Closed Bug 794907 Opened 12 years ago Closed 12 years ago

crash in js::CrossCompartmentWrapper::set on Gmail

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Version:
18 Branch
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 794947
Tracking Flags:
Tracking Status
firefox18 - ---

People

(Reporter: alex_mayorga, Unassigned)

References

(
URL
)

Details

(Keywords: crash, regression)

Crash Data

This bug was filed from the Socorro interface and is 
report bp-2373002d-1b31-484b-a834-1e7192120927 .
============================================================= 

Initial reporter at http://forums.mozillazine.org/viewtopic.php?p=12326615#p12326615
I cannot open gmail at all.

bp-1de3c10c-656d-4fbf-813c-40b782120927

m-i hourly build:

Last good rev is f341fc58f595
First bad rev is 7228effb2e5b
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=f341fc58f595&tochange=7228effb2e5b

triggered by Bug 787856 - Allow for the possibility of dynamically-generated object prototypes
Assignee: nobody → general
Blocks: 787856
Crash Signature: [@ js::CrossCompartmentWrapper::set] → [@ js::CrossCompartmentWrapper::set] [@ JSCompartment::wrapId(JSContext*, int*) ]
Component: Untriaged → JavaScript Engine
Product: Firefox → Core
Keywords: regression
OS: Linux → All
Hardware: x86 → All
Version: Trunk → 18 Branch
I've created another new account and doesn't crash. weird!
Summary: crash in js::CrossCompartmentWrapper::set → crash in js::CrossCompartmentWrapper::set on Gmail
from about:crashes

bp-983e1bf5-1614-4c8d-a8dd-b47102120927  [@ JSCompartment::wrapId(JSContext*, int*) ]
bp-4c8d777f-8821-4e61-b175-385592120927  [@ JSCompartment::wrapId(JSContext*, int*) ] 
bp-20c50072-8c75-4576-a6dd-ab5ed2120927  [@ js::gc::ArenaLists::allocateFromArena(JSCompartment*, js::gc::AllocKind) ]
bp-92157857-7b19-4604-9a70-18ffe2120927  [@ JSCompartment::wrapId(JSContext*, int*) ]
bp-b4975a7b-b7f9-4536-adc2-e18702120927  [@ JSCompartment::wrapId(JSContext*, int*) ]
bp-babb3079-a7a5-4c43-9d86-a0b0f2120927  [@ JSCompartment::wrapId(JSContext*, int*) ]
bp-a7040896-d1ac-445e-870a-673d02120927  [@ JSCompartment::wrapId(JSContext*, int*) ]
bp-61cb0970-a270-4f29-98b0-497bd2120927  [@ JSCompartment::wrapId(JSContext*, int*) ] 
bp-04058914-6600-4bfd-96e1-c061a2120927  [@ JSCompartment::wrapId(JSContext*, int*) ]
bp-3f8cf2a8-4b5a-4b53-b637-0b4ab2120927  [@ JSCompartment::wrapId(JSContext*, int*) ]
bp-14c7b96a-e3fe-4175-b44f-cfecb2120927  [@ JSCompartment::wrapId(JSContext*, int*) ]
bp-a24950c4-3839-4f55-94af-a0b0c2120927  [@ JSCompartment::wrapId(JSContext*, int*) ]
bp-fe8a69ca-50f3-4b38-b40b-b49312120927  [@ JSCompartment::wrapId(JSContext*, int*) ]
bp-628f0689-3058-4685-886f-dd0a22120927  [@ JSCompartment::wrapId(JSContext*, int*) ]
bp-cc4c214a-457e-4dc4-b60f-6b9f22120927  [@ JSCompartment::wrapId(JSContext*, int*) ] 
bp-7bc02891-bb0d-427d-afea-018682120927  [@ JSCompartment::wrapId(JSContext*, int*) ] 
bp-d3175542-4483-4180-afa7-3e6da2120927  [@ JSCompartment::wrapId(JSContext*, int*) ]
bp-c9adcf5e-83d4-4438-945e-2fe832120927  [@ JSCompartment::wrapId(JSContext*, int*) ]
bp-f31849cf-585f-45bc-b6c5-4de1c2120927  [@ JSCompartment::wrapId(JSContext*, int*) ]
bp-71a4f21a-3234-4632-8fa2-e02782120927  [@ js::gc::ArenaLists::allocateFromArena(JSCompartment*, js::gc::AllocKind) ]
Crash Signature: [@ js::CrossCompartmentWrapper::set] [@ JSCompartment::wrapId(JSContext*, int*) ] → [@ js::CrossCompartmentWrapper::set] [@ JSCompartment::wrapId(JSContext*, int*) ] [@ js::gc::ArenaLists::allocateFromArena(JSCompartment*, js::gc::AllocKind) ]
I can reproduce with STR in Bug 794947
  1. Open a e-mail2.
  2. Click ">"(older) button  quickly repeatedly

And I got regression range as same as comment#1.
fixed by bug 794947. tested both linux and win32 hourly build.
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.