crash in mozilla::dom::DocumentBinding::createDocumentFragment

VERIFIED FIXED in Firefox 23

Status

()

Core
JavaScript Engine
--
critical
VERIFIED FIXED
5 years ago
5 years ago

People

(Reporter: Alice0775 White, Unassigned)

Tracking

({crash, regression, reproducible})

23 Branch
mozilla23
x86
Linux
crash, regression, reproducible
Points:
---

Firefox Tracking Flags

(firefox22 unaffected, firefox23+ verified)

Details

(crash signature)

(Reporter)

Description

5 years ago
This bug was filed from the Socorro interface and is 
report bp-e638f61a-e1c1-45cb-a67b-0cbe52130426 .
============================================================= 

Steps to Reproduce:
0. Necessary Flash Player plugin
1. Open http://retro.grooveshark.com/#!/search?q=test
2. Wait about 4-5 seconds

Actual Results:
Crash
(Reporter)

Comment 1

5 years ago
Regression window(m-c)
Good:
http://hg.mozilla.org/mozilla-central/rev/acf388eaf9e9
Mozilla/5.0 (X11; Linux i686; rv:23.0) Gecko/20130423 Firefox/23.0 ID:20130423030935
Crash:
http://hg.mozilla.org/mozilla-central/rev/aa620f3fc2f7
Mozilla/5.0 (X11; Linux i686; rv:23.0) Gecko/20130424 Firefox/23.0 ID:20130423041034
Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=acf388eaf9e9&tochange=aa620f3fc2f7
(Reporter)

Comment 2

5 years ago
Umm, non-pgo acf388eaf9e9 build crashes..

Regression window(m-c non-pgo)
Good:
http://hg.mozilla.org/mozilla-central/rev/0d50cb959c46
Mozilla/5.0 (X11; Linux i686; rv:23.0) Gecko/20130420 Firefox/23.0 ID:20130420234506
Crash:
http://hg.mozilla.org/mozilla-central/rev/a09acc1ed635
Mozilla/5.0 (X11; Linux i686; rv:23.0) Gecko/20130421 Firefox/23.0 ID:20130421093204
Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=0d50cb959c46&tochange=a09acc1ed635


Regression window(m-i non-pgo)
Good:
http://hg.mozilla.org/integration/mozilla-inbound/rev/123a65dba090
Mozilla/5.0 (X11; Linux i686; rv:23.0) Gecko/20130420 Firefox/23.0 ID:20130420072406
Crash:
http://hg.mozilla.org/integration/mozilla-inbound/rev/503a5fb6d530
Mozilla/5.0 (X11; Linux i686; rv:23.0) Gecko/20130420 Firefox/23.0 ID:20130420073304
Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=123a65dba090&tochange=503a5fb6d530

Triggered by
503a5fb6d530	Kannan Vijayan — Bug 861596 - Add optimized ArgumentsObject stubs to Ion ICs. r=h4writer
Blocks: 861596
tracking-firefox23: --- → ?
Keywords: regression

Updated

5 years ago
status-firefox22: --- → unaffected
status-firefox23: --- → affected
Assignee: nobody → general
Component: DOM → JavaScript Engine

Updated

5 years ago
Keywords: reproducible
(Reporter)

Comment 3

5 years ago
And I also confirm that cset 503a5fb6d530 causes the crash in local build:
Build from m-c tip 0e45f1b9521f : I can reproduce the crash.
Build from m-c tip 0e45f1b9521f and backed out 503a5fb6d530: I cannot reproduce the crash.
(Reporter)

Comment 4

5 years ago
It works fine.
http://hg.mozilla.org/mozilla-central/rev/9d8977cbbfc6
Mozilla/5.0 (X11; Linux i686; rv:23.0) Gecko/20130428 Firefox/23.0 ID:20130428031010

Fixed by backed out Bug 861596.
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED

Updated

5 years ago
status-firefox23: affected → fixed
Target Milestone: --- → mozilla23
tracking-firefox23: ? → ---
tracking-firefox23: --- → +

Comment 5

5 years ago
[testday-20130610] edwardb

It works fine.
        User Agent
        Mozilla/5.0 (X11; Linux x86_64; rv:23.0) Gecko/20130611 Firefox/23.0
Keywords: verifyme
Verified fixed with Fx 23 beta 1, build ID: 20130625125232
status-firefox23: fixed → verified
QA Contact: manuela.muntean
Status: RESOLVED → VERIFIED
Keywords: verifyme
You need to log in before you can comment on or make changes to this bug.