720234 - Crash @ js_InternalInterpret

Status: RESOLVED INVALID

(Core :: JavaScript Engine, defect)

Description

[Scoobidiver (away)]

It's a new crash signature that first appeared in 12.0a1/20120120.
The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=58e933465c36&tochange=5c2bc94d359c

It might be a new form of bug 595351.

Signature 	js_InternalInterpret More Reports Search
UUID	44b09735-66d2-488b-86ab-aa5622120122
Date Processed	2012-01-22 02:51:18
Uptime	15484
Last Crash	19.0 hours before submission
Install Age	1.5 days since version was first installed.
Install Time	2012-01-20 15:38:16
Product	Firefox
Version	12.0a1
Build ID	20120120031125
Release Channel	nightly
OS	Windows NT
OS Version	6.1.7601 Service Pack 1
Build Architecture	x86
Build Architecture Info	GenuineIntel family 6 model 23 stepping 10
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0xffffffffffeae3cb
App Notes 	
AdapterVendorID: 0x1002, AdapterDeviceID: 0x68d8, AdapterSubsysID: 200d1787, AdapterDriverVersion: 8.872.0.0
D2D? D2D+
DWrite? DWrite+
D3D10 Layers? D3D10 Layers+
EMCheckCompatibility	True

Frame 	Module 	Signature [Expand] 	Source
0 	mozjs.dll 	js_InternalInterpret 	js/src/methodjit/InvokeHelpers.cpp:793
1 	mozjs.dll 	JaegerInterpoline 	js/src/methodjit/MethodJIT.cpp:939
2 	mozjs.dll 	js::mjit::EnterMethodJIT 	js/src/methodjit/MethodJIT.cpp:1052
3 	mozjs.dll 	js::mjit::JaegerShot 	js/src/methodjit/MethodJIT.cpp:1123
4 	mozjs.dll 	js::RunScript 	js/src/jsinterp.cpp:472
5 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:538
6 	mozjs.dll 	js::Invoke 	js/src/jsinterp.h:157
7 	mozjs.dll 	js_fun_apply 	js/src/jsfun.cpp:1669
8 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:520
9 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:3006
10 	mozjs.dll 	js::RunScript 	js/src/jsinterp.cpp:467
11 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:538
12 	mozjs.dll 	js::Invoke 	js/src/jsinterp.cpp:570
13 	mozjs.dll 	JS_CallFunctionValue 	js/src/jsapi.cpp:5446
14 	xul.dll 	nsJSContext::CallEventHandler 	dom/base/nsJSEnvironment.cpp:1957
15 	xul.dll 	nsGlobalWindow::RunTimeout 	dom/base/nsGlobalWindow.cpp:9305
16 	xul.dll 	nsGlobalWindow::TimerCallback 	dom/base/nsGlobalWindow.cpp:9693
17 	xul.dll 	nsTimerImpl::Fire 	xpcom/threads/nsTimerImpl.cpp:428
18 	xul.dll 	nsTimerEvent::Run 	xpcom/threads/nsTimerImpl.cpp:524
19 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:657
20 	nspr4.dll 	PR_Unlock 	nsprpub/pr/src/threads/combined/prulock.c:347
21 	xul.dll 	MessageLoop::RunHandler 	ipc/chromium/src/base/message_loop.cc:201
22 	xul.dll 	_SEH_epilog4 	
23 	xul.dll 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:175
24 	xul.dll 	mozilla::storage::AsyncStatement::QueryInterface 	storage/src/mozStorageAsyncStatement.cpp:312
25 	xul.dll 	nsBaseAppShell::Run 	widget/xpwidgets/nsBaseAppShell.cpp:189
26 		@0x16ac73f 	

More reports at:
https://crash-stats.mozilla.com/report/list?signature=js_InternalInterpret

Comment 1

[Benjamin Smedberg]

There's a lot in the regression range, but I don't think this is a generic signature like bug 595351.

Comment 2

[David Mandelin [:dmandelin]]

Just spoke with Brian on IRC. He says by date and kind it's likely to be related to bug 706914. Nothing obvious popped out--chunked compilation might just be exposing some other existing bugs. We'll just to have to watch and see if we get more data or if the fuzzers can trip over the bug.

Comment 3

[David Mandelin [:dmandelin]]

There don't seem to be very many of these any more.

Comment 4

[Jan de Mooij [:jandem]]

js_InternalInterpret is JM, JM is gone.