883211 - crash in js::ion::IonScript::addDependentAsmJSModule

Status: RESOLVED DUPLICATE of bug 882514

(Core :: JavaScript Engine, defect)

Description

[Scoobidiver (away)]

It has been hit by two users since 24.0a1/20130614. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=68760713a30f&tochange=b197bed90a98
It's likely a regression from bug 860838.

Signature 	js::ion::IonScript::addDependentAsmJSModule(JSContext*, js::DependentAsmJSModuleExit) More Reports Search
UUID	8b6d66f3-b60e-44db-bb52-91d212130614
Date Processed	2013-06-14 15:31:27
Uptime	172
Last Crash	3.0 minutes before submission
Install Age	5.2 minutes since version was first installed.
Install Time	2013-06-14 15:26:03
Product	Firefox
Version	24.0a1
Build ID	20130614031100
Release Channel	nightly
OS	Linux
OS Version	0.0.0 Linux 3.2.0-45-generic #70-Ubuntu SMP Wed May 29 20:12:06 UTC 2013 x86_64
Build Architecture	amd64
Build Architecture Info	family 6 model 42 stepping 7
Crash Reason	SIGSEGV
Crash Address	0x0
App Notes 	
OpenGL: NVIDIA Corporation -- Quadro 600/PCIe/SSE2 -- 4.2.0 NVIDIA 304.88 -- texture_from_pixmap
WebGL? libGL.so.1? libGL.so.1+ GL Context? GL Context+ WebGL+ 
Processor Notes 	sp-processor06_phx1_mozilla_com_14958:2012; exploitability tool: ERROR: unable to analyze dump
EMCheckCompatibility	True

Frame 	Module 	Signature 	Source
0 	libxul.so 	js::ion::IonScript::addDependentAsmJSModule 	js/src/ion/Ion.cpp:891
1 	libxul.so 	TryEnablingIon 	js/src/ion/AsmJS.cpp:5266
2 	libxul.so 	InvokeFromAsmJS_ToInt32 	js/src/ion/AsmJS.cpp:5296

More reports at:
https://crash-stats.mozilla.com/report/list?signature=js%3A%3Aion%3A%3AIonScript%3A%3AaddDependentAsmJSModule%28JSContext*%2C+js%3A%3ADependentAsmJSModuleExit%29

Comment 1

[Luke Wagner [:luke]]

One or both was me :)  I tested and this is fixed on central by bug 882514, should go out with the next nightly.