Closed Bug 595710 Opened 14 years ago Closed 14 years ago

Crash [@ js_CloseIterator(JSContext*, JSObject*) ]

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
Windows XP
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 597871
Tracking Flags:
Tracking Status
blocking2.0 --- beta8+

People

(Reporter: xtc4uall, Unassigned)

Details

(Keywords: crash)

Crash Data

Signature	js_CloseIterator(JSContext*, JSObject*)
UUID	7df34f72-a2ce-4c66-896e-438ce2100912
Time 	2010-09-12 13:24:39.693678
Uptime	204
Last Crash	356 seconds (5.9 minutes) before submission
Install Age	20949 seconds (5.8 hours) since version was first installed.
Product	Firefox
Version	4.0b6pre
Build ID	20100912041924
Branch	2.0
OS	Windows NT
OS Version	5.1.2600 Service Pack 3
CPU	x86
CPU Info	GenuineIntel family 15 model 2 stepping 9
Crash Reason	EXCEPTION_ACCESS_VIOLATION
Crash Address	0x4
User Comments	
App Notes 	AdapterVendorID: 1002, AdapterDeviceID: 7280
Processor Notes 	
EMCheckCompatibility	False
Frame  	Module  	Signature  	Source
0 	xul.dll 	js_CloseIterator(JSContext*,JSObject*) 	js/src/jsiter.cpp:844
1 	xul.dll 	FindExceptionHandler 	
2 	xul.dll 	SwallowErrors 	js/src/methodjit/InvokeHelpers.cpp:733
3 	xul.dll 	RemoveExcessFrames 	
4 	xul.dll 	RunTracer(js::VMFrame&,js::mjit::ic::MICInfo&) 	js/src/methodjit/InvokeHelpers.cpp:944
5 	xul.dll 	js::mjit::stubs::InvokeTracer(js::VMFrame&,unsigned long) 	js/src/methodjit/InvokeHelpers.cpp:994
6 	xul.dll 	XPC_WN_JSOp_ThisObject(JSContext*,JSObject*) 	js/src/xpconnect/src/xpcwrappednativejsops.cpp:1497
7 	xul.dll 	js::Invoke(JSContext*,js::CallArgs const&,unsigned int) 	js/src/jsinterp.cpp:614
8 	xul.dll 	js::ExternalInvoke(JSContext*,js::Value const&,js::Value const&,unsigned int,js::Value*,js::Value*) 	js/src/jsinterp.cpp:644
9 	xul.dll 	nsJSContext::CallEventHandler(nsISupports*,void*,void*,nsIArray*,nsIVariant**) 	dom/base/nsJSEnvironment.cpp:2186
10 	xul.dll 	nsGlobalWindow::RunTimeout(nsTimeout*) 	dom/base/nsGlobalWindow.cpp:8588
11 	xul.dll 	nsGlobalWindow::TimerCallback(nsITimer*,void*) 	dom/base/nsGlobalWindow.cpp:8933
12 	xul.dll 	nsTimerImpl::Fire() 	xpcom/threads/nsTimerImpl.cpp:425
13 	xul.dll 	nsTimerEvent::Run() 	xpcom/threads/nsTimerImpl.cpp:517
14 	xul.dll 	nsThread::ProcessNextEvent(int,int*) 	xpcom/threads/nsThread.cpp:547
15 	xul.dll 	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp:110
16 	xul.dll 	xul.dll@0xbed8b3 	
17 	xul.dll 	MessageLoop::RunInternal() 	ipc/chromium/src/base/message_loop.cc:219
18 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc:202
19 	xul.dll 	CheckSideEffects 	js/src/jsemit.cpp:2535
20 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc:176
21 	xul.dll 	xul.dll@0x3fb8e1 	
22 	firefox.exe 	firefox.exe@0x1bb7 	
23 	kernel32.dll 	GetCodePageFileInfo 	
24 	kernel32.dll 	BaseProcessStart 	
25 	firefox.exe 	firefox.exe@0x186f

All I can say is that i checked the URL mentioned in Bug 577848 Comment 8 (http://vid.buffed.de/v/tHeI18ASW2E/buffedShow/buffedShow-207/) concerning the Flash Bug when this Crash happened.
I tried to reproduce, but there's no Reliability. Sometimes you have Luck when you CTRL-Reload x-Times.
The shiny new Web Console reports repeatedly:
too much recursion @ http://vid.buffed.de/static/js/jquery.min.js?v=110 Line: 40, i.e.:

a,b);a==="fx"&&d[0]!=="inprogress"&&c.dequeue(this,a)})},dequeue:function(a){return this.each(function(){c.dequeue(this,a)})},delay:function(a,b){a=c.fx?c.fx.speeds[a]||a:a;b=b||"fx";return this.queue(b,function(){var d=this;setTimeout(function(){c.dequeue(d,b)},a)})},clearQueue:function(a){return this.queue(a||"fx",[])}});var za=/[\n\t]/g,fa=/\s+/,Va=/\r/g,Wa=/href|src|style/,Xa=/(button|input)/i,Ya=/(button|input|object|select|textarea)/i,Za=/^(a|area)$/i,Aa=/radio|checkbox/;c.fn.extend({attr:function(a,

And thus this crashes quite reliable by letting the Video play and waiting till the Crash comes.
Hmmmm, getting this now for the "let the Video play and do nothing" Part:

Crash Signature	js_ConcatStrings(JSContext*, JSString*, JSString*)
UUID	178dce2a-414d-4aad-8f8d-0c2912100912
Time 	2010-09-12 15:18:29.321560
Uptime	536
Last Crash	6577 seconds (1.8 hours) before submission
Install Age	27526 seconds (7.6 hours) since version was first installed.
Product	Firefox
Version	4.0b6pre
Build ID	20100912041924
Branch	2.0
OS	Windows NT
OS Version	5.1.2600 Service Pack 3
CPU	x86
CPU Info	GenuineIntel family 15 model 2 stepping 9
Crash Reason	EXCEPTION_ACCESS_VIOLATION
Crash Address	0x0
User Comments	Bug 595710
App Notes 	AdapterVendorID: 1002, AdapterDeviceID: 7280
Processor Notes 	
EMCheckCompatibility	False
Frame  	Module  	Signature  	Source
0 	xul.dll 	js_ConcatStrings(JSContext*,JSString*,JSString*) 	js/src/jsstr.cpp:382
1 	xul.dll 	js::Interpret(JSContext*,JSStackFrame*,unsigned int,unsigned int) 	js/src/jsinterp.cpp:3432
2 	xul.dll 	js::Invoke(JSContext*,js::CallArgs const&,unsigned int) 	js/src/jsinterp.cpp:614
3 	xul.dll 	js::ExternalInvoke(JSContext*,js::Value const&,js::Value const&,unsigned int,js::Value*,js::Value*) 	js/src/jsinterp.cpp:644
4 	xul.dll 	nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS*,unsigned short,XPTMethodDescriptor const*,nsXPTCMiniVariant*) 	js/src/xpconnect/src/xpcwrappedjsclass.cpp:1692
5 	xul.dll 	nsXPCWrappedJS::CallMethod(unsigned short,XPTMethodDescriptor const*,nsXPTCMiniVariant*) 	js/src/xpconnect/src/xpcwrappedjs.cpp:571
6 	xul.dll 	PrepareAndDispatch 	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:114
7 	xul.dll 	SharedStub 	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:141
8 	xul.dll 	nsStreamListenerTee::OnDataAvailable(nsIRequest*,nsISupports*,nsIInputStream*,unsigned int,unsigned int) 	netwerk/base/src/nsStreamListenerTee.cpp:111
blocking2.0: --- → ?
comment zero signature is now #9 topcrash on 4.0b7pre but it might influenced by people testing this bug.

does show up on some other sites

urls for testing
   4 http://xider.hu/takelogin.php
   3 http://twitter.com/home
   2 https://twitter.com/home
   2 http://turbodom.ru/games/servers/
   2 http://turbodom.ru/games/recommend/
   2 http://deathlord.dyn-o-saur.com/
   2 http://brazil.otservlist.org/search

this should probably block since its inside the top 10, and a possible regression since 4.0b6

date     tl crashes at, count build, count build, ...
         js_CloseIterator.JSContext...JSObject..
20100910 1 4.0b6pre2010091004, 1 ,, 
20100911 3 4.0b6pre2010091104, 3 ,, 
20100912 4 ,, 3 4.0b6pre2010091204, 1 4.0b6pre2010091104, 
20100913 25 ,, 14 4.0b6pre2010091204, 11 4.0b6pre2010091304, 
20100914 11 ,, 7 4.0b6pre2010091304, 3 4.0b6pre2010091204, 
               1 4.0b7pre2010091404, 
20100915 6 ,, 5 4.0b7pre2010091507, 1 4.0b6pre2010091204, 
20100916 12 ,, 4 4.0b7pre2010091604, 4 4.0b7pre2010091404, 
               3 4.0b7pre2010091507, 1 4.0b6pre2010091304, 
20100917 17 ,, 9 4.0b7pre2010091704, 3 4.0b7pre2010091604, 
               3 4.0b7pre2010091507, 1 4.0b7pre2010091404, 
               1 4.0b6pre2010091204, 
20100918 17 ,, 4.0b7pre2010091804, 5 4.0b7pre2010091704, 
               2 4.0b7pre2010091604, 2 4.0b6pre2010091304, 
               1 4.0b7pre2010091507, 
20100919 14 ,, 7 4.0b7pre2010091804, 2 4.0b7pre2010091704, 
               1 4.0b7pre2010091904, 1 4.0b7pre2010091604, 
               1 4.0b6pre2010091905, 1 4.0b6pre2010091304, 
               1 4.0b32010080519, 
20100920 28 ,, 15 4.0b7pre2010092004, 9 4.0b7pre2010091904, 
                2 4.0b7pre2010091704, 1 4.0b7pre2010091804, 
                1 4.0b62010091408, 
20100921 32 ,, 16 4.0b7pre2010092104, 11 4.0b7pre2010092004, 
                2 4.0b6pre2010091304, 1 4.0b7pre2010091904, 
                1 4.0b7pre2010091404, 1 4.0b62010091408, 
20100922 36 ,, 19 4.0b7pre2010092104, 12 4.0b7pre2010092204, 
                3 4.0b7pre2010092004, 2 4.0b7pre2010091704,
blocking2.0: ? → beta8+
Brian, I thought we changed this so that only the GC calls close?
This is almost definitely bug 597871, but I can't reproduce to test.
Still in the topcrash list in today's build, despite bug 597871 being fixed.
This is bug 597871, and the latest crashes I can see are from build 20100928041914, which does not have that fix.
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → DUPLICATE
Crash Signature: [@ js_CloseIterator(JSContext*, JSObject*) ]
You need to log in before you can comment on or make changes to this bug.