Closed Bug 484120 Opened 13 years ago Closed 13 years ago

TM: non-primitive array index crashes in jstracer.cpp

Categories

(Core :: JavaScript Engine, defect, P1)

x86
macOS
defect

Tracking

()

RESOLVED FIXED

People

(Reporter: gal, Assigned: gal)

References

Details

(Keywords: fixed1.9.1, Whiteboard: fixed-in-tracemonkey)

Attachments

(1 file)

Bug 483940 will properly trace this case. For now just abort to stop us from crashing.
Flags: blocking1.9.1?
Attached patch patchSplinter Review
Assignee: general → gal
Attachment #368171 - Flags: review?
Attachment #368171 - Flags: review? → review?(jwalden+bmo)
Attachment #368171 - Flags: review?(jwalden+bmo) → review+
Blocks: 483940
Priority: -- → P1
http://hg.mozilla.org/tracemonkey/rev/cc8876dd6f09

This bug hits cnn.com. If it cycles green I suggest merging into m-c before the nightlies go out.
Whiteboard: fixed-in-tracemonkey
(In reply to comment #2)
> http://hg.mozilla.org/tracemonkey/rev/cc8876dd6f09
> 
> This bug hits cnn.com. If it cycles green I suggest merging into m-c before the
> nightlies go out.

This checkin on TM looks like it turned Windows & Linux boxes orange.


*** 804 ERROR TEST-UNEXPECTED-FAIL | chrome://mochikit/content/chrome/toolkit/content/tests/chrome/test_bug418874.xul | t1 value correct following input - got "", expected "1"
*** 805 ERROR TEST-UNEXPECTED-FAIL | chrome://mochikit/content/chrome/toolkit/content/tests/chrome/test_bug418874.xul | undo correctly enabled when emptyText was not changed through property - got false, expected true
*** 807 ERROR TEST-UNEXPECTED-FAIL | chrome://mochikit/content/chrome/toolkit/content/tests/chrome/test_bug418874.xul | t2 value correct following input - got "", expected "2"
*** 808 ERROR TEST-UNEXPECTED-FAIL | chrome://mochikit/content/chrome/toolkit/content/tests/chrome/test_bug418874.xul | undo correctly enabled when emptyText explicitly changed through property - got false, expected true
(In reply to comment #3)
> (In reply to comment #2)
> This checkin on TM looks like it turned Windows & Linux boxes orange.

The linux orange is a known intermittent failure.

#15 on http://tedscomputer.homeip.net:8000/topfails 


The windows orange was completely different. It was a crash in the font code according to the stack trace in the log.

xul.dll!gfxTextRun::FindFirstGlyphRunContaining(unsigned int) [gfxFont.cpp:cc8876dd6f09 : 2175 + 0x3]
http://hg.mozilla.org/mozilla-central/rev/cc8876dd6f09
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Flags: blocking1.9.1? → blocking1.9.1+
You need to log in before you can comment on or make changes to this bug.