Closed
Bug 216320
Opened 21 years ago
Closed 21 years ago
[ABW]js_FinishTakingSrcNotes is exceeding the notes array
Categories
(Core :: JavaScript Engine, defect, P1)
Core
JavaScript Engine
Tracking
()
VERIFIED
FIXED
mozilla1.5beta
People
(Reporter: dbradley, Assigned: brendan)
Details
(Keywords: crash, js1.5)
Attachments
(5 files)
1.40 KB,
text/plain
|
Details | |
20.95 KB,
patch
|
Details | Diff | Splinter Review | |
2.66 KB,
patch
|
Details | Diff | Splinter Review | |
2.59 KB,
patch
|
shaver
:
review+
asa
:
approval1.5+
|
Details | Diff | Splinter Review |
136 bytes,
text/html
|
Details |
The SN_MAKE_TERMINATOR(¬es[totalCount]); line is exceeding the note's array passed in. Probably may some more adjusting like what was done in bug 215878?
Assignee | ||
Comment 2•21 years ago
|
||
dbradley: is this with the fixes for bug 215878 ? Can you give a stack trace, or better yet the script on which this happened? /be
Reporter | ||
Comment 3•21 years ago
|
||
I was just running the browser under Purify checking for something else, unfortunately I don't remember the specific thing I was doing. I was running the browser under Purify trying to diagnose another crash at the time. I'll look back and see if I figure out what I was doing. I meant to go back anyway and see if I could figure out what was going on, but got distracted. Yes, this occured with the patch(es) in bug 215878.
Reporter | ||
Comment 4•21 years ago
|
||
I've been unable to reproduce the problem since I first reported it. Unfortunately I didn't record what I was doing at the time. I'll keep an eye out and reopen if I come across it.
Status: NEW → RESOLVED
Closed: 21 years ago
Resolution: --- → WORKSFORME
Assignee | ||
Comment 6•21 years ago
|
||
bryner found a reproducible case, I think it's essentially this bug, modulo heap sensitivity. This needs to get fixed for 1.5 final. /be
Status: VERIFIED → REOPENED
Resolution: WORKSFORME → ---
Assignee | ||
Comment 7•21 years ago
|
||
Hope this is ok to attach, I didn't see anything confidential in it. /be
Assignee | ||
Updated•21 years ago
|
Status: REOPENED → ASSIGNED
Assignee | ||
Comment 9•21 years ago
|
||
I should write "KEEP CG_COUNT_FINAL_TRYNOTES IN SYNC WITH js_FinishTakingSrcNotes" 100 times on a blackboard. This fixes the bug, valgrind testifies that we're pure. diff -w version in a second for review. /be
Assignee | ||
Comment 10•21 years ago
|
||
Assignee | ||
Comment 11•21 years ago
|
||
Comment on attachment 130794 [details] [diff] [review] diff -w of last patch (review this) I hope shaver's around so this can get r= fast, and go in for 1.5. /be
Attachment #130794 -
Flags: review?(shaver)
Assignee | ||
Comment 12•21 years ago
|
||
Sorry for the mecha.mozilla.org link, it's easy to fix if it becomes impermanent. /be
Comment on attachment 130794 [details] [diff] [review] diff -w of last patch (review this) Looks good. sr=test-suite, and away? =)
Attachment #130794 -
Flags: review?(shaver) → review+
Assignee | ||
Comment 14•21 years ago
|
||
I'm sure Phil will make a regression test -- he always does ;-). Thanks, shaver. Now for 1.5final approval. This was a regression in 1.5beta. /be
Keywords: crash
Assignee | ||
Updated•21 years ago
|
Flags: blocking1.5+
Assignee | ||
Updated•21 years ago
|
Attachment #130794 -
Flags: approval1.5?
Comment 15•21 years ago
|
||
Comment on attachment 130794 [details] [diff] [review] diff -w of last patch (review this) a=asa (on behalf of drivers) for checkin to Mozilla 1.5
Attachment #130794 -
Flags: approval1.5? → approval1.5+
Assignee | ||
Comment 16•21 years ago
|
||
Fixed. /be
Status: ASSIGNED → RESOLVED
Closed: 21 years ago → 21 years ago
Resolution: --- → FIXED
Reporter | ||
Comment 17•21 years ago
|
||
>I should write "KEEP CG_COUNT_FINAL_TRYNOTES IN SYNC WITH
>js_FinishTakingSrcNotes" 100 times on a blackboard.
I'll be there with you, writing "Always post a test case"
Comment 18•21 years ago
|
||
Testcase added to JS testsuite: mozilla/js/tests/js1_5/Regress/regress-216320.js
Comment 19•21 years ago
|
||
Marking Verified FIXED. The above testcase does not crash for me in either the debug or optimized JS shell, on either WinNT or Linux -
Status: RESOLVED → VERIFIED
Updated•21 years ago
|
Keywords: verified1.5
Updated•19 years ago
|
Flags: testcase+
You need to log in
before you can comment on or make changes to this bug.
Description
•