TM: Crash [@ js_UnboxDouble(int) ] on certain page.

RESOLVED WORKSFORME

Status

()

Core
JavaScript Engine
--
critical
RESOLVED WORKSFORME
8 years ago
7 years ago

People

(Reporter: Alice0775 White, Assigned: Waldo)

Tracking

({crash, regression})

Trunk
x86
Windows 7
crash, regression
Points:
---

Firefox Tracking Flags

(blocking2.0 beta5+)

Details

(crash signature, URL)

(Reporter)

Description

8 years ago
User-Agent:       Mozilla/5.0 (Windows; Windows NT 6.1; WOW64; en-US; rv:2.0b2pre) Gecko/20100712 Firefox/4.0b2pre ID:20100712040843
Build Identifier: Mozilla/5.0 (Windows; Windows NT 6.1; WOW64; en-US; rv:2.0b2pre) Gecko/20100712 Firefox/4.0b2pre ID:20100712040843

Browser crashes on certain page.

If Disable javascript.options.jit.content, the browser does not crash.

Crash reports:
bp-69869d2e-ee89-4b58-9592-07a642100712
bp-f1f51298-3675-4366-8d2c-e3b202100712

Reproducible: Always

Steps to Reproduce:
1. Start Minefield with new profile
2. Open URL ( http://mb.softbank.jp/mb/product/ )
3. Click "SoftBank 3G" at middle-left of the page
4. 

Actual Results:
 Browser crashes with crash reports

Expected Results:
 Not crash
(Reporter)

Comment 1

8 years ago
Works:
http://hg.mozilla.org/mozilla-central/rev/38ee63fd5e34
Mozilla/5.0 (Windows; U; Windows NT 6.1; WOW64; en-US; rv:1.9.3a5pre) Gecko/20100606 Minefield/3.7a5pre ID:20100606121442

Fails:
http://hg.mozilla.org/mozilla-central/rev/5b3604a3cfbe
Mozilla/5.0 (Windows; U; Windows NT 6.1; WOW64; en-US; rv:1.9.3a5pre) Gecko/20100606 Minefield/3.7a5pre ID:20100606130824

Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=38ee63fd5e34&tochange=5b3604a3cfbe

Comment 2

8 years ago
Thats a 119 changeset merge. If you can bisect this down a bit more that would be awesome. Thanks!
(Reporter)

Comment 3

8 years ago
In tracemonkey build: 
sometime i get different ID [@ js::ExecuteTree ] -- Bug 571626 
bp-263268cc-7ae2-4676-892b-5dd122100712
bp-24c7f7c1-3de3-4f98-8fb3-b9e692100712

Works:
http://hg.mozilla.org/tracemonkey/rev/8f08ae0b74df
Mozilla/5.0 (Windows; U; Windows NT 6.1; WOW64; en-US; rv:1.9.3a5pre) Gecko/20100604 Minefield/3.7a5pre ID:20100604043239

Fails:
http://hg.mozilla.org/tracemonkey/rev/b3e27c1ee35e
Mozilla/5.0 (Windows; U; Windows NT 6.1; WOW64; en-US; rv:1.9.3a5pre) Gecko/20100605 Minefield/3.7a5pre ID:20100605043211

Pushlog:
http://hg.mozilla.org/tracemonkey/pushloghtml?fromchange=8f08ae0b74df&tochange=b3e27c1ee35e
(Reporter)

Updated

8 years ago
Keywords: crash
(Reporter)

Comment 4

8 years ago
When I backed out b3e27c1ee35e from local build, then the browser does not crash.
So, I  guess landing of Bug 548671 causes the problem.
Blocks: 548671
Status: UNCONFIRMED → NEW
Ever confirmed: true
(Reporter)

Updated

8 years ago
Keywords: regression

Comment 5

8 years ago
Thanks Alice!
Assignee: general → jwalden+bmo
blocking2.0: --- → ?

Updated

8 years ago
blocking2.0: ? → beta5+
(Reporter)

Comment 6

7 years ago
Works For me on Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0b4pre) Gecko/20100814 Minefield/4.0b4pre ID:20100814040443

Fixed range:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=5aeec895393f&tochange=ddedaa587215
Status: NEW → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → WORKSFORME
Crash Signature: [@ js_UnboxDouble(int) ]
You need to log in before you can comment on or make changes to this bug.