Closed Bug 578261 Opened 15 years ago Closed 15 years ago

TM: Crash [@ js_UnboxDouble(int) ] on certain page.

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
Windows 7
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME
Tracking Flags:
Tracking Status
blocking2.0 --- beta5+

People

(Reporter: alice0775, Assigned: Waldo)

References

(
URL
)

Details

(Keywords: crash, regression)

Crash Data

User-Agent: Mozilla/5.0 (Windows; Windows NT 6.1; WOW64; en-US; rv:2.0b2pre) Gecko/20100712 Firefox/4.0b2pre ID:20100712040843 Build Identifier: Mozilla/5.0 (Windows; Windows NT 6.1; WOW64; en-US; rv:2.0b2pre) Gecko/20100712 Firefox/4.0b2pre ID:20100712040843 Browser crashes on certain page. If Disable javascript.options.jit.content, the browser does not crash. Crash reports: bp-69869d2e-ee89-4b58-9592-07a642100712 bp-f1f51298-3675-4366-8d2c-e3b202100712 Reproducible: Always Steps to Reproduce: 1. Start Minefield with new profile 2. Open URL ( http://mb.softbank.jp/mb/product/ ) 3. Click "SoftBank 3G" at middle-left of the page 4. Actual Results: Browser crashes with crash reports Expected Results: Not crash
Works: http://hg.mozilla.org/mozilla-central/rev/38ee63fd5e34 Mozilla/5.0 (Windows; U; Windows NT 6.1; WOW64; en-US; rv:1.9.3a5pre) Gecko/20100606 Minefield/3.7a5pre ID:20100606121442 Fails: http://hg.mozilla.org/mozilla-central/rev/5b3604a3cfbe Mozilla/5.0 (Windows; U; Windows NT 6.1; WOW64; en-US; rv:1.9.3a5pre) Gecko/20100606 Minefield/3.7a5pre ID:20100606130824 Pushlog: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=38ee63fd5e34&tochange=5b3604a3cfbe
Thats a 119 changeset merge. If you can bisect this down a bit more that would be awesome. Thanks!
In tracemonkey build: sometime i get different ID [@ js::ExecuteTree ] -- Bug 571626 bp-263268cc-7ae2-4676-892b-5dd122100712 bp-24c7f7c1-3de3-4f98-8fb3-b9e692100712 Works: http://hg.mozilla.org/tracemonkey/rev/8f08ae0b74df Mozilla/5.0 (Windows; U; Windows NT 6.1; WOW64; en-US; rv:1.9.3a5pre) Gecko/20100604 Minefield/3.7a5pre ID:20100604043239 Fails: http://hg.mozilla.org/tracemonkey/rev/b3e27c1ee35e Mozilla/5.0 (Windows; U; Windows NT 6.1; WOW64; en-US; rv:1.9.3a5pre) Gecko/20100605 Minefield/3.7a5pre ID:20100605043211 Pushlog: http://hg.mozilla.org/tracemonkey/pushloghtml?fromchange=8f08ae0b74df&tochange=b3e27c1ee35e
Keywords: crash
When I backed out b3e27c1ee35e from local build, then the browser does not crash. So, I guess landing of Bug 548671 causes the problem.
Blocks: 548671
Status: UNCONFIRMED → NEW
Ever confirmed: true
Keywords: regression
Thanks Alice!
Assignee: general → jwalden+bmo
blocking2.0: --- → ?
blocking2.0: ? → beta5+
Works For me on Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0b4pre) Gecko/20100814 Minefield/4.0b4pre ID:20100814040443 Fixed range: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=5aeec895393f&tochange=ddedaa587215
Status: NEW → RESOLVED
Closed: 15 years ago
Resolution: --- → WORKSFORME
Crash Signature: [@ js_UnboxDouble(int) ]
You need to log in before you can comment on or make changes to this bug.