Closed Bug 510449 Opened 11 years ago Closed 11 years ago

Bug 493457 causes crash on x64 windows build because JSSLOT_CLASS_MASK_BITS is uint32

Categories

(Core :: JavaScript Engine, defect)

x86_64
All
defect
Not set
normal

Tracking

()

RESOLVED FIXED
mozilla1.9.3a1
Tracking Status
status1.9.2 --- beta1-fixed

People

(Reporter: m_kato, Assigned: m_kato)

References

Details

(Whiteboard: fixed-in-tracemonkey)

Attachments

(1 file)

Attached patch patch v1Splinter Review
Since JSSLOT_CLASS_MASK_BITS is uint32 type, ~JSSLOT_CLASS_MASK_BITS is 32bit value on cl.exe for x64.  So JSObject::getClass() always return invalid pointer.

This code was checked in by Bug 493457.
Duplicate of this bug: 510445
Attachment #394479 - Flags: review?(mrbkap)
OS: Windows NT → All
Blocks: 493457
Attachment #394479 - Flags: review?(mrbkap) → review+
Comment on attachment 394479 [details] [diff] [review]
patch v1

I happen to still be awake, I'll save mrbkap from this one since I asked for its introduction.  :-\  No pushing for me now, either someone else will get it first or I do it sometime tomorrow (today).
Duplicate of this bug: 510522
http://hg.mozilla.org/mozilla-central/rev/549f8ed44c5e
http://hg.mozilla.org/tracemonkey/rev/e29aaba07431
Assignee: general → m_kato
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
Whiteboard: fixed-in-tracemonkey
Target Milestone: --- → mozilla1.9.3
Target Milestone: mozilla1.9.3 → mozilla1.9.3a1
Attachment #394479 - Flags: approval1.9.2?
Attachment #394479 - Flags: approval1.9.2? → approval1.9.2+
Duplicate of this bug: 515101
You need to log in before you can comment on or make changes to this bug.