Closed Bug 709929 Opened 8 years ago Closed 8 years ago

Crash [@ GetGCKindSlots [inlined]]

Categories

(Core :: JavaScript Engine, defect, critical)

Other Branch
x86_64
macOS
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 705879

People

(Reporter: gkw, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: crash, regression, testcase, Whiteboard: [sg:critical] js-triage-needed)

Crash Data

Attachments

(1 file)

Attached file stack
f = eval("\
    (function() {\
        for each(l in[0,0]) {\
            with(gc()>[this for(x in[function(){}])]) {\
                var a;\
                yield\
            }\
        }\
    })\
")
for (i in f()) {}

crashes js opt shell on m-c changeset 604ce2fde8ca without any CLI flags when the testcase is passed into the shell as a CLI argument.

Assuming [sg:critical] and s-s because this involves gc().
Do you have a regression range for this one?
(In reply to David Mandelin from comment #1)
> Do you have a regression range for this one?

I've been running autoBisect as soon as I discovered this, but have been delayed due to hg pointing at merge landings as the regressor.

Am poking through these merge landings to hopefully find out the regressing changesets.
> Am poking through these merge landings to hopefully find out the regressing
> changesets.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   81298:33962bb21403
user:        Brian Hackett
date:        Tue Nov 08 16:56:00 2011 -0800
summary:     Set DELEGATE for parents of other objects, bug 700300.
Blocks: 700300
Keywords: regression
Version: Other Branch → Trunk
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → DUPLICATE
Version: Trunk → Other Branch
Duplicate of bug: 705879
Crash Signature: [@ GetGCKindSlots [inlined]]
Group: core-security
You need to log in before you can comment on or make changes to this bug.