Closed Bug 1055039 Opened 10 years ago Closed 6 years ago

Crash [@ js::ObjectImpl::lastProperty] or Opt-Crash [@ js::SavedStacksMetadataCallback] with enableTrackAllocations

Categories

(Core :: JavaScript Engine, defect)

x86_64
Linux
defect
Not set
critical

Tracking

()

RESOLVED WORKSFORME
Tracking Status
firefox34 --- affected

People

(Reporter: decoder, Unassigned)

Details

(Keywords: crash, testcase, Whiteboard: [jsbugmon:update,ignore])

Crash Data

Attachments

(1 file)

The following testcase crashes on mozilla-central revision 0aaa2d3d15cc (threadsafe build, run with --fuzzing-safe --thread-count=2):


var lfcode = new Array();
lfcode.push("");
lfcode.push("");
lfcode.push("1");
lfcode.push("enableTrackAllocations();\n");
lfcode.push("");
lfcode.push("evaluate");
lfcode.push("");
lfcode.push("4");
lfcode.push("\
  var otherGlobalSameCompartment = newGlobal('same-compartment');\
  unescape = otherGlobalSameCompartment.eval;\
");
lfcode.push("evaluate");
while (true) {
	var file = lfcode.shift(); if (file == undefined) { break; }
        unescape("x");
        loadFile(file)
}
function loadFile(lfVarx) {
    try {
        if (lfVarx.substr(-3) != ".js" && lfVarx.length != 1) {
            switch (lfRunTypeId) {
                case 1: eval(lfVarx); break;
                case 4: eval("(function() { " + lfVarx + " })();"); break;
            }
        } else if (!isNaN(lfVarx)) {
            lfRunTypeId = parseInt(lfVarx);
        }
    } catch (lfVare) {}
}
Crash Signature: [@ js::ObjectImpl::lastProperty] or Opt-Crash [@ js::SavedStacksMetadataCallback] → [@ js::ObjectImpl::lastProperty] [@ js::SavedStacksMetadataCallback]
Whiteboard: [jsbugmon:update,bisect]
Crash Signature: [@ js::ObjectImpl::lastProperty] [@ js::SavedStacksMetadataCallback] → [@ js::ObjectImpl::lastProperty] [@ js::SavedStacksMetadataCallback]
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
Crash Signature: [@ js::ObjectImpl::lastProperty] [@ js::SavedStacksMetadataCallback] → [@ js::ObjectImpl::lastProperty] [@ js::SavedStacksMetadataCallback]
Crash Signature: [@ js::ObjectImpl::lastProperty] [@ js::SavedStacksMetadataCallback] → [@ js::ObjectImpl::lastProperty] [@ js::SavedStacksMetadataCallback]
Whiteboard: [jsbugmon:update] → [jsbugmon:update,ignore]
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 1ddfd9afba40).
Closing because no crash reported since 12 weeks.
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → WONTFIX
Reopening because crash bugs **with testcases** should not be resolved **as WONTFIX** based on queries of crash-stats.  Other resolutions may be appropriate for other reasons.

(Crash signatures are not the same as bug identity; they're merely a search aid to find and group similar crashes.  The bug may still be present, but the signature may have changed slightly, or the bug may even still be present with the same signature but there are simply no recent reports of crashes in that function.)
Status: RESOLVED → REOPENED
Resolution: WONTFIX → ---
:decoder, is this bug still alive ?
Crash Signature: [@ js::ObjectImpl::lastProperty] [@ js::SavedStacksMetadataCallback] → [@ js::ObjectImpl::lastProperty] [@ js::SavedStacksMetadataCallback]
Flags: needinfo?(choller)
This doesn't reproduce anymore for me, but I don't know what fixed this. Marking as WFM.
Status: REOPENED → RESOLVED
Closed: 6 years ago6 years ago
Flags: needinfo?(choller)
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: