Closed
Bug 885399
Opened 12 years ago
Closed 12 years ago
crash in js::ScopeObject::setAliasedVar
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 884194
Tracking | Status | |
---|---|---|
firefox23 | --- | unaffected |
firefox24 | --- | affected |
People
(Reporter: scoobidiver, Unassigned)
References
Details
(Keywords: crash, regression)
Crash Data
It first showed up in 24.0a1/20130619. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=4e5983de6e3b&tochange=d2a7cfa34154
It might be bug 682573 but at a higher volume.
Stack traces are various:
Frame Module Signature Source
0 XUL js::ScopeObject::setAliasedVar obj-firefox/x86_64/dist/include/js/Value.h:1020
1 XUL Interpret js/src/vm/Interpreter.cpp:2537
2 XUL js::RunScript js/src/vm/Interpreter.cpp:411
3 XUL js::Invoke js/src/vm/Interpreter.cpp:473
4 XUL js::Invoke js/src/vm/Interpreter.cpp:504
5 XUL js::ion::DoCallFallback js/src/ion/BaselineIC.cpp:7004
Frame Module Signature Source
0 XUL js::ScopeObject::setAliasedVar obj-firefox/x86_64/dist/include/js/Value.h:1020
1 XUL Interpret js/src/vm/Interpreter.cpp:2523
2 XUL XPCWrappedNative::InitTearOff nsCxPusher.h:61
3 libsystem_c.dylib libsystem_c.dylib@0x19886
4 libsystem_c.dylib libsystem_c.dylib@0x1a195
Frame Module Signature Source
0 XUL js::ScopeObject::setAliasedVar obj-firefox/x86_64/dist/include/js/Value.h:1020
1 XUL Interpret js/src/vm/Interpreter.cpp:2523
2 CoreFoundation CoreFoundation@0x2c52
3 CoreFoundation CoreFoundation@0x2c52
4 CoreFoundation CoreFoundation@0x939c
5 CoreGraphics CoreGraphics@0x4d781
Frame Module Signature Source
0 XUL js::ScopeObject::setAliasedVar obj-firefox/x86_64/dist/include/js/Value.h:1020
1 XUL Interpret js/src/vm/Interpreter.cpp:2523
2 @0x200000000
3 XUL GetPropertyOperation js/src/jsobjinlines.h:131
4 XUL Interpret js/src/vm/Interpreter.cpp:3161
5 XUL JSObject::putProperty js/src/vm/Shape.cpp:629
Frame Module Signature Source
0 XUL js::ScopeObject::setAliasedVar obj-firefox/x86_64/dist/include/js/Value.h:1020
1 XUL Interpret js/src/vm/Interpreter.cpp:2523
2 XUL nsDisplayBackgroundImage::AppendBackgroundItemsToTop nsDisplayList.h:739
3 XUL nsDeckFrame::BuildDisplayListForChildren nsDeckFrame.cpp:170
4 XUL nsBoxFrame::BuildDisplayList nsDisplayList.h:1276
5 libmozglue.dylib arena_malloc jemalloc.c:1722
6 XUL nsScriptSecurityManager::CheckPropertyAccessImpl nsScriptSecurityManager.cpp:2015
More reports at:
https://crash-stats.mozilla.com/report/list?signature=js%3A%3AScopeObject%3A%3AsetAliasedVar%28JSContext*%2C+js%3A%3AScopeCoordinate%2C+js%3A%3APropertyName*%2C+JS%3A%3AValue+const%26%29
Comment 1•12 years ago
|
||
This is bug 884194 I think, which will have a patch later today.
Reporter | ||
Comment 3•12 years ago
|
||
(In reply to Brian Hackett (:bhackett) from comment #1)
> This is bug 884194 I think, which will have a patch later today.
It seems based on crash stats.
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → DUPLICATE
You need to log in
before you can comment on or make changes to this bug.
Description
•