Crash at js3250!JS_ValueToObject running test_js_weak_references.js

VERIFIED FIXED

Status

()

Core
JavaScript Engine
--
critical
VERIFIED FIXED
11 years ago
10 years ago

People

(Reporter: WeirdAl, Assigned: Ben Turner (not reading bugmail, use the needinfo flag!))

Tracking

({crash, testcase})

unspecified
x86
Windows XP
crash, testcase
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(2 attachments)

(Reporter)

Description

11 years ago
Created attachment 282070 [details]
stack trace

Firefox trunk build from today, with this mozconfig:

#
# See http://www.mozilla.org/build/ for build instructions.
#

. $topsrcdir/browser/config/mozconfig

# Options for client.mk.
mk_add_options MOZ_CO_PROJECT=suite,browser,mail,xulrunner
mk_add_options MOZ_OBJDIR=@TOPSRCDIR@/../fx-debug

# Options for 'configure' (same as command-line options).
ac_add_options --enable-svg
ac_add_options --enable-mathml
ac_add_options --disable-installer
ac_add_options --disable-activex
ac_add_options --disable-activex-scripting
ac_add_options --disable-xpconnect-idispatch
ac_add_options --enable-debug
ac_add_options --disable-optimize
ac_add_options --enable-chrome-format=flat
ac_add_options --enable-extensions=default,venkman,inspector
ac_add_options --disable-accessibility

I've been seeing JS assertion failures running the same test on Mac, but I haven't reported it yet because I couldn't get a useful stack.
Flags: blocking1.9?
(Reporter)

Updated

11 years ago
Blocks: 317304
Created attachment 282071 [details] [diff] [review]
Likely fix

Need an autorequest.
Attachment #282071 - Flags: review?(brendan)
Blocks: 396452
No longer blocks: 317304
Ben, care to take this bug?

/be
Comment on attachment 282071 [details] [diff] [review]
Likely fix

More like this? Look for GetArgvPtr.

/be
Attachment #282071 - Flags: review?(brendan) → review+
Yeah, there are a few others. Patch in a bit.
Comment on attachment 282071 [details] [diff] [review]
Likely fix

sr+a=jst
Attachment #282071 - Flags: superreview+
Attachment #282071 - Flags: approval1.9?
Attachment #282071 - Flags: approval1.9+
Filed bug 397319 for the remaining uses of GetArgvPtr.
Assignee: general → bent.mozilla
Fixed.
Status: NEW → RESOLVED
Last Resolved: 11 years ago
Resolution: --- → FIXED

Comment 8

11 years ago
test not in js suite but in xpconnect at /js/src/xpconnect/tests/unit/test_js_weak_references.js
Flags: in-testsuite+
(Reporter)

Comment 9

10 years ago
clearing blocking flag on a fixed bug
Flags: blocking1.9?

Comment 10

10 years ago
v 1.9.0 based on tinderbox logs
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.