499610 - TM: Crash during local mochitest-browser-chrome run [@ SetProperty_tn]

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect, P1)

Description

[Nochum Sossonko [:Natch]]

Attachment: crash-stack + debugger info

I can reproduce this on m-c tip reliably, so I caught it in a debugger on a debug build, stack attached.

The crash happens right after/during this run:

TEST-PASS | chrome://mochikit/content/browser/browser/base/content/test/browser_
sanitize-timespans.js | Checking for b4today form history entry creation

Comment 1

[Nochum Sossonko [:Natch]]

This *might* be a tracemonkey chrome-jit bug, I changed my srcdir to enable chrome jit by default, so unless the mochitest-harness explicitly disables it, it should be enabled.

That may also explain why it isn't showing up on tinderbox...

Comment 2

[Nochum Sossonko [:Natch]]

Confirmed that theory on tm-tip, with chrome jit enabled it crashes, otherwise it's fine.

Comment 3

[Robert Sayre]

what platform?

Comment 4

[Nochum Sossonko [:Natch]]

Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2a1pre) Gecko/20090623 Minefield/3.6a1pre

Windows/Vista x86

Comment 5

[Nochum Sossonko [:Natch]]

This is an invalid pointer write, not a null deref. According to the page explaining how to detect security crashes, this one qualifies as it is non-null and not near-null. Should this be marked security-sensitive?

Just asking, because I know there's been an increase in vigilance in that direction...

Comment 6

[Nochum Sossonko [:Natch]]

Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2a1pre) Gecko/20090724 Minefield/3.6a1pre

WFM now.