Closed Bug 527261 Opened 13 years ago Closed 13 years ago

tests/js/jsd/test/test_bug507448.html test failure/crash after patch for 525481 landed [@fun_reserveSlots ]

Categories

(Core :: JavaScript Engine, defect, P1)

defect

Tracking

()

VERIFIED FIXED
mozilla1.9.3a1
Tracking Status
blocking2.0 --- alpha1+

People

(Reporter: brendan, Assigned: brendan)

References

Details

(Keywords: assertion, crash, regression, Whiteboard: fixed-in-tracemonkey)

Crash Data

Attachments

(2 files)

80 ERROR TEST-UNEXPECTED-FAIL | /tests/js/jsd/test/test_bug507448.html |
[SimpleTest/SimpleTest.js, window.onerror] An error occurred -
jsd.wrapValue(f).script is null at
http://localhost:8888/tests/js/jsd/test/test_bug507448.html:54
TEST-UNEXPECTED-FAIL | automation.py | Exited with code -1073741819 during test
run
TEST-UNEXPECTED-FAIL | automation.py | application crashed (minidump found)
TEST-UNEXPECTED-FAIL | automationutils.processLeakLog() | missing output line
for total leaks!
Attached file crash stack
Attached patch fixSplinter Review
The empty script optimization could fail due to debugger hooks, and if the script was being constructed by js_NewScriptFromCG then we'd leave fun->u.i.script NULL!

Worse, making a mutable empty script should have gone through the newScriptHook as usual. Fixing that consisted in letting the normal code in js_NewScriptFromCG create the mutable empty script, so the net patch for this bug and the one it blocks is smaller.

Good test, wish we could run it in the shell (xpc or js).

/be
Attachment #411024 - Flags: review?(igor)
This also causes the browser to crash when you load Dom Inspector.
http://hg.mozilla.org/tracemonkey/rev/e5c0a6d8be25

Thanks to sayrer for landing this. It needs to go into m-c too.

/be
Whiteboard: fixed-in-tracemonkey
I have verified that the patch here fixes the Mozilla Central Dom Inspector crash I mentioned in comment #3.
landed on mozilla-central as well.

http://hg.mozilla.org/mozilla-central/rev/499a3c1f0001
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Attachment #411024 - Flags: review?(igor) → review+
Duplicate of this bug: 527383
hmm, looks like this may be causing Windows leak test boxes to assert on startup. bah humbug.
Duplicate of this bug: 527399
Looks good in a tinderbox build. Will check again once we have new nightly builds.
Summary: tests/js/jsd/test/test_bug507448.html test failure after patch for 525481 landed → tests/js/jsd/test/test_bug507448.html test failure/crash after patch for 525481 landed [@fun_reserveSlots ]
Target Milestone: --- → mozilla1.9.3a1
The latest nightly build doesn't crash anymore when FlashGot is installed ( https://bugzilla.mozilla.org/show_bug.cgi?id=527399 )
The crash on OS X has gone too. Marking verified fixed with Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.3a1pre) Gecko/20091109 Minefield/3.7a1pre ID:20091109034249
Status: RESOLVED → VERIFIED
Fixed for me.

Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.3a1pre) Gecko/20091109 Minefield/3.7a1pre (.NET CLR 3.5.30729) ID:20091109043812
(In reply to comment #8)
> hmm, looks like this may be causing Windows leak test boxes to assert on
> startup. bah humbug.

Need some help debugging -- anyone able to reproduce under VS?

New bug blocking this one, at this point.

/be
Depends on: 527894
blocking2.0: ? → alpha1
Crash Signature: [@fun_reserveSlots ]
You need to log in before you can comment on or make changes to this bug.