Closed
Bug 496270
Opened 16 years ago
Closed 16 years ago
TM: crash [@ js_ValueToNumber] or [@ JS_Enumerate]; corrupted array?
Categories
(Core :: JavaScript Engine, defect, P1)
Tracking
()
RESOLVED
FIXED
| Tracking | Status | |
|---|---|---|
| status1.9.2 | --- | beta4-fixed |
| status1.9.1 | --- | unaffected |
People
(Reporter: jruderman, Assigned: dmandelin)
References
Details
(Keywords: crash, regression, testcase, Whiteboard: fixed-in-tracemonkey)
Crash Data
Attachments
(1 file)
|
1.38 KB,
patch
|
gal
:
review+
|
Details | Diff | Splinter Review |
+[(e = {}, (function () e)()) for each (e in ["", {}, "", {}, ""])][4];
Crash [@ js_ValueToNumber] touching 0x20000000
+[(e = {}, (function () e)()) for each (e in ["", {}, "", {}, ""])];
Crash [@ JS_Enumerate] touching 0x20000000
|
||
Comment 1•16 years ago
|
||
jit or no jit? or both?
|
|
||
Comment 2•16 years ago
|
||
JIT only, confirmed TM tip.
|
||
Comment 3•16 years ago
|
||
autoBisect shows this is probably related to bug 494269 :
The first bad revision is:
changeset: 28896:a16ed38ff63a
user: David Mandelin
date: Wed Jun 03 11:19:20 2009 -0700
summary: Bug 494269: trace JSOP_LAMBDA_FC, r=brendan,gal
|
Assignee | |
Comment 4•16 years ago
|
||
Still grinding away on this. Somehow a pointer to a bogus JSObject (junk instead of actual object data) gets stored to position 3 on the trace native stack. It appears to be code generated for a JSOP_NEXTITER. No idea why this happens yet.
|
|
Assignee | |
Comment 5•16 years ago
|
||
Caused by C++ semantics bustage on my part.
Assignee: general → dmandelin
Attachment #381874 -
Flags: review?(gal)
|
|
||
Comment 6•16 years ago
|
||
Comment on attachment 381874 [details] [diff] [review]
Patch
I would prefer not to use the tracker of "in-range" checks. Its safe here accidentally.
Attachment #381874 -
Flags: review?(gal) → review+
|
|
Assignee | |
Comment 7•16 years ago
|
||
Pushed to TM as a6f9df8c33a9.
|
||
Updated•16 years ago
|
Flags: blocking1.9.2? → blocking1.9.2+
|
|
||
Comment 8•16 years ago
|
||
(In reply to comment #7)
> Pushed to TM as a6f9df8c33a9.
Marking `fixed-in-tracemonkey` in whiteboard.
Whiteboard: fixed-in-tracemonkey
|
|
||
Comment 10•16 years ago
|
||
Status: NEW → RESOLVED
Closed: 16 years ago
Resolution: --- → FIXED
|
|
||
Comment 11•15 years ago
|
||
fixed on 192 a while back
http://hg.mozilla.org/releases/mozilla-1.9.2/rev/a6f9df8c33a9
status1.9.2:
--- → final-fixed
|
||
Updated•15 years ago
|
status1.9.1:
--- → unaffected
Flags: wanted1.9.0.x-
|
|
||
Updated•15 years ago
|
Group: core-security
|
||
Updated•14 years ago
|
Crash Signature: [@ js_ValueToNumber]
[@ JS_Enumerate]
|
||
Comment 12•12 years ago
|
||
Automatically extracted testcase for this bug was committed:
https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•