Attempting to load maps.google.com results in a crash (builds 20100910044908 and 20100909043955). http://crash-stats.mozilla.com/report/index/6adfe4c1-7c09-4edc-bbf5-e6df42100910 http://crash-stats.mozilla.com/report/index/bp-dbd3e100-47e1-4e96-8ea3-bdce82100909 http://crash-stats.mozilla.com/report/index/bp-bd14b2a2-4f6b-4ef9-badd-bf6b52100909 http://crash-stats.mozilla.com/report/index/bp-331f19dc-929e-4702-aa75-2f3332100909
I still get the crash with methodjit disabled, with all jit disabled, and in safe mode with all jit disabled.
I found out that I get the crash if I'm logged in, but not if I'm not. I believe this must be due to Labs features being enabled. I can trigger the crash easily when not logged in by simply mousing over the Labs icon in the top right corner.
(In reply to comment #3) > I found out that I get the crash if I'm logged in, but not if I'm not. I > believe this must be due to Labs features being enabled. I can trigger the > crash easily when not logged in by simply mousing over the Labs icon in the top > right corner. Can you say more about which Labs features? Maybe steps to reproduce (even if not minimal)? This looks like fallout from bug 558451. /be
It actually doesn't take any specific Labs feature (it crashes before that). Step 1. Load maps.google.com Step 2. Mouse over the labs icon
This crashes for me with all JITs disabled.
STR: just mouse over the little potion with "New!" next to it in the upper right. You might have to be logged in to a Google account. Could be the same as bug 592214.
Created attachment 474477 [details] [diff] [review] fix I may push this to tm and m-c ahead of review, to avoid nightly build user pain. /be
Created attachment 474478 [details] [diff] [review] fix Use obj not pobj in add2dictfills reject-propcache-fill case. /be
Created attachment 474482 [details] [diff] [review] fix With typo fix -- thanks to philor for proof-reading. /be
http://hg.mozilla.org/tracemonkey/rev/1a5fefbe9f2f http://hg.mozilla.org/mozilla-central/rev/cd3c926a7413 /be
I turned off this test in the browser because it uses shapeOf (and fails because of it), which other tests lead me to believe is shell only. http://hg.mozilla.org/mozilla-central/rev/484bd866905e
If this patch has indeed landed on the m-c Trunk build for September 12, 2010, it has fixed things on Google Maps. I have been able to load, get directions, zoom and scroll maps on GMaps on my Win7 system.
Kyle: thanks for fixing jstests.list -- I propagated your change from m-c to tm. Sorry about the orange. Ray: thanks for confirming. /be
I'm still seeing this crash on trunk, and from the looks of it, so are others. http://crash-stats.mozilla.com/report/list?range_value=2&range_unit=weeks&signature=JSObject%3A%3AremoveProperty%28JSContext*%2C%20int%29&version=Firefox%3A4.0b6pre
I filed bug 596128 for a still-reproducable crash that looks similar to the ones reported here.
Ryan, Gavin: new and different bug, I'm on it. Thanks for commenting (and filing, Gavin). /be
(Maybe not "new" -- perhaps contemporaneous -- but definitely "different".)