993 - Unhandled exception in jsapi

Status: VERIFIED WONTFIX

(Core :: JavaScript Engine, defect, P2)

Description

[Bryce Harrington]

Unhandled exception.  This time in jsapi.c, line 829.
(I'm guessing this is part of the javascript module.)

I had about 8 windows open when the crash occurred.
I'd been looking at BBS CGI scripts, and had just
closed a window.

This occurred on Win95 running Moz-980904.

Cause:
------
The debugger indicates that the exception was
somewhere inside of:

JS_PUBLIC_API(void)
JS_GC(JSContext *cx)
{
    if (!cx->fp)
	PR_FinishArenaPool(&cx->stackPool);
 /* >> */   PR_FinishArenaPool(&cx->codePool);
    PR_FinishArenaPool(&cx->tempPool);
    js_ForceGC(cx);
}

The debugger only traces into PR_FinishArenaPool in the dissassembly window,
which I can't follow.  So I can't find the precise cause.

I am guessing that the above code is supposed
to be more like this:

JS_PUBLIC_API(void)
JS_GC(JSContext *cx)
{
    if (!cx->fp) {
	PR_FinishArenaPool(&cx->stackPool);
      PR_FinishArenaPool(&cx->codePool);
      PR_FinishArenaPool(&cx->tempPool);
      js_ForceGC(cx);
    }
}

PLEASE let me know if this is correct or not, and if not,
what a better solution might be.

Stack Trace:
------------
KERNEL32! bff76693()
FreeArenaList(PLArenaPool * 0x026c4158, PLArena * 0x026c4158, int 1) line 137 +
61 bytes
PL_FinishArenaPool(PLArenaPool * 0x026c4158) line 185 + 15 bytes
JS_GC(JSContext * 0x026c4120) line 829 + 12 bytes
LM_ReleaseDocument(MWContext_ * 0x026c2830, int 0) line 1868 + 10 bytes
et_releasedocument_handler(ReleaseDocStruct * 0x026723d0) line 1436 + 19 bytes
PL_HandleEvent(PLEvent * 0x026723d0) line 395 + 10 bytes
et_SubEventLoop(QueueStackElement * 0x00ed5570) line 2311 + 9 bytes
lm_wait_for_events(void * 0x00000000) line 2366 + 11 bytes
_PR_NativeRunThread(void * 0x00ed9280) line 381 + 13 bytes
_threadstartex(void * 0x00ed9440) line 212 + 13 bytes
KERNEL32! bff86917()
KERNEL32! bff84327()
00000006()

Comment 1

[Mike McCabe]

I'll accept this bug for now, but I'm afraid I can't do very much about it
without knowing more about the situation in which it occurs.  Unfortunately, the
original error that caused javascript to crash could be just about anywhere in
the libmocha or javascript code.  Do you have a more reproducible testcase for
this error?

Comment 2

[leger]

Setting all current Open/Normal to M4.

Comment 3

[Paul MacQuiddy]

per leger, assigning QA contacts to all open bugs without QA contacts according
to list at http://bugzilla.mozilla.org/describecomponents.cgi?product=Browser

Comment 4

[Mike McCabe]

Thanks again for the original bug report.

I'm going to mark this one wontfix -

crashes in the javascript GC can be caused by just about anything in the
program; e.g. another part of the program frees something that the GC thinks it
owns.  Given that the codebase now is much changed from the original mozilla
classic codebase, it's not too likely that this particular bug is still around.
(Though many similar ones may still be.)

If you notice that our current build has the same problem, please line up a
reproducible testcase and file another bug against me.

Thanks -
Mike

Comment 5

[leger]

Changing component to "Javascript Engine".  "Javascript" component is being
retired.

Comment 6

[leger]

Marking Verified/Won't Fix.

Comment 7

[[github robot]]

Commits pushed to master at https://github.com/mozilla/olympia

https://github.com/mozilla/olympia/commit/60eba46a5cecf96ba5ca1b28409d88df5f351024
Don't display a red warning if there are unsupported platforms on add-on submission (issue #993)

https://github.com/mozilla/olympia/commit/e2e1211ae129e1bde080cae441da3316e1962a23
Merge pull request #1045 from magopian/993-dont-display-red-warning-if-platforms-unsupported

Don't display a red warning if there are unsupported platforms on add-on submission (issue #993)

Comment 8

[Mathieu Agopian [:magopian]]

Sorry about the previous comment, totally unrelated, linked to a github issue, and a misbehaving web hook.