633127 - Crash [@ js::mjit::ic::CallProp ]

Status: RESOLVED INVALID

(Core :: JavaScript Engine, defect)

Description

[Scoobidiver (away)]

It is #31 top crasher in Fennec 4.0b4.

There are two kinds of stack traces:

Frame 	Module 	Signature [Expand] 	Source
0 	libxul.so 	js::mjit::ic::CallProp 	js/src/methodjit/PolyIC.cpp:1759
1 	libxul.so 	libxul.so@0xb1d10a 	
2 	libxul.so 	js::mjit::ic::CallProp 	js/src/methodjit/PolyIC.cpp:1752
3 	libxul.so 	js::mjit::JaegerShot 	js/src/jscntxt.h:2890
4 	libxul.so 	js::Execute 	js/src/jsinterp.cpp:654
5 	libxul.so 	JS_EvaluateUCScriptForPrincipals 	js/src/jsapi.cpp:4933
6 	libxul.so 	JS_EvaluateUCScriptForPrincipalsVersion 	js/src/jsapi.cpp:151
7 	libxul.so 	nsJSContext::EvaluateString 	dom/base/nsJSEnvironment.cpp:1552
8 	libxul.so 	nsScriptLoader::EvaluateScript 	nsCOMPtr.h:655
9 	libxul.so 	nsScriptLoader::ProcessRequest 	nsCOMPtr.h:800
10 	libxul.so 	nsScriptLoader::ProcessScriptElement 	content/base/src/nsScriptLoader.cpp:646
11 	libxul.so 	nsScriptElement::MaybeProcessScript 	content/base/src/nsScriptElement.cpp:185
12 	libxul.so 	nsHTMLScriptElement::MaybeProcessScript 	content/html/content/src/nsHTMLScriptElement.cpp:584
13 	libxul.so 	nsHTMLScriptElement::DoneAddingChildren 	content/html/content/src/nsHTMLScriptElement.cpp:511
14 	libxul.so 	nsHtml5TreeOpExecutor::RunScript 	parser/html/nsHtml5TreeOpExecutor.cpp:734
15 	libxul.so 	nsHtml5TreeOpExecutor::RunFlushLoop 	parser/html/nsHtml5TreeOpExecutor.cpp:528
16 	libxul.so 	nsHtml5ExecutorReflusher::Run 	parser/html/nsHtml5TreeOpExecutor.cpp:92
17 	libxul.so 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:633
18 	libxul.so 	NS_ProcessNextEvent_P 	nsThreadUtils.cpp:250
19 	libxul.so 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:111
20 	libxul.so 	mozilla::ipc::MessagePumpForChildProcess::Run 	ipc/glue/MessagePump.cpp:230
...

Frame 	Module 	Signature [Expand] 	Source
0 	libxul.so 	js::mjit::ic::CallProp 	js/src/methodjit/PolyIC.cpp:1756
1 	libxul.so 	libxul.so@0xb1d10a 	
2 	libxul.so 	js::mjit::ic::CallProp 	js/src/methodjit/PolyIC.cpp:1752
3 	libxul.so 	js::mjit::JaegerShot 	js/src/jscntxt.h:2890
4 	libxul.so 	js::Invoke 	js/src/jsinterp.cpp:654
5 	libxul.so 	js::ExternalInvoke 	js/src/jsinterp.cpp:858
6 	libxul.so 	JS_CallFunctionValue 	js/src/jsinterp.h:961
7 	libxul.so 	nsXPCWrappedJSClass::CallMethod 	js/src/xpconnect/src/xpcwrappedjsclass.cpp:1702
8 	libxul.so 	nsXPCWrappedJS::CallMethod 	js/src/xpconnect/src/xpcwrappedjs.cpp:589
9 	libxul.so 	PrepareAndDispatch 	xpcom/reflect/xptcall/src/md/unix/xptcstubs_arm.cpp:134
10 	libxul.so 	libxul.so@0x96990c 	
11 	libxul.so 	nsDOMEventListenerWrapper::HandleEvent 	content/events/src/nsDOMEventTargetHelper.cpp:66
12 		@0x43333f4f 	
13 	libxul.so 	nsEventListenerManager::HandleEventSubType 	content/events/src/nsEventListenerManager.cpp:1114
14 	libxul.so 	nsEventListenerManager::HandleEventInternal 	content/events/src/nsEventListenerManager.cpp:1209
15 	libxul.so 	nsEventTargetChainItem::HandleEvent 	content/events/src/nsEventListenerManager.h:146
16 	libxul.so 	nsEventTargetChainItem::HandleEventTargetChain 	content/events/src/nsEventDispatcher.cpp:343
17 	libxul.so 	nsEventDispatcher::Dispatch 	content/events/src/nsEventDispatcher.cpp:630
18 	libxul.so 	nsEventDispatcher::DispatchDOMEvent 	content/events/src/nsEventDispatcher.cpp:691
19 	libxul.so 	nsDOMEventTargetHelper::DispatchDOMEvent 	content/events/src/nsDOMEventTargetHelper.cpp:230
...

More reports at:
https://crash-stats.mozilla.com/report/list?range_value=4&range_unit=weeks&signature=js%3A%3Amjit%3A%3Aic%3A%3ACallProp

Comment 1

[Scoobidiver (away)]

Now, the stack trace looks like:
Frame 	Module 	Signature [Expand] 	Source
0 	libxul.so 	js::mjit::ic::CallProp 	js/src/vm/Stack.h:1133
1 	libxul.so 	libxul.so@0xc0dc85 	
2 	libxul.so 	js::mjit::ic::CallElement 	js/src/methodjit/PolyIC.cpp:2612
3 		@0x4260031e 	
4 	libxul.so 	js::mjit::JaegerShot 	js/src/methodjit/MethodJIT.cpp:687
5 	libxul.so 	js::Interpret 	js/src/jsinterp.cpp:4053
6 	libxul.so 	js::Invoke 	js/src/jsinterp.cpp:614
7 	libxul.so 	js_fun_apply 	js/src/jsinterp.h:169
8 	libxul.so 	js::Invoke 	js/src/jscntxtinlines.h:281
9 	libxul.so 	js::Interpret 	js/src/jsinterp.cpp:4016
10 	libxul.so 	js::mjit::stubs::UncachedCallHelper 	js/src/methodjit/InvokeHelpers.cpp:353
11 	libxul.so 	CallCompiler::update 	js/src/methodjit/MonoIC.cpp:965
12 	libxul.so 	js::mjit::ic::Call 	js/src/methodjit/MonoIC.cpp:1019
13 	libxul.so 	libxul.so@0xc0dc85 	
14 	libxul.so 	js::mjit::ic::New 	js/src/methodjit/MonoIC.cpp:1027
15 		@0x47944d3e 	
16 	libxul.so 	js::mjit::JaegerShot 	js/src/methodjit/MethodJIT.cpp:687
17 	libxul.so 	js::ExternalInvoke 	js/src/jsinterp.cpp:611
18 	libxul.so 	JS_CallFunctionValue 	js/src/jsapi.cpp:5052
19 	libxul.so 	nsXPCWrappedJSClass::CallMethod 	js/src/xpconnect/src/xpcwrappedjsclass.cpp:1657
20 	libxul.so 	nsXPCWrappedJS::CallMethod 	js/src/xpconnect/src/xpcwrappedjs.cpp:585
...

Comment 2

[Scoobidiver (away)]

There's one crash in 10.0:
bp-0b043a38-9418-464b-a1c6-421e82120207

Comment 3

[Jan de Mooij [:jandem]]

JM is gone.