Closed
Bug 659785
Opened 13 years ago
Closed 7 years ago
Crash in js::ValueToNumberSlow [@ js::DefaultValue(JSContext*, JSObject*, JSType, js::Value*) ] (Specific to volume regression)
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
WORKSFORME
People
(Reporter: marcia, Unassigned)
References
Details
(Keywords: crash, regression)
Crash Data
+++ This bug was initially created as a clone of Bug #605033 +++ Same signature has had a dramatic increase in Firefox 5. This is a Residual crash that had some work that was done. Crash volume was low for 4.0. Now starting in May an uptick on 5.0 and it is pretty volume regression. Needs more investigation.
Comment 1•13 years ago
|
||
this is a definite volume 5.0 regression on the same older signature mentioned in the comment 0 clone bug. on may 10 5.0 crashes with this signature started higher than 4.0.1. js::DefaultValue.JSContext...JSObject...JSType,.js::Value.. date total breakdown by build crashes count build, count build, ... 20110509 40 20 4.0.12011041322, 5 5.02011042714, 3 4.0b112011020314, 3 4.02011031805, 2 5.0a22011050804, 2 4.0b122011022221, 1 6.0a12011050903, 1 6.0a12011050803, 1 4.0b82010121417, 1 4.0b72010110414, 1 4.0b62010091408, 20110510 44 15 5.02011042714, 11 4.0.12011041322, 6 5.0a22011050904, 2 4.0b72010110414, 2 4.02011031805, 1 6.0a12011051003, 1 6.0a12011050903, 1 6.0a12011042203, 1 6.0a12011041703, 1 4.0b82010121417, 1 4.0b32010080519, 1 4.0b122011022221, 1 4.0b112011020314, yesterday 5.0 crash volume shows significantly higher with over 100 crashes per day. 20110524 170 124 5.02011051719, 21 4.0.12011041322, 7 5.0a22011052304, 4 5.02011042714, 3 6.0a12011052303, 3 5.0a22011052404, 2 4.0b102011012116, 1 6.0a12011052403, 1 6.0a12011052203, 1 5.0a22011052204, 1 5.0a22011051704, 1 4.0b72010110414, 1 4.0b62010091408, needs to block 5.0.
Updated•13 years ago
|
Version: Trunk → 5 Branch
Reporter | ||
Updated•13 years ago
|
Summary: Crash in js::ValueToNumberSlow [@ js::DefaultValue(JSContext*, JSObject*, JSType, js::Value*) ] → Crash in js::ValueToNumberSlow [@ js::DefaultValue(JSContext*, JSObject*, JSType, js::Value*) ] (Specific to volume regression)
Comment 2•13 years ago
|
||
Turning off PGO seems to have gotten rid of this issue but the underlying crash is still there and likely showing up as EnterMethodJIT.
tracking-firefox5:
+ → ---
Assignee | ||
Updated•13 years ago
|
Crash Signature: [@ js::DefaultValue(JSContext*, JSObject*, JSType, js::Value*) ]
Assignee | ||
Updated•10 years ago
|
Assignee: general → nobody
Updated•9 years ago
|
Crash Signature: [@ js::DefaultValue(JSContext*, JSObject*, JSType, js::Value*) ] → [@ js::DefaultValue(JSContext*, JSObject*, JSType, js::Value*) ]
[@ js::DefaultValue ]
Comment 3•7 years ago
|
||
I'm marking this bug as WORKSFORME as bug crashlog signature didn't appear from a long time (over half year) in Firefox (except some obsolete Fx <38).
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → WORKSFORME
You need to log in
before you can comment on or make changes to this bug.
Description
•