597886 - Crash [@ js_ConcatStrings(JSContext*, JSString*, JSString*) ]

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[(mostly gone) XtC4UaLL [:xtc4uall]]

See Bug 595710 Comment 2.

Per http://crash-stats.mozilla.com/report/list?product=Firefox&branch=2.0&query_search=signature&query_type=exact&query=js_ConcatStrings%28JSContext*%2C%20JSString*%2C%20JSString*%29&date=09%2F19%2F2010%2007%3A31%3A28&range_value=1&range_unit=weeks&hang_type=any&process_type=any&plugin_field=&plugin_query_type=&plugin_query=&do_query=1&admin=&signature=js_ConcatStrings%28JSContext*%2C%20JSString*%2C%20JSString*%29
the Crashing started with Build 20100911041541. The listed older Builds crash differently.

Mozilla/5.0 (Windows NT 5.1; rv:2.0b7pre) Gecko/20100919 Firefox/4.0b7pre ID:20100919042023 (http://hg.mozilla.org/mozilla-central/rev/7640eb022be6):
Frame  	Module  	Signature  	Source
0 	xul.dll 	js_ConcatStrings(JSContext*,JSString*,JSString*) 	js/src/jsstr.cpp:382
1 	xul.dll 	js::Interpret(JSContext*,JSStackFrame*,unsigned int,unsigned int) 	js/src/jsinterp.cpp:3341
2 	xul.dll 	js::Invoke(JSContext*,js::CallArgs const&,unsigned long) 	js/src/jsinterp.cpp:592
3 	xul.dll 	js::ExternalInvoke(JSContext*,js::Value const&,js::Value const&,unsigned int,js::Value*,js::Value*) 	js/src/jsinterp.cpp:622
4 	xul.dll 	JS_CallFunctionValue 	js/src/jsapi.cpp:4847
5 	xul.dll 	nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS*,unsigned short,XPTMethodDescriptor const*,nsXPTCMiniVariant*) 	js/src/xpconnect/src/xpcwrappedjsclass.cpp:1692
6 	xul.dll 	nsXPCWrappedJS::CallMethod(unsigned short,XPTMethodDescriptor const*,nsXPTCMiniVariant*) 	js/src/xpconnect/src/xpcwrappedjs.cpp:571
7 	xul.dll 	PrepareAndDispatch 	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:114
8 	xul.dll 	SharedStub 	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:141
9 	xul.dll 	nsStreamListenerTee::OnDataAvailable(nsIRequest*,nsISupports*,nsIInputStream*,unsigned int,unsigned int) 	netwerk/base/src/nsStreamListenerTee.cpp:111

Mozilla/5.0 (Windows NT 5.1; rv:2.0b6pre) Gecko/20100919 Firefox/4.0b6pre (http://hg.mozilla.org/tracemonkey/rev/dfcf5611ce02) with Method and/or Trace JIT on/off (i.e. does not matter):
Frame  	Module  	Signature  	Source
0 	xul.dll 	js_ConcatStrings(JSContext*,JSString*,JSString*) 	js/src/jsstr.cpp:382
1 	xul.dll 	js::Interpret(JSContext*,JSStackFrame*,unsigned int,unsigned int) 	js/src/jsinterp.cpp:3341
2 	xul.dll 	js::Invoke(JSContext*,js::CallArgs const&,unsigned long) 	js/src/jsinterp.cpp:592
3 	xul.dll 	js::ExternalInvoke(JSContext*,js::Value const&,js::Value const&,unsigned int,js::Value*,js::Value*) 	js/src/jsinterp.cpp:622
4 	xul.dll 	nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS*,unsigned short,XPTMethodDescriptor const*,nsXPTCMiniVariant*) 	js/src/xpconnect/src/xpcwrappedjsclass.cpp:1692
5 	xul.dll 	nsXPCWrappedJS::CallMethod(unsigned short,XPTMethodDescriptor const*,nsXPTCMiniVariant*) 	js/src/xpconnect/src/xpcwrappedjs.cpp:571
6 	xul.dll 	PrepareAndDispatch 	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:114
7 	xul.dll 	SharedStub 	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:141
8 	xul.dll 	nsStreamListenerTee::OnDataAvailable(nsIRequest*,nsISupports*,nsIInputStream*,unsigned int,unsigned int) 	netwerk/base/src/nsStreamListenerTee.cpp:111

* open given URL
* make sure to reload it that many Times, that the Video starts playing
* let it play/wait untill Crash happens

Worth mentioning Web Console Output:
with Method/Trace JIT on:
too much recursion @ http://vid.buffed.de/static/js/jquery.min.js?v=110 Line: 132

c.isFunction(b))this._toggle.apply(this,arguments);else a==null||d?this.each(function(){var f=d?a:c(this).is(":hidden");c(this)[f?"show":"hide"]()}):this.animate(L("toggle",3),a,b);return this},fadeTo:function(a,b,d){return this.filter(":hidden").css("opacity",0).show().end().animate({opacity:b},a,d)},animate:function(a,b,d,f){var e=c.speed(b,d,f);if(c.isEmptyObject(a))return this.each(e.complete);return this[e.queue===false?"each":"queue"](function(){var i=c.extend({},e),j,o=this.nodeType===1&&c(this).is(":hidden"),

with Method and/or Trace JIT off:
too much recursion @ http://vid.buffed.de/static/js/jquery.min.js?v=110 Line: 40

a,b);a==="fx"&&d[0]!=="inprogress"&&c.dequeue(this,a)})},dequeue:function(a){return this.each(function(){c.dequeue(this,a)})},delay:function(a,b){a=c.fx?c.fx.speeds[a]||a:a;b=b||"fx";return this.queue(b,function(){var d=this;setTimeout(function(){c.dequeue(d,b)},a)})},clearQueue:function(a){return this.queue(a||"fx",[])}});var za=/[\n\t]/g,fa=/\s+/,Va=/\r/g,Wa=/href|src|style/,Xa=/(button|input)/i,Ya=/(button|input|object|select|textarea)/i,Za=/^(a|area)$/i,Aa=/radio|checkbox/;c.fn.extend({attr:function(a,

Comment 1

[(mostly gone) XtC4UaLL [:xtc4uall]]

Looks different as Bug 596988, no?

Comment 2

[(mostly gone) XtC4UaLL [:xtc4uall]]

Adding Dependancy to Bug 596460 cause of the "too much recursion" Stuff.

Comment 3

[(mostly gone) XtC4UaLL [:xtc4uall]]

Bug 596460 didn't help.
bp-604f82dd-9896-4cb6-afb0-e862e2100926 with Build 20100926042726 Built from (http://hg.mozilla.org/mozilla-central/rev/2370ecfdcbb7).

If you look at Error Console Output, there are these two Warnings

Warning: reference to undefined property a[++e]
Source: http://vid.buffed.de/static/js/jquery.min.js?v=110
Line: 29
Warning: reference to undefined property f.queue
Source: http://vid.buffed.de/static/js/jquery.min.js?v=110
Line: 135

what "compete" in alternating Way when counting up - and keep on doing so even when you close the Site's Tab.

Comment 4

[David Mandelin [:dmandelin]]

I tried the linked URL today, and it worked fine the first time. When I reloaded, it wouldn't play any more--it never seemed to get past the blank screen phase. In the log, I got:

Error: [Exception... "'Error: Cannot get outputNode by id' when calling method: [nsIConsoleListener::observe]"  nsresult: "0x8057001c (NS_ERROR_XPC_JS_THREW_JS_OBJECT)"  location: "<unknown>"  data: no]

xtc4uall, what do you see in current versions?

Comment 5

[(mostly gone) XtC4UaLL [:xtc4uall]]

The Bug as filed is not reproducible anymore for me, but that has been Kind of fragile in the Past anyways.

I tried it again now with a TM Hourly (http://hg.mozilla.org/tracemonkey/rev/25ba554a24ac) and today's MC Nightly.

Looking at the Crashstats (http://redir.ec/BtCk) the Signature is still present (on Beta 7 mainly), but with different Stacktraces of several Kinds.

Unsure if this can be closed WFM now and new one(s) should be opened ...

Comment 6

[David Mandelin [:dmandelin]]

(In reply to comment #5)
> The Bug as filed is not reproducible anymore for me, but that has been Kind of
> fragile in the Past anyways.

Thanks! This bug is for your reproducible crash, so I will close it. Crashkill peeps will file a bug on the ones from breakpad if they become common enough.