Closed
Bug 795150
Opened 8 years ago
Closed 8 years ago
IonMonkey: Crash in TestShouldDOMCall
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
mozilla18
People
(Reporter: vladan, Assigned: efaust)
References
()
Details
(Keywords: crash, regression, reproducible, Whiteboard: [ion:t])
Crash Data
Attachments
(1 file)
783 bytes,
patch
|
bzbarsky
:
review+
|
Details | Diff | Splinter Review |
While opening the Gecko Profiler page, I got a crash on a NULL pointer access in TestShouldDOMCall. My crash report: https://crash-stats.mozilla.com/report/index/57292627-7595-4ebc-8df3-933c72120927 Offending line: http://hg.mozilla.org/mozilla-central/annotate/b038e9e2023f/js/src/ion/IonBuilder.cpp#l5550
Comment 1•8 years ago
|
||
Based on a comment, I found an URL that crashes Firefox. More reports at: https://crash-stats.mozilla.com/report/list?signature=TestShouldDOMCall
Severity: normal → critical
Crash Signature: [@ TestShouldDOMCall]
OS: Windows 7 → All
Hardware: x86_64 → All
Version: 16 Branch → 18 Branch
Eric, does anything obvious stick out here? Since it's a NPE, might be easy to tell from the crashing line and source code.
Whiteboard: [ion:t]
Assignee | ||
Comment 3•8 years ago
|
||
Uh, looks like It's executing in a runtime without any DOM stuff executing? Those callbacks are set in nsJSRuntime::Init().
Assignee | ||
Comment 4•8 years ago
|
||
I hear this crash happens in the profiler? Does the profiler run things under strangely initialized JSRuntimes?
Assignee | ||
Comment 5•8 years ago
|
||
So, after a little more digging, I discovered the root of the problem. We were compiling on a worker thread, which didn't have the callbacks. Normally, for various reasons, the callbacks that run on the main thread are not installed for workers, but in this case, it should be safe to do so. Rather than have the optimization only work on the main thread, we have added the appropriate callback to worker thread JSRuntimes. The pdf of the paper in that link now loads nicely.
![]() |
||
Comment 6•8 years ago
|
||
Comment on attachment 667512 [details] [diff] [review] Fix r=me
Attachment #667512 -
Flags: review?(bzbarsky) → review+
Assignee | ||
Comment 7•8 years ago
|
||
https://hg.mozilla.org/integration/mozilla-inbound/rev/e9633e93b7e2
Comment 8•8 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/e9633e93b7e2 Should this have a crashtest?
Status: ASSIGNED → RESOLVED
Closed: 8 years ago
Flags: in-testsuite?
Resolution: --- → FIXED
Target Milestone: --- → mozilla18
You need to log in
before you can comment on or make changes to this bug.
Description
•