Bug 480301 may fix this crash since it adds protective code right before the call that causes the crash.

I will mention that I tried going back to an old nightly trunk load Gecko/20090401 and I couldn't get it to crash there either.  That was before the fix for bug 480301 landed so I'm not sure why Minefield doesn't crash but Shiretoko does.

Comment 11

[Michael Kraft [:morac]]

Since the fix for bug 480301 dropped, I can't reproduce this crash any more.  So I think it was fixed.

Comment 12

[IlkkaP]

I can't reproduce it either so it seems to be fixed.
Closing this bug.