If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

Crash [@ TraceRecorder::attemptTreeCall] - js1_6/extensions/regress-472508.js

VERIFIED FIXED

Status

()

Core
JavaScript Engine
--
blocker
VERIFIED FIXED
8 years ago
6 years ago

People

(Reporter: bc, Assigned: dvander)

Tracking

({crash, regression, testcase})

Trunk
x86
Windows XP
crash, regression, testcase
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: fixed-in-tracemonkey, crash signature)

Attachments

(1 attachment)

(Reporter)

Description

8 years ago
+++ This bug was initially created as a clone of Bug #520003 +++

js1_6/extensions/regress-472508.js crashed debug shell and browser in winxp only. This is another regression from bug 459301
Flags: in-testsuite+
(Reporter)

Comment 1

8 years ago
+		&innermostNestedGuard	0x0012eea4	VMSideExit * *
+		cx	0xdddddddd {operationCallbackFlag=??? link={...} xmlSettingFlags=??? ...}	JSContext *
+		f	0x06933a10 {first=0x06933a10 next=0x00000000 peer=0x00000000 ...}	VMFragment *
		inlineCallCount	0	unsigned int &
+		lr	0x06da5300 {block=0x00000000 pc=0x00741e5d ":" imacpc=0x06da8ada "LÿûMœ" ...}	VMSideExit *
+		this	0x06da4048 {tempAlloc={...} mark={...} cx=0xdddddddd ...}	TraceRecorder * const

js3250.dll!TraceRecorder::attemptTreeCall(VMFragment * f=0x06933a10, unsigned int & inlineCallCount=0)  Line 5985 + 0x6 bytes	C++
js3250.dll!RecordLoopEdge(JSContext * cx=0x05198530, TraceRecorder * r=0x06da4048, unsigned int & inlineCallCount=0)  Line 5948 + 0x10 bytes	C++
js3250.dll!js_MonitorLoopEdge(JSContext * cx=0x05198530, unsigned int & inlineCallCount=0, MonitorReason reason=Monitor_Branch)  Line 6796 + 0x14 bytes	C++

mmm, deleted memory.
Severity: normal → blocker
Summary: Crash [ @ ] - js1_6/extensions/regress-472508.js → Crash [ @ TraceRecorder::attemptTreeCall] - js1_6/extensions/regress-472508.js
(Assignee)

Comment 2

8 years ago
Created attachment 404669 [details] [diff] [review]
fix

Good catch. Bug here is that I forgot to save |this->cx| when |this| can be destroyed.
Assignee: general → dvander
Status: NEW → ASSIGNED
Attachment #404669 - Flags: review?(gal)
jsfunfuzz has also been hitting this issue...

Comment 4

8 years ago
Comment on attachment 404669 [details] [diff] [review]
fix

Please use a comment or maybe localCx.
Attachment #404669 - Flags: review?(gal) → review+
(Assignee)

Comment 5

8 years ago
http://hg.mozilla.org/tracemonkey/rev/7f14152ae76f

pushed, renamed _cx to localCx.
Whiteboard: fixed-in-tracemonkey

Comment 6

8 years ago
http://hg.mozilla.org/mozilla-central/rev/7f14152ae76f
Status: ASSIGNED → RESOLVED
Last Resolved: 8 years ago
Resolution: --- → FIXED
(Reporter)

Comment 7

8 years ago
v 1.9.3
Status: RESOLVED → VERIFIED

Updated

8 years ago
Keywords: crash
Summary: Crash [ @ TraceRecorder::attemptTreeCall] - js1_6/extensions/regress-472508.js → Crash [@ TraceRecorder::attemptTreeCall] - js1_6/extensions/regress-472508.js
Crash Signature: [@ TraceRecorder::attemptTreeCall]
You need to log in before you can comment on or make changes to this bug.