crash in js::Vector::growStorageBy

NEW
Unassigned

Status

()

Core
Gecko Profiler
--
critical
5 years ago
11 months ago

People

(Reporter: azakai, Unassigned)

Tracking

(Blocks: 1 bug, {crash})

Trunk
x86_64
Linux
crash
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

(Reporter)

Description

5 years ago
This bug was filed from the Socorro interface and is 
report bp-5d722e08-0aa1-4151-a1cd-fbdff2130131 .
============================================================= 

happened when profiling a very JS-heavy demo

Updated

5 years ago
Hardware: All → x86_64
Summary: crash in js::Vector → crash in js::Vector::growStorageBy
Version: unspecified → Trunk

Updated

5 years ago
Crash Signature: [@ js::Vector<unsigned short, 32ul, js::ContextAllocPolicy>::growStorageBy(unsigned long)] → [@ js::Vector<unsigned short, 32ul, js::ContextAllocPolicy>::growStorageBy(unsigned long)] [@ js::Vector<unsigned short, int, js::ContextAllocPolicy>::growStorageBy(unsigned int)]
(Reporter)

Comment 1

5 years ago
Seeing this on another demo now too (can't share source).

Comment 2

5 years ago
It's likely a duplicate of bug 832812.

Comment 3

5 years ago
Visiting http://productforums.google.com/d/topic/chat/5bE-mrVrP3A on the 2/10 nightly gives me a completely reproducible crash as the page loads.

Updated

2 years ago
Crash Signature: [@ js::Vector<unsigned short, 32ul, js::ContextAllocPolicy>::growStorageBy(unsigned long)] [@ js::Vector<unsigned short, int, js::ContextAllocPolicy>::growStorageBy(unsigned int)] → [@ js::Vector<unsigned short, 32ul, js::ContextAllocPolicy>::growStorageBy(unsigned long)] [@ js::Vector<unsigned short, int, js::ContextAllocPolicy>::growStorageBy(unsigned int)] [@ js::Vector<T>::growStorageBy]

Updated

11 months ago
Blocks: 1329181
You need to log in before you can comment on or make changes to this bug.