While testing, I keep getting hit by these kind of crashes. http://crash-stats.mozilla.com/report/index/bp-f207ec22-5176-4fc1-b135-a931e2100914 0 xul.dll js_ConcatStrings js/src/jsstr.cpp:382 1 xul.dll js::mjit::stubs::Add js/src/methodjit/StubCalls.cpp:1216 It would be nice if it could get fixed.

Do you know when it started?

Probably when tracemonkey landed or something.

This patch probably fixes this issue. It fixes a stupid OOM-propagation bug. I'm flagging gal for review, since he reviewed the original ropes patch. Here's the story to explain the line number (the line is a call to ObtainRopeBuffer, which is forced to be inlined, so the line number info just says that the crash happened in ObtainRopeBuffer), and why this would occur relatively rarely: -Concat strings is called where at least one argument is already a rope, and its underlying buffer is not big enough, so a new one needs to be malloced. -malloc inside ObtainRopeBuffer fails, so ObtainRopeBuffer returns NULL. -The NULL is sent to FinishConcat (instead of being propagated, as it should be), so we return a rope that is otherwise completely valid, except that the underlying buffer of the top node is instead NULL. -There are no (failed) mallocs until the next call to js_ConcatStrings. -The next call to js_ConcatStrings calls ObtainRopeBuffer, which tries to read from the NULL buffer, causing a crash.

I don't have commit access, so someone else needs to commit this.

Do we really think that we're in OOM when this hits? I would hope that'd be rarer than this bug seems to be...

(See also bug 597886.)

I was hitting this often while testing bug 581539.

Don't code else after return. Whoever lands this can fix with rs=me unless Alan wants to do a new patch. /be

I'm seeing a crash in js_ConcatStrings when I'm trying to download large files (Go-OO ~180Mb) in the latest nightly on Win XP. Crash report: http://crash-stats.mozilla.com/report/index/bp-c4440b0a-240b-431a-ac4f-fc6ad2100928 (there's a bunch more, but they all look the same to me)

http://hg.mozilla.org/tracemonkey/rev/aa2ca63a88d8 Refactored code to eliminate else-after-return. OK'd by Alan.