683756 - Firefox 9.0a1 Crash @ js::mjit::Assembler::objSlotRef(JSObject*

Status: RESOLVED INVALID

(Core :: JavaScript Engine, defect)

Description

[Marcia Knous [:marcia]]

Seen while reviewing crash stats. Small volume with both Windows and Linux signatures found. Crashes started showing up using 2011083000 build. Likely related to TI landing.

http://tinyurl.com/3pjscaz links to the crashes on Win and Linux. One comment notes: "crashes regularly since the last update on http://plus.google.com"

https://crash-stats.mozilla.com/report/index/cdc84798-7250-4140-b560-501332110830

Frame 	Module 	Signature [Expand] 	Source
0 	mozjs.dll 	js::mjit::Assembler::objSlotRef 	js/src/methodjit/BaseAssembler.h:216
1 	mozjs.dll 	js::mjit::Compiler::jsop_getglobal 	js/src/methodjit/Compiler.cpp:2863
2 	mozjs.dll 	js::mjit::Compiler::generateMethod 	js/src/methodjit/Compiler.cpp:2699
3 	mozjs.dll 	js::mjit::Compiler::performCompilation 	js/src/methodjit/Compiler.cpp:511
4 	mozjs.dll 	js::mjit::Compiler::compile 	js/src/methodjit/Compiler.cpp:162
5 	mozjs.dll 	js::mjit::TryCompile 	js/src/methodjit/Compiler.cpp:620
6 	mozjs.dll 	js::mjit::CanMethodJIT 	js/src/methodjit/MethodJIT-inl.h:79
7 	mozjs.dll 	UncachedInlineCall 	js/src/methodjit/InvokeHelpers.cpp:327
8 	mozjs.dll 	js::mjit::stubs::UncachedCallHelper 	js/src/methodjit/InvokeHelpers.cpp:479
9 	mozjs.dll 	js::mjit::stubs::CompileFunction 	js/src/methodjit/InvokeHelpers.cpp:305
10 	mozjs.dll 	js::mjit::EnterMethodJIT 	js/src/methodjit/MethodJIT.cpp:884
11 	mozjs.dll 	js::mjit::JaegerShot 	js/src/methodjit/MethodJIT.cpp:961
12 	mozjs.dll 	js::RunScript 	js/src/jsinterp.cpp:620
13 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:705
14 	mozjs.dll 	js::Invoke 	js/src/jsinterp.cpp:837
15 	mozjs.dll 	JS_CallFunctionValue 	js/src/jsapi.cpp:5041
16 	xul.dll 	nsJSContext::CallEventHandler 	dom/base/nsJSEnvironment.cpp:1916
17 	xul.dll 	nsGlobalWindow::RunTimeout 	dom/base/nsGlobalWindow.cpp:9247
18 	xul.dll 	nsGlobalWindow::TimerCallback 	dom/base/nsGlobalWindow.cpp:9685
19 	xul.dll 	nsTimerImpl::Fire 	xpcom/threads/nsTimerImpl.cpp:424
20 	xul.dll 	nsTimerEvent::Run 	xpcom/threads/nsTimerImpl.cpp:520
21 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:631
22 	xul.dll 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:110
23 	xul.dll 	xul.dll@0xbba973 	
24 	xul.dll 	MessageLoop::RunHandler 	ipc/chromium/src/base/message_loop.cc:201
25 	xul.dll 	_SEH_epilog4 	
26 	xul.dll 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:175
27 	xul.dll 	mozilla::storage::AsyncExecuteStatements::AsyncExecuteStatements 	storage/src/mozStorageAsyncStatementExecution.cpp:238
28 	xul.dll 	nsBaseAppShell::Run 	widget/src/xpwidgets/nsBaseAppShell.cpp:189
29 		@0x35eddcf 	
30 	xul.dll 	nsAppStartup::Run 	toolkit/components/startup/nsAppStartup.cpp:224
31 	xul.dll 	XRE_main 	toolkit/xre/nsAppRunner.cpp:3551
32 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:107
33 	firefox.exe 	firefox.exe@0x4033 	
34 	firefox.exe 	__tmainCRTStartup 	crtexe.c:594
35 	firefox.exe 	_SEH_epilog4 	
36 	kernel32.dll 	BaseThreadInitThunk 	
37 	ntdll.dll 	__RtlUserThreadStart 	
38 	kernel32.dll 	WerpReportFaultInternal 	
39 	kernel32.dll 	WerpReportFaultInternal

Comment 1

[Brian Hackett [Laid off!]]

The signature suggests we are compiling a script with GLOBAL opcodes against a global that has had its scope cleared.  This can happen but shouldn't be, bug 680456.

Comment 2

[Jan de Mooij [:jandem]]

JM is gone.