Closed Bug 885399 Opened 12 years ago Closed 12 years ago

crash in js::ScopeObject::setAliasedVar

Categories

(Core :: JavaScript Engine, defect)

24 Branch
x86_64
macOS
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 884194
Tracking Status
firefox23 --- unaffected
firefox24 --- affected

People

(Reporter: scoobidiver, Unassigned)

References

Details

(Keywords: crash, regression)

Crash Data

It first showed up in 24.0a1/20130619. The regression range is: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=4e5983de6e3b&tochange=d2a7cfa34154 It might be bug 682573 but at a higher volume. Stack traces are various: Frame Module Signature Source 0 XUL js::ScopeObject::setAliasedVar obj-firefox/x86_64/dist/include/js/Value.h:1020 1 XUL Interpret js/src/vm/Interpreter.cpp:2537 2 XUL js::RunScript js/src/vm/Interpreter.cpp:411 3 XUL js::Invoke js/src/vm/Interpreter.cpp:473 4 XUL js::Invoke js/src/vm/Interpreter.cpp:504 5 XUL js::ion::DoCallFallback js/src/ion/BaselineIC.cpp:7004 Frame Module Signature Source 0 XUL js::ScopeObject::setAliasedVar obj-firefox/x86_64/dist/include/js/Value.h:1020 1 XUL Interpret js/src/vm/Interpreter.cpp:2523 2 XUL XPCWrappedNative::InitTearOff nsCxPusher.h:61 3 libsystem_c.dylib libsystem_c.dylib@0x19886 4 libsystem_c.dylib libsystem_c.dylib@0x1a195 Frame Module Signature Source 0 XUL js::ScopeObject::setAliasedVar obj-firefox/x86_64/dist/include/js/Value.h:1020 1 XUL Interpret js/src/vm/Interpreter.cpp:2523 2 CoreFoundation CoreFoundation@0x2c52 3 CoreFoundation CoreFoundation@0x2c52 4 CoreFoundation CoreFoundation@0x939c 5 CoreGraphics CoreGraphics@0x4d781 Frame Module Signature Source 0 XUL js::ScopeObject::setAliasedVar obj-firefox/x86_64/dist/include/js/Value.h:1020 1 XUL Interpret js/src/vm/Interpreter.cpp:2523 2 @0x200000000 3 XUL GetPropertyOperation js/src/jsobjinlines.h:131 4 XUL Interpret js/src/vm/Interpreter.cpp:3161 5 XUL JSObject::putProperty js/src/vm/Shape.cpp:629 Frame Module Signature Source 0 XUL js::ScopeObject::setAliasedVar obj-firefox/x86_64/dist/include/js/Value.h:1020 1 XUL Interpret js/src/vm/Interpreter.cpp:2523 2 XUL nsDisplayBackgroundImage::AppendBackgroundItemsToTop nsDisplayList.h:739 3 XUL nsDeckFrame::BuildDisplayListForChildren nsDeckFrame.cpp:170 4 XUL nsBoxFrame::BuildDisplayList nsDisplayList.h:1276 5 libmozglue.dylib arena_malloc jemalloc.c:1722 6 XUL nsScriptSecurityManager::CheckPropertyAccessImpl nsScriptSecurityManager.cpp:2015 More reports at: https://crash-stats.mozilla.com/report/list?signature=js%3A%3AScopeObject%3A%3AsetAliasedVar%28JSContext*%2C+js%3A%3AScopeCoordinate%2C+js%3A%3APropertyName*%2C+JS%3A%3AValue+const%26%29
This is bug 884194 I think, which will have a patch later today.
(In reply to Brian Hackett (:bhackett) from comment #1) > This is bug 884194 I think, which will have a patch later today. It seems based on crash stats.
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.