Closed Bug 764409 Opened 13 years ago Closed 9 years ago

crash in js::HeapSlot::set

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Version:
13 Branch
Platform:
x86
Windows 7
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED INCOMPLETE

People

(Reporter: wsmwk, Unassigned)

Details

(Keywords: crash, regression, Whiteboard: [js:t])

Crash Data

version 13 and higher regression? This bug was filed from the Socorro interface and is report bp-158a24a4-b572-455a-8c94-e5cfc2120608 v15.0a1 ============================================================= 0 mozjs.dll js::HeapSlot::set js/src/gc/Barrier-inl.h:274 1 mozjs.dll js::DefineNativeProperty js/src/jsobj.cpp:4561 2 mozjs.dll js::Interpret js/src/jsinterp.cpp:3216 3 mozjs.dll js::RunScript js/src/jsinterp.cpp:258 4 mozjs.dll js::ExecuteKernel js/src/jsinterp.cpp:466 5 mozjs.dll js::Execute js/src/jsinterp.cpp:508 6 mozjs.dll JS_ExecuteScript js/src/jsapi.cpp:5310 7 xul.dll nsJSContext::ExecuteScript dom/base/nsJSEnvironment.cpp:1600 8 xul.dll nsXULDocument::ExecuteScript content/xul/document/src/nsXULDocument.cpp:3595 9 xul.dll nsXULDocument::ExecuteScript content/xul/document/src/nsXULDocument.cpp:3615 10 xul.dll nsXULDocument::OnStreamComplete content/xul/document/src/nsXULDocument.cpp:3492 v13 bp-4e239f5e-d60e-496d-a651-13db62120611 v14 bp-01d2fdc5-3103-4b8b-8b09-f47db2120613
It's a low volume crash: #395 top browser crasher.
Keywords: regression
OS: Windows NT → Windows 7
Version: Trunk → 13 Branch
Whiteboard: [js:t]
Assignee: general → nobody
Crash Signature: [@ js::HeapSlot::set(JSObject*, unsigned int, JS::Value const&)] → [@ js::HeapSlot::set(JSObject*, unsigned int, JS::Value const&)] [@ js::HeapSlot::set]
not going to keep this open for one crash per week with no testcase
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → INCOMPLETE
You need to log in before you can comment on or make changes to this bug.