Closed Bug 798383 Opened 13 years ago Closed 13 years ago

crash in js::ion::IonCacheGetProperty::attachCallGetter , Peacekeeper crashes.

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Version:
18 Branch
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla18
Tracking Flags:
Tracking Status
firefox17 --- unaffected
firefox18 + verified

People

(Reporter: alice0775, Assigned: djvj)

References

(
URL
)

Details

(4 keywords)

Crash Data

This bug was filed from the Socorro interface and is report bp-ac65dbdc-e410-46a4-9bac-bc81e2121005 . ============================================================= Build identifier: http://hg.mozilla.org/mozilla-central/rev/fd724f194a1f Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/18.0 Firefox/18.0 ID:20121005030609 Browser crashes at start of "This physics test simulates bouncing dandelion floats and their collsion physis. the test measures both DOM update speed and mathematical methods." Steps to reproduce: 1. Open http://peacekeeper.futuremark.com/run.action
Regression window(m-c) Good: http://hg.mozilla.org/mozilla-central/rev/4cb8f88213f5 Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/18.0 Firefox/18.0 ID:20121003235718 Crash: http://hg.mozilla.org/mozilla-central/rev/0d90d5f3da5a Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/18.0 Firefox/18.0 ID:20121004082018 Pushlog: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=4cb8f88213f5&tochange=0d90d5f3da5a Regression window(m-i) Good: http://hg.mozilla.org/integration/mozilla-inbound/rev/b72781fd478c Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/18.0 Firefox/18.0 ID:20121003195316 Crash: http://hg.mozilla.org/integration/mozilla-inbound/rev/fa3d21b84a63 Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/18.0 Firefox/18.0 ID:20121003195616 Pushlog: http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=b72781fd478c&tochange=fa3d21b84a63 Triggered by Bug 795803
Assignee: nobody → general
Blocks: 795803
tracking-firefox18: --- → ?
Component: General → JavaScript Engine
Keywords: regression, reproducible
It's #1 top crasher in today's build.
Crash Signature: [@ js::ion::IonCacheGetProperty::attachCallGetter(JSContext*, js::ion::IonScript*, JSObject*, JSObject*, js::Shape const*, js::ion::SafepointIndex const*, void*)] → [@ js::ion::IonCacheGetProperty::attachCallGetter(JSContext*, js::ion::IonScript*, JSObject*, JSObject*, js::Shape const*, js::ion::SafepointIndex const*, void*)] [@ js::ion::IonCacheGetProperty::attachCallGetter]
Keywords: topcrash
OS: Windows 7 → All
Hardware: x86 → All
Tracking.
Assignee: general → kvijayan
This bug is likely a dup of bug 798589. Patch for it is up, will get pushed as soon as m-i is open again.
Waiting for crash reports to go away before closing this, but this issue should be fixed now.
Have triggered another nightly (on 9f677c2bb33d) to pick up the fix in bug 798589, seeing how close we are to uplift :-)
djvj, you could also check that we can now get through Peacekeeper without crashing.
I checked that yesterday before pushing the fix. I was able to reproduce the peacekeeper crash reliably and it went away after the patch. I also tried the Google contacts after the patch, and the contacts showed up fine. The rainbows and ponies did not appear.. however I think we can go ahead and ship and just put that deficiency on a known errata list.
There are no crashes in 18.0a1/20121007 and above.
Fixed by bug 798589.
Status: NEW → RESOLVED
Closed: 13 years ago
status-firefox18: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla18
Verified crash using steps to reproduce from comment 0 in 2012-10-05 Nightly and then retested on Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/20100101 Firefox/18.0 Beta 2 Build ID: 20121128060531 No crashes occurred in Firefox 18.0 beta 2 or in Latest Nigtly.
status-firefox18: fixed → verified
You need to log in before you can comment on or make changes to this bug.