601982 - Crash in [@ AtSafePoint ]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Marcia Knous [:marcia]]

Seen while reviewing crash stats.http://tinyurl.com/23yxaej links to the crash reports which are all Windows. Crashes started showing using the 2010100500 build. The lone comment references crashing on picasweb.

Frame 	Module 	Signature [Expand] 	Source
0 	mozjs.dll 	AtSafePoint 	js/src/methodjit/InvokeHelpers.cpp:689
1 	mozjs.dll 	FinishExcessFrames 	js/src/methodjit/InvokeHelpers.cpp:734
2 	mozjs.dll 	RunTracer 	js/src/methodjit/InvokeHelpers.cpp:883
3 	mozjs.dll 	js::mjit::stubs::InvokeTracer 	js/src/methodjit/InvokeHelpers.cpp:931
4 	mozjs.dll 	EnterMethodJIT 	js/src/methodjit/MethodJIT.cpp:748
5 	mozjs.dll 	js::mjit::JaegerShot 	js/src/methodjit/MethodJIT.cpp:778
6 	mozjs.dll 	js::RunScript 	js/src/jsinterp.cpp:639
7 	mozjs.dll 	js::Invoke 	js/src/jsinterp.cpp:751
8 	mozjs.dll 	js_fun_call 	js/src/jsfun.cpp:2280
9 		@0x21f31dec 	
10 	mozjs.dll 	EnterMethodJIT 	js/src/methodjit/MethodJIT.cpp:748
11 	mozjs.dll 	js::mjit::JaegerShot 	js/src/methodjit/MethodJIT.cpp:778
12 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:4519
13 	mozjs.dll 	js::RunScript 	js/src/jsinterp.cpp:642
14 	mozjs.dll 	js::Invoke 	js/src/jsinterp.cpp:751
15 	mozjs.dll 	SlowCallFromIC 	js/src/methodjit/MonoIC.cpp:221
16 		@0x1fb137cc 	
17 	mozjs.dll 	EnterMethodJIT 	js/src/methodjit/MethodJIT.cpp:748
18 	mozjs.dll 	js::mjit::JaegerShot 	js/src/methodjit/MethodJIT.cpp:778
19 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:4519
20 	mozjs.dll 	js::RunScript 	js/src/jsinterp.cpp:642
21 	mozjs.dll 	js::Invoke 	js/src/jsinterp.cpp:751
22 	mozjs.dll 	js_fun_call 	js/src/jsfun.cpp:2280
23 		@0x2ec1384 	
24 	mozjs.dll 	EnterMethodJIT 	js/src/methodjit/MethodJIT.cpp:748
25 	mozjs.dll 	js::mjit::JaegerShot 	js/src/methodjit/MethodJIT.cpp:778
26 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:4519
27 	mozjs.dll 	js::RunScript 	js/src/jsinterp.cpp:642
28 	mozjs.dll 	js::Invoke 	js/src/jsinterp.cpp:751
29 	mozjs.dll 	js_fun_apply 	js/src/jsfun.cpp:2407
30 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:4639
31 	mozjs.dll 	js::RunScript 	js/src/jsinterp.cpp:642
32 	mozjs.dll 	js::Invoke 	js/src/jsinterp.cpp:751
33 	mozjs.dll 	js_fun_call 	js/src/jsfun.cpp:2280
34 		@0x1a703f30 	
35 	mozjs.dll 	EnterMethodJIT 	js/src/methodjit/MethodJIT.cpp:748
36 	mozjs.dll 	js::mjit::JaegerShot 	js/src/methodjit/MethodJIT.cpp:778
37 	mozjs.dll 	js::RunScript 	js/src/jsinterp.cpp:639
38 	mozjs.dll 	js::Invoke 	js/src/jsinterp.cpp:751
39 	mozjs.dll 	js::ExternalInvoke 	js/src/jsinterp.cpp:783
40 	mozjs.dll 	JS_CallFunctionValue 	js/src/jsapi.cpp:4870
41 	xul.dll 	nsXPCWrappedJSClass::CallMethod 	js/src/xpconnect/src/xpcwrappedjsclass.cpp:1694
42 	xul.dll 	nsXPCWrappedJS::CallMethod 	js/src/xpconnect/src/xpcwrappedjs.cpp:571
43 	xul.dll 	PrepareAndDispatch 	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:114
44 	xul.dll 	SharedStub 	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:141
45 	xul.dll 	nsEventListenerManager::HandleEventSubType 	content/events/src/nsEventListenerManager.cpp:1112

Comment 1

[timeless]

dvander: jit is null

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix

Comment 3

[chris hofmann]

the spike is pretty hard.  this should probably block b7

Comment 4

[David Mandelin [:dmandelin]]

Comment on attachment 481088 [details] [diff] [review]
fix

This probably wants to be

    script->setNativeMap(isConstructing, nmap);

>+    if (isConstructing)
>+        script->nmapCtor = nmap;
>+    else
>+        script->nmapNormal = nmap;
>+

Comment 5

[David Anderson [:dvander] - inactive, e-mail if emergency]

(In reply to comment #3)
the regressing patch never landed on m-c yet.

Comment 6

[chris hofmann]

ok. removing nom.

Comment 7

[David Anderson [:dvander] - inactive, e-mail if emergency]

http://hg.mozilla.org/tracemonkey/rev/fab29597e5af

Comment 8

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/fab29597e5af