915687 - crash in js::WorkerThreadState::finishParseTask(JSContext*, JSRuntime*, void*)

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Tracy Walker [:tracy]]

This bug was filed from the Socorro interface and is 
report bp-d250916d-8cde-4b73-b3de-8653a2130912.
=============================================================

Startup crasher in Nightly on Windows x86 builds. First appeared in 20130911030258

Frame 	Module 	Signature 	Source
0 	mozjs.dll 	js::WorkerThreadState::finishParseTask(JSContext *,JSRuntime *,void *) 	js/src/jsworkers.cpp
1 	mozjs.dll 	JS::FinishOffThreadScript(JSContext *,JSRuntime *,void *) 	js/src/jsapi.cpp
2 	xul.dll 	NotifyOffThreadScriptCompletedRunnable::Run() 	content/xul/content/src/nsXULElement.cpp
3 	xul.dll 	mozilla::HangMonitor::NotifyActivity(mozilla::HangMonitor::ActivityType) 	xpcom/threads/HangMonitor.cpp
4 	nss3.dll 	PR_Unlock 	nsprpub/pr/src/threads/combined/prulock.c
5 	xul.dll 	NS_ProcessNextEvent(nsIThread *,bool) 	obj-firefox/xpcom/build/nsThreadUtils.cpp
6 	xul.dll 	MessageLoop::RunHandler()

Comment 1

[Brian Hackett [Laid off!]]

Attachment: potential patch

Judging from the 0x5 crashing address and stack, I think the problem here is that finishing a parse task doesn't account for type objects in the parse compartment with a lazy proto.

Comment 2

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/7d020f55e9fc

Comment 3

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/7d020f55e9fc