664159 - Firefox 7.0a1 Crash Report [@ js::ContextStack::popInvokeArgs(js::InvokeArgsGuard const&) ]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan Honza Odvarko [:Honza] (always need-info? me)]

Built from: http://hg.mozilla.org/mozilla-central/rev/060127d32405

Report: https://crash-stats.mozilla.com/report/index/7d8ba01a-fcbe-4f26-97a5-4a8182110614

The crash started when Firefox updated today.

Here you can see when exactly the crash started to appear.
http://getfirebug.com/testresults

(the first time: Mon, 13 Jun 2011 19:48:39 GMT, App Changeset: 17219648b629, App Build ID: 20110613110258)

STR:

1) Install Firebug 1.8b2: http://getfirebug.com/releases/firebug/1.8/firebug-1.8.0b2.xpi

2) Install FBTest 1.8b7: http://getfirebug.com/releases/fbtest/1.8/fbTest-1.8b7.xpi

3) Start Firefox, open Firebug UI (F12), open Test console, (focus Firebug UI and press Shift+T)

4) Expand the 'Dom' group and run 'dom/attributes/attributes.js' test by clicking on it -> CRASH

Honza

Comment 1

[Alice0775 White]

Regression window(TM hourly)
Works:
http://hg.mozilla.org/tracemonkey/rev/e3e54ff584a8
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:7.0a1) Gecko/20110607 Firefox/7.0a1 ID:20110607100903
Crashes:
http://hg.mozilla.org/tracemonkey/rev/bb9e5496b0ac
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:7.0a1) Gecko/20110607 Firefox/7.0a1 ID:20110607123559
Pushlog:
http://hg.mozilla.org/tracemonkey/pushloghtml?fromchange=e3e54ff584a8&tochange=bb9e5496b0ac

Comment 2

[Luke Wagner [:luke]]

looking into it

Comment 3

[Jan Honza Odvarko [:Honza] (always need-info? me)]

Just in case, here is easier STR:

1) Install Firebug 1.8b2: http://getfirebug.com/releases/firebug/1.8/firebug-1.8.0b2.xpi
2) Load http://www.softwareishard.com/har/viewer/
3) Open Firebug, select the Script panel and click the Enable link -> CRASH

Honza

Comment 4

[pal-moz]

dupe Bug 664146 ?

Comment 5

[Luke Wagner [:luke]]

Attachment: fix eval-in-frame

Thanks for the quick STR!  Eval-in-frame was clobbering the previous native call's prev-link.

Comment 6

[Luke Wagner [:luke]]

(In reply to comment #4)
Yeah, its safe to say any new crash under popInvokeArgs is going to be a dup of this.

Comment 7

[Luke Wagner [:luke]]

http://hg.mozilla.org/tracemonkey/rev/a55e103ba5c6
http://hg.mozilla.org/mozilla-central/rev/2ffda60b67dc

Comment 10

[Marcia Knous [:marcia]]

Adding Mac and Linux signature so it gets picked up in crash stats.