584437 - TOP Crash [@ js::MonitorLoopEdge(JSContext*, unsigned int&, js::RecordReason)]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Myzar]

User-Agent:       Mozilla/5.0 (Windows; Windows NT 6.1; WOW64; rv:2.0b3pre) Gecko/20100804 Mozilla.Firefox.4.0b3pre Firefox/3.6.7
Build Identifier: 20100804040859

With today nightly i get an instant crash trying to visit those sites:

http://fudzilla.com/
http://www.dazebao.org/ 
http://www.fcmatera.it/ 
http://partedmagic.com/
http://www.theclevelandfan.com/boards/viewforum.php?f=3
http://www.ogelektra.ee/

crash reports

http://crash-stats.mozilla.com/report/index/bp-269ec26d-f67e-4e87-b788-f06db2100804
http://crash-stats.mozilla.com/report/index/bp-ea1611b1-78f6-4944-ae0e-19dc52100804






Reproducible: Always

Steps to Reproduce:
1. Open a site in details
2.
3.
Actual Results:  
Instant Crash

Expected Results:  
Not crashing :)

Comment 1

[timeless]

Signature	js::MonitorLoopEdge(JSContext*, unsigned int&, js::RecordReason)
UUID	269ec26d-f67e-4e87-b788-f06db2100804
Time	2010-08-04 10:53:31.901861
Uptime	10957
Last Crash	10961 seconds (3.0 hours) before submission
Install Age	16996 seconds (4.7 hours) since version was first installed.
Product	Firefox
Version	4.0b3pre
Build ID	20100804040859
Branch	2.0
OS	Windows NT
OS Version	6.1.7601 Service Pack 1, v.178
CPU	x86
CPU Info	GenuineIntel family 6 model 15 stepping 11
Crash Reason	EXCEPTION_ACCESS_VIOLATION
Crash Address	0x4

Frame	Module	Signature [Expand]	Source
0		@0x286ef7a	
1	mozjs.dll	js::MonitorLoopEdge	js/src/jstracer.cpp:7252
2	mozjs.dll	js::Interpret	js/src/jsinterp.cpp:2907
3	mozjs.dll	js::Execute	js/src/jsinterp.cpp:907
4	mozjs.dll	JS_EvaluateUCScriptForPrincipals	js/src/jsapi.cpp:4761
5	xul.dll	nsJSContext::EvaluateString	dom/base/nsJSEnvironment.cpp:1811
6	xul.dll	nsScriptLoader::EvaluateScript	content/base/src/nsScriptLoader.cpp:764
7	xul.dll	nsScriptLoader::ProcessRequest	content/base/src/nsScriptLoader.cpp:674
8	xul.dll	nsScriptLoader::ProcessPendingRequests

Comment 2

[Michael Lefevre]

I'm not sure if the "topcrash" is appropriate just yet, and I haven't tested this myself, but the reason Myzar (who filed this bug) added that is because a bunch of MozillaZine users were able to reproduce ( http://forums.mozillazine.org/viewtopic.php?p=9712367#p9712367 )

Possibly related to (or dupe of) bug 561813 or bug 584158, but those are security sensitive so it's hard to know.

Comment 3

[[not reading bugmail]]

There is a list of many sites that crash on the forum.  I hope this gets fixed before B3 spins out because that was started right after the TM merge landed.

Comment 5

[Mike Beltzner [:beltzner, not reading bugmail]]

Blocking beta 3, stopping current builds until we get a fix.

When we have the fix, it should land both on mozilla-central default and on GECKO20b3_20100804_RELBRANCH

Comment 6

[Robert Sayre]

No crash on a 08-03-nightly

Comment 7

[[not reading bugmail]]

(In reply to comment #3)
> There is a list of many sites that crash on the forum.  I hope this gets fixed
> before B3 spins out because that was started right after the TM merge landed.

ur B3 was tagged already :-/

Comment 8

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

(In reply to comment #7)
> (In reply to comment #3)
> > There is a list of many sites that crash on the forum.  I hope this gets fixed
> > before B3 spins out because that was started right after the TM merge landed.
> 
> ur B3 was tagged already :-/

The builds were stopped until this can be dealt with.

Comment 9

[Jim Jeffery not reading bug-mail 1/2/11]

(In reply to comment #6)
> No crash on a 08-03-nightly

Regression range:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=79aa28daf1f4&tochange=c761f8e85b8c

build prior to the TM merge is OK, so appears one of the patches in merge is tickling bug https://bugzilla.mozilla.org/show_bug.cgi?id=561813

Comment 10

[Robert Sayre]

Attachment: stack

mootools.js

Comment 11

[Bob Clary [:bc] (inactive)]

see also bug 579551 comment 8 and 10.

Comment 12

[(mostly gone) XtC4UaLL [:xtc4uall]]

FWIW, on Tracemonkey-Branch using http://fudzilla.com/ Example I found this Regression Range:
http://hg.mozilla.org/tracemonkey/pushloghtml?fromchange=b8d51faf7ee5&tochange=898ab54a0ce9 (08-02/03 Nightlies)

Comment 13

[Luke Wagner [:luke]]

It looks like this has to do with the property cache.  We record JSOP_LENGTH (where the objects is a function) and the property cache tells to hard-code slot 3 (which is dslots[0]), even though obj->dslots == NULL (at record-time and on trace).  Any prop-cache-affecting changes pulled in by the last merge?

Comment 14

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/f7478476c9a5

Comment 15

[infinite.luta]

Shouldn't this be checked-in to GECKO20b3_20100804_RELBRANCH per Comment 5 before marking as FIXED? I didn't see anything for this in the branch changelog.

Comment 16

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

No, we mark things fixed when they're fixed on trunk.

Comment 17

[Reed Loden [:reed]]

(In reply to comment #15)
> Shouldn't this be checked-in to GECKO20b3_20100804_RELBRANCH per Comment 5
> before marking as FIXED? I didn't see anything for this in the branch
> changelog.

sayrer just landed it on the relbranch. http://hg.mozilla.org/mozilla-central/rev/69f2d0457750

Comment 18

[Jason Orendorff [:jorendorff]]

Luke and I think that bug 584565 is the root cause of this crash. The test case in that bug crashes near NULL even after the backout that we've landed, but not every site on the web that uses mootools.

Comment 19

[martin raud]

Crashed at once when i tryed to go into that site : http://www.ogelektra.ee/

Report: http://crash-stats.mozilla.com/report/index/fe2c5a9b-e33d-4f48-8d9e-d8ed72100804

Comment 20

[martin raud]

sorry, forgot to put my minefield data

Mozilla/5.0 (Windows; Windows NT 5.1; rv:2.0b3pre) Gecko/20100804 Minefield/4.0b3pre

using windows xp sp3

Comment 21

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

(In reply to comment #19)
> Crashed at once when i tryed to go into that site : http://www.ogelektra.ee/
> 
> Report:
> http://crash-stats.mozilla.com/report/index/fe2c5a9b-e33d-4f48-8d9e-d8ed72100804

That's because you're on a build from before the backout.

Comment 22

[martin raud]

i m using latest nigtly build
i havent noticed this kinda bug in last one, after updating to the latest it popped in :)

Comment 23

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

Yes, and this will be fixed in the next nightly build.  Please take any issues you see tomorrow to separate bugs.