756799 - crash in TypeConstraintCall::newType

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Scoobidiver (away)]

It first appeared in 15.0a1/20120519. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=e794cef56df6&tochange=642d1a36702f

Signature 	TypeConstraintCall::newType(JSContext*, js::types::TypeSet*, js::types::Type) More Reports Search
UUID	ed7a8853-b61f-448f-ab4f-417b72120519
Date Processed	2012-05-19 17:29:36
Uptime	10109
Install Age	3.5 hours since version was first installed.
Install Time	2012-05-19 13:57:49
Product	Firefox
Version	15.0a1
Build ID	20120519030527
Release Channel	nightly
OS	Windows NT
OS Version	6.1.7601 Service Pack 1
Build Architecture	x86
Build Architecture Info	GenuineIntel family 6 model 15 stepping 11
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0xffffffffdadadada
App Notes 	
AdapterVendorID: 0x1002, AdapterDeviceID: 0x9490, AdapterSubsysID: 20091787, AdapterDriverVersion: 8.961.0.0
D2D? D2D+ DWrite? DWrite+ D3D10 Layers! D3D10 Layers+ 
EMCheckCompatibility	True
Total Virtual Memory	4294836224
Available Virtual Memory	2993168384
System Memory Use Percentage	56
Available Page File	9375748096
Available Physical Memory	2819186688

Frame 	Module 	Signature 	Source
0 	mozjs.dll 	TypeConstraintCall::newType 	js/src/jsinfer.cpp:1135
1 	mozjs.dll 	js::types::TypeCompartment::resolvePending 	js/src/jsinferinlines.h:843
2 	mozjs.dll 	js::types::TypeSet::add 	js/src/jsinfer.cpp:429
3 	mozjs.dll 	js::types::TypeSet::addCall 	js/src/jsinfer.cpp:674
4 	mozjs.dll 	js::analyze::ScriptAnalysis::analyzeTypesBytecode 	js/src/jsinfer.cpp:3813
5 	mozjs.dll 	js::analyze::ScriptAnalysis::analyzeTypes 	js/src/jsinfer.cpp:4151
6 	mozjs.dll 	JSScript::ensureRanInference 	js/src/jsinferinlines.h:1485
7 	mozjs.dll 	js::mjit::Compiler::checkAnalysis 	js/src/methodjit/Compiler.cpp:178
8 	mozjs.dll 	js::mjit::Compiler::performCompilation 	js/src/methodjit/Compiler.cpp:535
9 	mozjs.dll 	js::mjit::Compiler::compile 	js/src/methodjit/Compiler.cpp:146
10 	mozjs.dll 	js::mjit::CanMethodJIT 	js/src/methodjit/Compiler.cpp:1000
11 	mozjs.dll 	js::RunScript 	js/src/jsinterp.cpp:291
12 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:359
13 	mozjs.dll 	js::Invoke 	js/src/jsinterp.cpp:391
14 	mozjs.dll 	js::IndirectProxyHandler::call 	js/src/jsproxy.cpp:471
15 	mozjs.dll 	js::CrossCompartmentWrapper::call 	js/src/jswrapper.cpp:684
16 	mozjs.dll 	js::Proxy::call 	js/src/jsproxy.cpp:1095
17 	mozjs.dll 	proxy_Call 	js/src/jsproxy.cpp:1608
18 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:336
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=TypeConstraintCall%3A%3AnewType%28JSContext*%2C+js%3A%3Atypes%3A%3ATypeSet*%2C+js%3A%3Atypes%3A%3AType%29
https://crash-stats.mozilla.com/report/list?signature=TypeConstraintCall%3A%3AnewType

Comment 1

[Scoobidiver (away)]

It's fixed by http://hg.mozilla.org/mozilla-central/rev/fb3036d9b9e6.