Closed Bug 809789 Opened 12 years ago Closed 12 years ago

crash in js::ToNumberSlow

Categories

(Core :: JavaScript Engine, defect)

19 Branch
x86
Windows 7
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 791214
Tracking Status
firefox18 --- unaffected
firefox19 --- affected

People

(Reporter: scoobidiver, Unassigned)

Details

(Keywords: crash, regression)

Crash Data

It first appeared in 19.0a1/20121101180809. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=5bd5bb168eb1&tochange=c5fbfc1b1a94 (short option)
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=bed18790882f&tochange=c5fbfc1b1a94 (large option)

Stack traces are various:
Frame 	Module 	Signature 	Source
0 	mozjs.dll 	js::ToNumberSlow 	js/src/jsnum.cpp:1376
1 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:1872
2 	mozjs.dll 	js::RunScript 	js/src/jsinterp.cpp:324
...

Frame 	Module 	Signature 	Source
0 	mozjs.dll 	js::ToNumberSlow 	js/src/jsnum.cpp:1376
1 	mozjs.dll 	js::math_cos 	js/src/jsmath.cpp:266
2 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:367
3 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:2324
...

Frame 	Module 	Signature 	Source
0 	mozjs.dll 	js::ToNumberSlow 	js/src/jsnum.cpp:1376
1 	mozjs.dll 	js::math_sin 	js/src/jsmath.cpp:608
2 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:367
3 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:2324
...

Frame 	Module 	Signature 	Source
0 	mozjs.dll 	js::ToNumberSlow 	js/src/jsnum.cpp:1376
1 	mozjs.dll 	StubEqualityOp<0> 	js/src/methodjit/StubCalls.cpp:542
2 	mozjs.dll 	js::mjit::stubs::NotEqual 	js/src/methodjit/StubCalls.cpp:568
3 	mozjs.dll 	js::RunScript 	js/src/jsinterp.cpp:321
...

Frame 	Module 	Signature 	Source
0 	mozjs.dll 	js::ToNumberSlow 	js/src/jsnum.cpp:1376
1 	xul.dll 	mozilla::dom::ValueToPrimitive<double,0> 	obj-firefox/dist/include/mozilla/dom/PrimitiveConversions.h:339
2 	xul.dll 	mozilla::dom::CanvasRenderingContext2DBinding::translate 	obj-firefox/dom/bindings/CanvasRenderingContext2DBinding.cpp:163
3 	xul.dll 	mozilla::dom::UnwrapObject<9,mozilla::dom::CanvasRenderingContext2D,mozilla::dom 	obj-firefox/dist/include/mozilla/dom/BindingUtils.h:195
4 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:367
5 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:2324
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=js%3A%3AToNumberSlow%28JSContext*%2C+JS%3A%3AValue%2C+double*%29
It seems to be the new crash signature of bug 791214.
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.