Closed Bug 883677 Opened 11 years ago Closed 11 years ago

IonMonkey: Crash [@ JSScript::filename() const ]

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Version:
24 Branch
Platform:
All
Linux
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 883562
Tracking Flags:
Tracking Status
firefox23 --- unaffected
firefox24 --- affected

People

(Reporter: sstangl, Unassigned)

Details

(Keywords: crash, regression)

Crash Data

https://crash-stats.mozilla.com/report/index/bp-283cebbe-ffc5-4657-82d6-06b1a2130616

Just hit a crash at http://hg.mozilla.org/mozilla-central/annotate/3d16d59c9317/js/src/ion/BaselineBailouts.cpp#l478.

It looks like the script is non-NULL, since it's dereferenced earlier in the same function, but asking for a filename is invalid.
Crashed again: https://crash-stats.mozilla.com/report/index/f117633f-d0d3-482e-8876-2b3822130617

Appears to happen when scrolling down the Facebook news feed.
The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=b197bed90a98&tochange=3d16d59c9317
Severity: normal → critical
Crash Signature: [@ JSScript::filename() const ]
status-firefox23: --- → unaffected
status-firefox24: --- → affected
Keywords: crash, regression
OS: All → Linux
Version: unspecified → 24 Branch
Brian, could this be fallout from bug 678037?
Flags: needinfo?(bhackett1024)
I think it's a dupe of bug 883562.
(In reply to Scoobidiver from comment #4)
> I think it's a dupe of bug 883562.

Yeah, I think this is right.  This should be fixed in today's nightly.
Flags: needinfo?(bhackett1024)
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.