686358 - Crash @ TraceRecorder::import(nanojit::LIns*, int, long*, JSTraceType_, char const*, unsigned int, JSStackFrame*) ]

Status: RESOLVED WONTFIX

(Core :: JavaScript Engine, defect)

Description

[Chris DeCairos (:cade)]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:6.0.2) Gecko/20100101 Firefox/6.0.2
Build ID: 20110902133214

Steps to reproduce:

While testing the popcorn.js test suite with firebug open, I kept running into crashes when refreshing the page.

crash report: https://crash-stats.mozilla.com/report/index/0c69e57d-b1af-4bfd-9eb2-3455f2110912


Actual results:

Firefox crashed while reloading.  It looks like firebug may have been the culprit, as I can't get it to crash after I close firebug.

Comment 1

[Chris DeCairos (:cade)]

Here's what i was reloading that caused the crash:

http://scotland.proximity.on.ca/cadecairos/ff36/bug686358/test/

Comment 2

[Tim (fmdeveloper)]

That crash report is for Firefox 3.6.22...is the issue reproducible in Firefox 6?

Comment 3

[Chris DeCairos (:cade)]

I haven't been able to reproduce it on Firefox 6. But afaik, Mozilla still supports Firefox 3.6 for the time being. I also was told that this may/may not be an exploitable crash, so it was worth filing just in case.

Comment 4

[Matthias Versen [:Matti]]

FYI: Gecko1.9.2 gets only security fixes

Comment 5

[(mostly gone) XtC4UaLL [:xtc4uall]]

I fail to repro against Mozilla/5.0 (Windows NT 5.1; rv:9.0a1) Gecko/20110912 Firefox/9.0a1 ID:20110912030829 + Firebug 1.7.3.

Is it happening with Firebug's Defaults?

Comment 6

[(mostly gone) XtC4UaLL [:xtc4uall]]

(In reply to XtC4UaLL [:xtc4uall] from comment #5)
Arrg, should have been "Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.2.22) Gecko/20110902 Firefox/3.6.22 ID:20110902133716".

Sorry for the Spam.

Comment 7

[Chris DeCairos (:cade)]

Firebug hasn't been changed in anyway.

Comment 8

[Ryan VanderMeulen (PTO, back July 27)]

Results within 4 weeks of 12/01/2011 09:02:14, where the crash signature contains '[@ TraceRecorder::import(nanojit::LIns*, int, long*, JSTraceType_, char const*, unsigned int, JSStackFrame*) ]', and the product is one of Firefox, and the branch is one of 1.9.2 and the crashing process was of any type.

No results were found.

Seems highly unlikely that this is going to be looked at for 3.6 at this point. Furthermore, the tracejit is gone on mozilla-central, this is certainly not going to affect future Firefox releases.