Closed
Bug 1055039
Opened 10 years ago
Closed 6 years ago
Crash [@ js::ObjectImpl::lastProperty] or Opt-Crash [@ js::SavedStacksMetadataCallback] with enableTrackAllocations
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
WORKSFORME
Tracking | Status | |
---|---|---|
firefox34 | --- | affected |
People
(Reporter: decoder, Unassigned)
Details
(Keywords: crash, testcase, Whiteboard: [jsbugmon:update,ignore])
Crash Data
Attachments
(1 file)
1.08 KB,
text/plain
|
Details |
The following testcase crashes on mozilla-central revision 0aaa2d3d15cc (threadsafe build, run with --fuzzing-safe --thread-count=2): var lfcode = new Array(); lfcode.push(""); lfcode.push(""); lfcode.push("1"); lfcode.push("enableTrackAllocations();\n"); lfcode.push(""); lfcode.push("evaluate"); lfcode.push(""); lfcode.push("4"); lfcode.push("\ var otherGlobalSameCompartment = newGlobal('same-compartment');\ unescape = otherGlobalSameCompartment.eval;\ "); lfcode.push("evaluate"); while (true) { var file = lfcode.shift(); if (file == undefined) { break; } unescape("x"); loadFile(file) } function loadFile(lfVarx) { try { if (lfVarx.substr(-3) != ".js" && lfVarx.length != 1) { switch (lfRunTypeId) { case 1: eval(lfVarx); break; case 4: eval("(function() { " + lfVarx + " })();"); break; } } else if (!isNaN(lfVarx)) { lfRunTypeId = parseInt(lfVarx); } } catch (lfVare) {} }
Reporter | ||
Updated•10 years ago
|
Crash Signature: [@ js::ObjectImpl::lastProperty] or Opt-Crash [@ js::SavedStacksMetadataCallback] → [@ js::ObjectImpl::lastProperty]
[@ js::SavedStacksMetadataCallback]
status-firefox34:
--- → affected
Whiteboard: [jsbugmon:update,bisect]
Reporter | ||
Comment 1•10 years ago
|
||
Reporter | ||
Updated•10 years ago
|
Crash Signature: [@ js::ObjectImpl::lastProperty]
[@ js::SavedStacksMetadataCallback] → [@ js::ObjectImpl::lastProperty]
[@ js::SavedStacksMetadataCallback]
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
Updated•10 years ago
|
Crash Signature: [@ js::ObjectImpl::lastProperty]
[@ js::SavedStacksMetadataCallback] → [@ js::ObjectImpl::lastProperty]
[@ js::SavedStacksMetadataCallback]
Reporter | ||
Updated•10 years ago
|
Crash Signature: [@ js::ObjectImpl::lastProperty]
[@ js::SavedStacksMetadataCallback] → [@ js::ObjectImpl::lastProperty]
[@ js::SavedStacksMetadataCallback]
Whiteboard: [jsbugmon:update] → [jsbugmon:update,ignore]
Reporter | ||
Comment 2•10 years ago
|
||
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 1ddfd9afba40).
Comment 3•6 years ago
|
||
Closing because no crash reported since 12 weeks.
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → WONTFIX
Reopening because crash bugs **with testcases** should not be resolved **as WONTFIX** based on queries of crash-stats. Other resolutions may be appropriate for other reasons. (Crash signatures are not the same as bug identity; they're merely a search aid to find and group similar crashes. The bug may still be present, but the signature may have changed slightly, or the bug may even still be present with the same signature but there are simply no recent reports of crashes in that function.)
Status: RESOLVED → REOPENED
Resolution: WONTFIX → ---
Comment 5•6 years ago
|
||
:decoder, is this bug still alive ?
Crash Signature: [@ js::ObjectImpl::lastProperty]
[@ js::SavedStacksMetadataCallback] → [@ js::ObjectImpl::lastProperty]
[@ js::SavedStacksMetadataCallback]
Flags: needinfo?(choller)
Reporter | ||
Comment 6•6 years ago
|
||
This doesn't reproduce anymore for me, but I don't know what fixed this. Marking as WFM.
Status: REOPENED → RESOLVED
Closed: 6 years ago → 6 years ago
Flags: needinfo?(choller)
Resolution: --- → WORKSFORME
You need to log in
before you can comment on or make changes to this bug.
Description
•