Closed Bug 1175339 Opened 9 years ago Closed 9 years ago

crash @ js::IsSymbolOrSymbolWrapper(JS::Value)

Categories

(Core :: JavaScript Engine: JIT, defect)

defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 1174547

People

(Reporter: wgianopoulos, Unassigned)

References

()

Details

(Keywords: regression)

Crash Data

Broser crashes when visiting URL http://www.siriusxm.com/stars
Platform > All

since it crashes on 64-bit linux and 32 bit windows.  It does not crash with 6/8 Nightly I will bisect this further.
Keywords: regression
OS: Unspecified → All
Hardware: Unspecified → All
Version: unspecified → Trunk
hg bisect identified:

The first bad revision is:
changeset:   248305:e51492b08d25
user:        Nicolas B. Pierron <nicolas.b.pierron@mozilla.com>
date:        Thu Jun 11 14:30:29 2015 +0200
summary:     Bug 1165348 - Move Scalar Replacement after GVN. r=jandem
Blocks: 1165348
This is a sample crash from Linux:

bp-7b6a2d08-4c90-40aa-a7ec-e28fa2150617
Crash Signature: js::IsSymbolOrSymbolWrapper(JS::Value)
Here are the crashes from windows.  I just noticed that the crash signature is different.  The bisecting was done under Linux.

bp-769757f8-9bac-4b3d-b370-028d12150616
bp-0ba8753c-2a7c-41e2-87e7-01d2b2150616
bp-78aaabce-db51-4887-ab5b-35cde2150616
bp-f7c6462d-56e8-4696-9c88-4ab702150616
So, I guess this is likely a duplicate of bug 1175350.
Crash Signature: js::IsSymbolOrSymbolWrapper(JS::Value) → [@ js::IsSymbolOrSymbolWrapper(JS::Value) ] [@ js::ValueToId<T>(js::ExclusiveContext*, JS::Handle<T>, JS::MutableHandle<T>) ]
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → DUPLICATE
I was unable to reproduce this Crash on a custom build including Bug 1174322, Bug 1174547, and Bug 1175233 patches.
You need to log in before you can comment on or make changes to this bug.