816368 - Gmail crashing after bug 813773 landed (crash in JSScript::ensureRanAnalysis)

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jim Jeffery not reading bug-mail 1/2/11]

Gmail is crashing in 5-8 seconds after logging in to the service. 

Thanks to Alice0775 for the regression check:

Regression window(m-i)
Good:
http://hg.mozilla.org/integration/mozilla-inbound/rev/8aa207f87eb6
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:20.0) Gecko/20.0 Firefox/20.0 ID:20121127124432
Crash:
http://hg.mozilla.org/integration/mozilla-inbound/rev/5158d648702e
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:20.0) Gecko/20.0 Firefox/20.0 ID:20121127130433
Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=8aa207f87eb6&tochange=5158d648702e

Regressed by:
5158d648702e Hannes Verschore — Bug 813773: Enable IM to IM fastpath for constructing calls, r=nbp,sstangl

Comment 1

[Jim Jeffery not reading bug-mail 1/2/11]

Tested using Win7 x64 running win32 opt hourly builds:

Good: https://hg.mozilla.org/mozilla-central/rev/6c23f41b0747
Bad: https://hg.mozilla.org/mozilla-central/rev/17c267a881cf 

regression window in comment #0

Comment 2

[Hubert Figuiere [:hub]]

Possibly dupe of bug 816378 I just pushed to inbound. I can't verify this one but I reverted the afformentionned patch.

Comment 3

[Alice0775 White]

bp-a5c04813-56f0-4144-bed1-ca3922121129

Comment 5

[Hubert Figuiere [:hub]]

tommorrow Nightly should have this fixed by way of bug 816378

Comment 7

[Ed Morley [:emorley]]

I've respun Nightly on c72d38e7a212 to pick up the backout; should be available in a few hours (thank goodness; the crash has been driving me nuts!).

Comment 8

[Scoobidiver (away)]

The backout of bug 813773 is on m-c.

Comment 10

[David Bolter [:davidb] (NeedInfo me for attention)]

My bad. Setting fixed status back.

Comment 15

[Paul Silaghi, QA [:pauly]]

Reproduced on Nightly 2012-11-29.
Verified fixed FF 20b1 Win 7, Ubuntu 12.04, Mac OS X 10.8.2