511831 - Crash [@ js_Invoke] playing videos at Comcast.net

Status: RESOLVED DUPLICATE of bug 516009

(Core :: JavaScript Engine, defect)

Description

[Stephen Donner [:stephend] Not actively reading bugmail]

STR:

1. Using a Namoroka nightly (I'm on Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2a2pre) Gecko/20090820 Namoroka/3.6a2pre), load http://www.comcast.net
2. Acknowledge the warning about browser compatibility
3. Click on any of the videos, and just wait -- eventually you'll crash (timer?):

0  	libmozjs.dylib  	js_Invoke  	 js/src/jsinterp.cpp:1130
1 	libmozjs.dylib 	js_Interpret 	js/src/jsinterp.cpp:5229
2 	libmozjs.dylib 	js_Invoke 	js/src/jsinterp.cpp:1379
3 	libmozjs.dylib 	js_InternalInvoke 	js/src/jsinterp.cpp:1451
4 	libmozjs.dylib 	JS_CallFunctionValue 	js/src/jsapi.cpp:5176
5 	XUL 	nsJSContext::CallEventHandler 	dom/base/nsJSEnvironment.cpp:2097
6 	XUL 	nsGlobalWindow::RunTimeout 	dom/base/nsGlobalWindow.cpp:7935
7 	XUL 	nsGlobalWindow::TimerCallback 	dom/base/nsGlobalWindow.cpp:8269
8 	XUL 	nsTimerImpl::Fire 	xpcom/threads/nsTimerImpl.cpp:427
9 	XUL 	nsTimerEvent::Run 	xpcom/threads/nsTimerImpl.cpp:519
10 	XUL 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:527

Comment 1

[Stephen Donner [:stephend] Not actively reading bugmail]

http://crash-stats.mozilla.com/report/index/3c83816c-8935-45e0-b8d5-64aaf2090820?p=1 is the full crash report.

Comment 2

[Joesassa]

(In reply to comment #1)
> http://crash-stats.mozilla.com/report/index/3c83816c-8935-45e0-b8d5-64aaf2090820?p=1
> is the full crash report.

Comment 3

[David Mandelin [:dmandelin]]

I just tried this with a debug TM build and it blinked for a while, showing the URL 'http://www.comcast.net/browserupgrade/' in the location bar while spewing a lot of stuff like this to the console, and then stopped with "Unable to connect".

--DOMWINDOW == 22 (0x1574ae80) [serial = 358] [outer = 0x1356ee60] [url = http://www.comcast.net/browserupgrade/]
--DOMWINDOW == 21 (0x163befc0) [serial = 359] [outer = 0x1356ee60] [url = http://www.comcast.net/browserupgrade/]
--DOMWINDOW == 20 (0x1893e190) [serial = 360] [outer = 0x1356ee60] [url = http://www.comcast.net/browserupgrade/]
--DOMWINDOW == 19 (0x13998bf0) [serial = 361] [outer = 0x1356ee60] [url = http://www.comcast.net/browserupgrade/]
--DOMWINDOW == 18 (0x18933720) [serial = 362] [outer = 0x1356ee60] [url = http://www.comcast.net/browserupgrade/]
--DOMWINDOW == 17 (0x15f35ce0) [serial = 363] [outer = 0x1356ee60] [url = http://www.comcast.net/browserupgrade/]
--DOMWINDOW == 16 (0x10dc42c0) [serial = 364] [outer = 0x1356ee60] [url = http://www.comcast.net/browserupgrade/]
--DOMWINDOW == 15 (0x10d615c0) [serial = 365] [outer = 0x1356ee60] [url = http://www.comcast.net/browserupgrade/]
--DOMWINDOW == 14 (0x15f42530) [serial = 366] [outer = 0x1356ee60] [url = http://www.comcast.net/browserupgrade/]
--DOMWINDOW == 13 (0x1634c020) [serial = 367] [outer = 0x1356ee60] [url = http://www.comcast.net/browserupgrade/]

Comment 4

[David Mandelin [:dmandelin]]

I got the same thing (minus console spew) with today's nightly.

Comment 5

[Stephen Donner [:stephend] Not actively reading bugmail]

(In reply to comment #4)
> I got the same thing (minus console spew) with today's nightly.

Comcast is doing user-agent sniffing now, so you'll have to use general.useragent.override (type: string) with something like "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2"

Crash report: http://crash-stats.mozilla.com/report/index/b3f015f6-81a9-4d87-9a7f-26c272090905?p=1

Comment 6

[David Mandelin [:dmandelin]]

I can replicate with today's trunk and TM nightlies. It's crashing on trace so it will not be easy to debug. Could someone please get us a regression window?

Comment 7

[juan becerra [:juanb]]

3.6a1pre, it could be between 6/15 and 6/16. I left the build from 6/15 play several videos in a span of a couple of hours and it didn't crash, whereas the build from 6/16 crashes eventually, although not right away.

http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=a012b6f9858b&tochange=ca8799e74642

Comment 8

[Andreas Gal :gal]

I don't see any JS changes in that window.

Comment 9

[juan becerra [:juanb]]

It could be that I didn't wait long enough for the early June builds to crash, but in at least two early June builds from 6/3 and 6/12, for example, I let it play videos for several minutes, and the one from 6/15 for at least two hours with no crash. I'll try checking these again, with fresher profiles, since I tried to find the regression with the same one.

Comment 10

[David Mandelin [:dmandelin]]

Starting from the range in comment 7, I rebisected using the TM tree and found the problem to start with this rev:

changeset:   28946:a6f9df8c33a9
user:        David Mandelin <[e-mail]>
date:        Fri Jun 05 16:19:06 2009 -0700
summary:     Bug 496270: correct use of C++ reference returned from function, r=gal

Comment 11

[David Mandelin [:dmandelin]]

I believe this is a dup of bug 516009, which has already been fixed (in TM and m-c). I also tried these videos again on today's TM nightly, and they did not crash. The fix has not to my knowledge been landed to 1.9.2 yet but is marked blocking.