The default bug view has changed. See this FAQ.

crash js::ContextStack::popInvokeArgs, Browser Crashes when close a tab(heavy script site)

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: Alice0775 White, Unassigned)

Tracking

({crash, reproducible})

Trunk
x86
Windows 7
crash, reproducible
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

(Reporter)

Description

5 years ago
Build Identifier:
http://hg.mozilla.org/mozilla-central/rev/0d5ad6a6f814
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0a1) Gecko/20120125 Firefox/12.0a1 ID:20120125064912


Nightly12.0a1 bp-6fd9285c-1804-4f0f-9b8c-542712120126
Aurora 11.0a2 bp-673982b6-6213-43c9-b8e4-adf622120126
Beta10.0      bp-51287043-62ac-404d-a491-a0bda2120126
Firefox9.0.1  bp-06cc970c-f93a-49e2-8c4b-3e72c2120126
Firefox8.0    bp-84118e5b-5d2e-4883-b36c-2723b2120126


Browser Crashes when close a tab.

*Crashes on Firefox8.0 to Nightly12.0a2.
*Firefox7 STR Cannot run.


STR (slow PC is required)
1. Open more than 2 tab and https://developer.mozilla.org/en-US/demos/detail/javascript-ray-tracer
2. Click "LAUNCH DEMO" red button
3. Click "single_light" (at 2nd row/5th column)
4. Click "Ray Trace!" blue button
5. Close this tab(ctrl+W),  just before slow script dialog pops up (13-18second)
6. Wait until the tab is completely closed
7. Slow script dialog will pops up, Click "Stop script"
8. Repeat step3 to step7 if browser does not crash.

Actual result
  Browser crashes w/ crash report
Looks js-y, punting it over.
Assignee: nobody → general
Component: DOM → JavaScript Engine
QA Contact: general → general
(Reporter)

Comment 2

5 years ago
Can not run STR
http://hg.mozilla.org/integration/mozilla-inbound/rev/22b20e5dcdce
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0a1) Gecko/20110725 Firefox/8.0a1 ID:20110725152331
Crashes w/ STR
http://hg.mozilla.org/integration/mozilla-inbound/rev/e385a9429c3a
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0a1) Gecko/20110725 Firefox/8.0a1 ID:20110725185810

Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=22b20e5dcdce&tochange=e385a9429c3a

Triggered by:
f631e1b0e296	Ben Turner — Bug 649537 - 'Workers: Make one OS thread and JS runtime per worker, and lose XPConnect'. r=sicking+mrbkap. * * * Bug 649537 - 'Workers: Make one OS thread and JS runtime per worker, and lose XPConnect'. r=sicking+mrbkap. Add workaround for bug 666963.
Assignee: general → nobody
Component: JavaScript Engine → DOM
QA Contact: general → general
(Reporter)

Updated

5 years ago
Blocks: 649537
Even so, I think this looks like a JS bug. Needs some investigation by a JS peer.
Assignee: nobody → general
Component: DOM → JavaScript Engine
QA Contact: general → general
(Reporter)

Comment 4

5 years ago
Sorry BuildId in comment #0 is
http://hg.mozilla.org/mozilla-central/rev/005488525c43
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0a1) Gecko/20120125 Firefox/12.0a1 ID:20120125031119


And it seemed to be fixed.
I cannot reproduce anymore on
http://hg.mozilla.org/mozilla-central/rev/0d5ad6a6f814
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0a1) Gecko/20120125 Firefox/12.0a1 ID:20120125064912

And this is seems to be duplication of Bug 714639.

Fixed window(m-c):
Reproduce:
http://hg.mozilla.org/mozilla-central/rev/03ae304e45af
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0a1) Gecko/20120125 Firefox/12.0a1 ID:20120125052451
Cannot reproduce:
http://hg.mozilla.org/mozilla-central/rev/0d5ad6a6f814
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0a1) Gecko/20120125 Firefox/12.0a1 ID:20120125064912
Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=03ae304e45af&tochange=0d5ad6a6f814


Fixed window(m-i):
Reproduce:
http://hg.mozilla.org/integration/mozilla-inbound/rev/040975f3210a
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0a1) Gecko/20120124 Firefox/12.0a1 ID:20120124102247
Cannot reproduce:
http://hg.mozilla.org/integration/mozilla-inbound/rev/79deba022227
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0a1) Gecko/20120124 Firefox/12.0a1 ID:20120124104951
Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=040975f3210a&tochange=79deba022227

Fixed by:
79deba022227	Luke Wagner — Bug 675078 - rm JSThreadData and JSThread (JSRuntime is now officially single-threaded) (r=igor)
No longer blocks: 649537
Depends on: 675078
(Reporter)

Updated

5 years ago
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.