591513 - Crash [@ js_CheckForStringIndex(int) ]

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Marcia Knous [:marcia]]

Seen in chofmann's crash report - a new low volume crash introduced in B4. http://tinyurl.com/2b9up9g links to the crash reports. No correlation data and there are several users that had no extensions installed.

Frame  	Module  	Signature [Expand]  	Source
0 	xul.dll 	js_CheckForStringIndex 	js/src/jsobj.cpp:3910
1 	xul.dll 	js_LookupPropertyWithFlags 	js/src/jsobj.cpp:4398
2 	xul.dll 	js_LookupProperty 	js/src/jsobj.cpp:4251
3 	xul.dll 	js::Interpret 	js/src/jsinterp.cpp:5331
4 	xul.dll 	LeaveFunction 	js/src/jsparse.cpp:2520
5 	xul.dll 	EmitJump 	js/src/jsemit.cpp:1200
6 	xul.dll 	js_EmitTree 	js/src/jsemit.cpp:6858
7 	xul.dll 	js_EmitTree 	js/src/jsemit.cpp:5624
8 	mozcrt19.dll 	arena_run_split 	obj-firefox/memory/jemalloc/crtsrc/jemalloc.c:2993
9 	mozcrt19.dll 	arena_run_alloc 	obj-firefox/memory/jemalloc/crtsrc/jemalloc.c:3200
10 	kernel32.dll 	VirtualFree 	
11 		@0x6f 	
12 	mozcrt19.dll 	arena_run_dalloc 	obj-firefox/memory/jemalloc/crtsrc/jemalloc.c:3391
13 	mozcrt19.dll 	arena_dalloc 	obj-firefox/memory/jemalloc/crtsrc/jemalloc.c:4235
14 	mozcrt19.dll 	free 	obj-firefox/memory/jemalloc/crtsrc/jemalloc.c:6064
15 	xul.dll 	js::Parser::~Parser 	js/src/jsparse.cpp:192
16 	xul.dll 	js::Compiler::compileScript 	js/src/jsparse.cpp:967
17 		@0x190009f 	
18 	xul.dll 	JS_EvaluateUCScriptForPrincipals 	js/src/jsapi.cpp:4779
19 	xul.dll 	nsJSContext::EvaluateString 	dom/base/nsJSEnvironment.cpp:1811

Comment 1

[Scoobidiver (away)]

It is #27 top crasher in 4.0b9 for the last week.

Comments say:
"I was copng and pasting something into a email"
"suddenly crashed when replying on an email... wow. browser plus core seems to have crashed as well... so unreliable"
"I was loading a .tga file with firefox"

Comment 2

[Scoobidiver (away)]

It is #20 top crasher in 4.0b12.

Comment 3

[chris hofmann]

I suspect this is one that will rise in ranking post release.

we might be able to find a regression range around b6.

checking --- js_CheckForStringIndex.int. 20110228-crashdata.csv
found in: 4.0b12 4.0b11 4.0b10 4.0b9 4.0b7 4.0b13pre 4.0b8 4.0b6
release total-crashes
              js_CheckForStringIndex.int. crashes
                         pct.
all     367436  288     0.00078381
4.0b12  53873   193     0.0035825
4.0b11  27465   74      0.00269434
4.0b10  6272    12      0.00191327
4.0b9   2194    3       0.00136737
4.0b7   2489    2       0.000803536
4.0b13pre       1369    2       0.00146092
4.0b8   1894    1       0.000527983
4.0b6   1348    1       0.00074184

os breakdown
js_CheckForStringIndex.int.Total 288
Win5.1  0.59
Win6.0  0.09
Win6.1  0.32

there is a scatttering of other sites in the url list, but it looks almost exlusively as a yahoo mail problem.

domains of sites
  28 http://us.mg4.mail.yahoo.com
  18 http://us.mg5.mail.yahoo.com
  18 //
  13 http://us.mg1.mail.yahoo.com
  11 http://www.facebook.com
  11 about:blank//
  11 \N//
   7 http://mail.yahoo.com
   6 http://us.mg60.mail.yahoo.com
   6 http://us.mg6.mail.yahoo.com
   6 http://us.mg3.mail.yahoo.com
   6 http://us.mg2.mail.yahoo.com
   3 wyciwyg://44
   3 wyciwyg://10
   3 http://us.mg203.mail.yahoo.com
   3 http://us.mg201.mail.yahoo.com
   3 http://uk.mg41.mail.yahoo.com
   3 http://ph.mg60.mail.yahoo.com
   2 https://www.facebook.com
   2 http://www.youtube.com
   2 http://www.orkut.com.br
   2 http://us.mg204.mail.yahoo.com
   2 http://uk.mg40.mail.yahoo.com
   2 http://thepiratebay.org
   2 http://mail.google.com
   2 http://id.mg60.mail.yahoo.com
   2 http://de.mg5.mail.yahoo.com
   2 http://compose.mail.yahoo.com
   2 http://au.mg5.mail.yahoo.com
   2 http://apps.facebook.com
   2 http://aa.mg4.mail.yahoo.com

...
...
...

Comment 4

[Mike Beltzner [:beltzner, not reading bugmail]]

Gal/Sayrer: do these stacks give you anything to go on? I don't think this blocks as-is, but crashing on mail.yahoo.com is worrying.

Please renominate if we can figure out what's causing this, or a regression range.

Comment 5

[Marcia Knous [:marcia]]

I will spend some time running Yahoo Mail on Win XP today. Typically I spot check Yahoo Mail on Mac daily.

Comment 6

[Scoobidiver (away)]

There are two kinds of stack traces:
* the JavaScript one (similar to the one in comment 0, low volume):
0 	mozjs.dll 	js_CheckForStringIndex 	js/src/jsobj.cpp:4466
1 	mozjs.dll 	js_LookupPropertyWithFlags 	js/src/jsobj.cpp:5032
2 	mozjs.dll 	js_FindPropertyHelper 	js/src/jsobj.cpp:5060
3 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:4868
4 	mozjs.dll 	js::RunScript 	js/src/jsinterp.cpp:653
5 	mozjs.dll 	js::Invoke 	js/src/jsinterp.cpp:733
6 	mozjs.dll 	js_fun_apply 	js/src/jsfun.cpp:2206
7 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:4766
8 	mozjs.dll 	js::RunScript 	js/src/jsinterp.cpp:653
9 	mozjs.dll 	js::Execute 	js/src/jsinterp.cpp:1014
10 	mozjs.dll 	EvaluateUCScriptForPrincipalsCommon 	js/src/jsapi.cpp:5059
11 	mozjs.dll 	JS_EvaluateUCScriptForPrincipalsVersion 	js/src/jsapi.cpp:5075
12 	xul.dll 	nsJSContext::EvaluateString 	dom/base/nsJSEnvironment.cpp:1457
* the plugin one (high volume): see bug 639337.

More reports at:
https://crash-stats.mozilla.com/report/list?range_value=4&range_unit=weeks&signature=js_CheckForStringIndex%28int%29

Comment 8

[Robert Kaiser]

This signature is now #6 on Firefox 11.* in yesterday's data.

Comment 9

[Scoobidiver (away)]

(In reply to Robert Kaiser (:[e-mail]) from comment #8)
> This signature is now #6 on Firefox 11.* in yesterday's data.
I see it as #142 top browser crasher.

Comment 10

[Robert Kaiser]

(In reply to Scoobidiver from comment #9)
> (In reply to Robert Kaiser (:[e-mail]) from comment #8)
> > This signature is now #6 on Firefox 11.* in yesterday's data.
> I see it as #142 top browser crasher.

I looked at 11.* (in my explosiveness reports), you probably looked at the 11.0 release (in Socorro). The signature summary for https://crash-stats.mozilla.com/report/list?signature=js_CheckForStringIndex%28int%29 says that most of those actually happen in 11.0b8, which is interesting. Still, we probably can remove topcrash for now, you're right.