935491 - crash in EnterBaseline

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[alex_mayorga]

This bug was filed from the Socorro interface and is 
report bp-0502ccd5-ce16-48ca-83dd-fea5f2131106.
=============================================================

Comment 1

[alex_mayorga]

Couple more, seems to be triggered by adding attachments on Yahoo! Mail and sending messages with said attachments.

Report ID 	Date Submitted
bp-85de30ed-328f-4f0e-bc6d-64ae72131106	06/11/2013	11:17 a.m.
bp-38fddff0-55d7-48aa-aa8d-bda782131106	06/11/2013	11:14 a.m.

Comment 2

[Alice0775 White]

Regression window(m-c)
Good:
http://hg.mozilla.org/mozilla-central/rev/bd6c7c46afce
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0 ID:20131104045410
Bad:
L:\trunk\2013\11\firefox04-Nov-2013 2229 1383599890 inbound
http://hg.mozilla.org/mozilla-central/rev/3e4275a874d8
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0 ID:20131104131810
Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=bd6c7c46afce&tochange=3e4275a874d8


Regression window(m-i)
Good:
http://hg.mozilla.org/integration/mozilla-inbound/rev/da5df68e8857
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0 ID:20131104023709
Bad:
http://hg.mozilla.org/integration/mozilla-inbound/rev/495a9c210b91
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0 ID:20131104024108
Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=da5df68e8857&tochange=495a9c210b91
Regressed by:
495a9c210b91	Jan de Mooij — Bug 933798 - Don't unnecessarily deoptimize name accesses in try blocks in lazily parsed functions. r=bhackett


And the offending patch was backed ont in http://hg.mozilla.org/mozilla-central/rev/175bebe48034

Comment 4

[juan becerra [:juanb]]

A similar crash is in the top 5 of crashers for Fx26 beta at the moment.

Comment 5

[Robert Kaiser]

Juan, sorry to undo your flags here, but see bug 858032, this is a generic signature that catches anything that goes wrong in the Baseline JIT and therefore it's an expected and unactionable topcrash - unless you find specifically reproducible instances, which should be filed as separate bugs.

Given that bug 933798 stuck, I take it this specific instance was actually fixed. Please reopen if the specific steps on this bug (and what Alice used in comment #2) still cause the crash.

For other occurrences with specific steps to reproduce, please file new bugs.