Closed Bug 580144 Opened 13 years ago Closed 13 years ago

JM: mochitest-plain crash on Windows only: test_MochiKit-Base.html


(Core :: JavaScript Engine, defect)

Not set





(Reporter: dmandelin, Assigned: dmandelin)



We crash getting a cached native iterator.
Summary: JM: mochitest-plain crash: test_sanity.html → JM: mochitest-plain crash: test_MochiKit-Base.html
This is a tough one. It appears that the last 10-15 elements of the native iterator cache get corrupted. The corruption does not appear to happen in the interpreter; it seems to be either something with JM or something with the browser. The crash happens every time, but not always at the same point, so it seems hard to pinpoint the corruption using watchpoints.

This appears only on Windows.

The bug started in moo rev 47887, which is basically a build-fix of rev 47885, which is a merge from TM. The parent revs to the merge rev are OK, so the bug somehow appeared either due to error performing the merge, or more likely, an interaction that appeared with the merge change.

The crash appears if the method JIT is turned off via browser pref (in
The crash does not appear if the method JIT is disabled in the build (with --disable-methodjit).
Summary: JM: mochitest-plain crash: test_MochiKit-Base.html → JM: mochitest-plain crash on Windows only: test_MochiKit-Base.html

JS_METHODJIT wasn't getting put in js-config.h, so different files saw different layouts for JSThreadData => lose.
Closed: 13 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.