306350 - Regression on JS testsuite: js1_5/Regress/regress-271716-n.js

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Blake Kaplan (:mrbkap) (inactive)]

Bob pointed me to a regression on js1_5/Regress/regress-271716-n.js . He can
only reproduce it in the browser. I'm currently attempting to reproduce it in
the (with TOO_MUCH_GC).

When I crashed in the debugger, I saw that the runtime's freelist contained a
bogus pointer (0x2). timeless says that he's seen that sort of corruption
before, though he was unable to track down the cause of it.

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

Another note that I forgot to include: when I crashed in the browser, the crash
was after running the script (which had correctly reported OOM) and when it was
trying to update the progressbar.

Comment 2

[Bob Clary [:bc] (inactive)]

I'm seeing timeouts in the current browser based tests on the qa farm and locally on winxp. mrbkap, still seeing a crash on linux?

Comment 3

[Blake Kaplan (:mrbkap) (inactive)]

I don't seem to be able to reproduce this anymore, no.

Comment 4

[Bob Clary [:bc] (inactive)]

I now see this in mac ppc and windows 1.9a1 builds from 20060520 at least on the qa farm machines.

Comment 5

[Mike Schroepfer]

BC is this still an issue?

Comment 6

[Bob Clary [:bc] (inactive)]

I can't reproduce on debug trunk|linux, debug 1.8|winxp, debug|trunk|winxp. ->WFM