397311 - Crash at js3250!JS_ValueToObject running test_js_weak_references.js

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Alex Vincent [:WeirdAl]]

Attachment: stack trace

Firefox trunk build from today, with this mozconfig:

#
# See http://www.mozilla.org/build/ for build instructions.
#

. $topsrcdir/browser/config/mozconfig

# Options for client.mk.
mk_add_options MOZ_CO_PROJECT=suite,browser,mail,xulrunner
mk_add_options MOZ_OBJDIR=@TOPSRCDIR@/../fx-debug

# Options for 'configure' (same as command-line options).
ac_add_options --enable-svg
ac_add_options --enable-mathml
ac_add_options --disable-installer
ac_add_options --disable-activex
ac_add_options --disable-activex-scripting
ac_add_options --disable-xpconnect-idispatch
ac_add_options --enable-debug
ac_add_options --disable-optimize
ac_add_options --enable-chrome-format=flat
ac_add_options --enable-extensions=default,venkman,inspector
ac_add_options --disable-accessibility

I've been seeing JS assertion failures running the same test on Mac, but I haven't reported it yet because I couldn't get a useful stack.

Comment 1

[Ben Turner (not reading bugmail, use the needinfo flag!)]

Attachment: Likely fix

Need an autorequest.

Comment 2

[Brendan Eich [:brendan]]

Ben, care to take this bug?

/be

Comment 3

[Brendan Eich [:brendan]]

Comment on attachment 282071 [details] [diff] [review]
Likely fix

More like this? Look for GetArgvPtr.

/be

Comment 4

[Ben Turner (not reading bugmail, use the needinfo flag!)]

Yeah, there are a few others. Patch in a bit.

Comment 5

[Johnny Stenback (:jst)]

Comment on attachment 282071 [details] [diff] [review]
Likely fix

sr+a=jst

Comment 6

[Ben Turner (not reading bugmail, use the needinfo flag!)]

Filed bug 397319 for the remaining uses of GetArgvPtr.

Comment 7

[Ben Turner (not reading bugmail, use the needinfo flag!)]

Fixed.

Comment 8

[Bob Clary [:bc] (inactive)]

test not in js suite but in xpconnect at /js/src/xpconnect/tests/unit/test_js_weak_references.js

Comment 9

[Alex Vincent [:WeirdAl]]

clearing blocking flag on a fixed bug

Comment 10

[Bob Clary [:bc] (inactive)]

v 1.9.0 based on tinderbox logs