74962 - Crash in js_GC when closing mail compose window

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Patrick C. Beard]

With latest JS engine changes (pulled at 2pm on 4/5/2001), I'm seeing a 100% 
repeatable crash in the JS GC. If I pull the following list of files using a 4/1/
2001 date stamp, the crash goes away. Mind you, this is running on top of the 
Boehm GC, so if any changes have gone in that do any explicit pointer hiding, 
this can be the culprit, but I don't see any leaks that would point to that.

Here's the list of files that appeared to have changed in my most recent pull:

mozilla/js/src/jsxdrapi.c
mozilla/js/src/jsobj.c
mozilla/js/src/jsobj.h
mozilla/js/src/jsprvtd.h
mozilla/js/src/jspubtd.h
mozilla/js/src/jsgc.c
mozilla/js/src/jsgc.h
mozilla/js/src/jsinterp.c
mozilla/js/src/jslock.c
mozilla/js/src/jslock.h
mozilla/js/src/jsapi.c
mozilla/js/src/jsapi.h
mozilla/js/src/jscntxt.h
mozilla/js/src/jsfun.c
mozilla/js/src/js.c
mozilla/js/src/js.msg

Comment 1

[Patrick C. Beard]

Attachment: Stack crawl of crash

Comment 2

[Brendan Eich [:brendan]]

Update your js/src/liveconnect and rebuild -- that may fix it, although your
stack doesn't show the top frames I'd expect.

/be

Comment 3

[Patrick C. Beard]

Using my debugger, I determined that the crash is occurring on line 1216 of 
jsgc.c; evidently the finalizer that is getting called is garbage.

Comment 4

[Brendan Eich [:brendan]]

That's a static array element, referring to a C function.  What can go wrong? 
Anyway to test that boehm isn't involved?

/be

Comment 5

[Patrick C. Beard]

Yup, that fixed it. Closing bug.

Comment 6

[Phil Schwartau]

Marking Verfied -