940131 - Crash with SIGTRAP involving ArrayType

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision d58ab6f6ca0a (run with --ion-eager):


var Vec3 = new TypedObject.ArrayType(TypedObject.float32, 3);
var Sprite = new TypedObject.ArrayType(Vec3, 3);
var mario = new Sprite();
new Vec3(mario);

Comment 1

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/669ccf5fb31e
user:        Felix S. Klock II
date:        Tue Nov 05 09:53:00 2013 +0100
summary:     Bug 933269: jit support for getElem in TypedObjects (r=nmatsakis).

This iteration took 367.923 seconds to run.

Comment 2

[Andrew McCreight [:mccr8]]

Typed objects are trunk-only, so probably no need to track this.

I don't know how bad this is, but I'm just going to mark it sec-high.  Feel free to adjust as needed.

Comment 3

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision edac8cba9f78).

Comment 4

[Christian Holler (:decoder)]

JSBugMon: Fix Bisection requested, failed due to error (try manually).

Comment 5

[Christian Holler (:decoder)]

Updated autoBisect, let's see if it works now.

Comment 6

[Christian Holler (:decoder)]

JSBugMon: Fix Bisection requested, result:
Due to skipped revisions, the first good revision could be any of:
changeset:   http://hg.mozilla.org/mozilla-central/rev/b0678affef03
user:        Ehsan Akhgari
date:        Fri Dec 06 08:08:52 2013 -0500
summary:     Bug 915735 - Build ICU as a shared library where JS is built as a shared library; r=glandium

changeset:   http://hg.mozilla.org/mozilla-central/rev/be257c6d6d24
user:        Andrew Halberstadt
date:        Fri Dec 06 09:24:09 2013 -0500
summary:     Bug 942275 - Add support for setuptools' entry points to mach, r=gps

changeset:   http://hg.mozilla.org/mozilla-central/rev/070043d0e2e1
user:        Stephen Pohl
date:        Fri Dec 06 09:41:09 2013 -0500
summary:     Backout 2ea21428f70c (bug 860493) while working on overall performance and bugs for swipe animations. r=me

changeset:   http://hg.mozilla.org/mozilla-central/rev/40718eca5ea7
user:        Carsten "Tomcat" Book
date:        Fri Dec 06 15:58:22 2013 +0100
summary:     Backed out changeset bbd9375c5f50 (bug 938772) mochitest 5 timeout failures

changeset:   http://hg.mozilla.org/mozilla-central/rev/6a4ad5ae7eb7
user:        Gregory Szorc
date:        Fri Dec 06 11:35:52 2013 +0800
summary:     Bug 945577 - mach rbt command to run ReviewBoard Tools; r=ahal

changeset:   http://hg.mozilla.org/mozilla-central/rev/9ff7f259d9bc
user:        Ethan Tseng
date:        Tue Nov 26 17:25:40 2013 +0800
summary:     Bug 938512 - HTMLMediaElement does not fire loadedmetadata. r=sworkman

changeset:   http://hg.mozilla.org/mozilla-central/rev/c149ae799213
user:        David Major
date:        Fri Dec 06 10:21:16 2013 -0500
summary:     Bug 939043 - Downgrade the user32 assertion to a warning message. r=bsmedberg

changeset:   http://hg.mozilla.org/mozilla-central/rev/906f5a720000
user:        Jim Chen
date:        Fri Dec 06 10:22:18 2013 -0500
summary:     Bug 942470 - Don't apply user agent update if updates have been disabled. r=fabrice

changeset:   http://hg.mozilla.org/mozilla-central/rev/013d080dbc29
user:        Dan Glastonbury
date:        Fri Dec 06 10:23:16 2013 -0500
summary:     Bug 942507 - GLContext doesn't need to have userdata. r=bjacob

changeset:   http://hg.mozilla.org/mozilla-central/rev/b76e788fa217
user:        Walter Meinl
date:        Fri Dec 06 10:24:01 2013 -0500
summary:     Bug 946878 - Don't pass unknown options over to jemalloc configure. r=glandium

changeset:   http://hg.mozilla.org/mozilla-central/rev/0cfd889611f8
user:        Nicolas Silva
date:        Fri Dec 06 16:30:50 2013 +0100
summary:     Bug 943392 - Let MemoryTextureClient use a fallible allocation. r=BenWa

changeset:   http://hg.mozilla.org/mozilla-central/rev/11e0720cbd28
user:        Birunthan Mohanathas
date:        Fri Dec 06 10:34:20 2013 -0500
summary:     Bug 206659 - Disregard case of MIME types in nsPluginTag::InitMime and add tests to verify mixed-case MIME type handling. r=bsmedberg

changeset:   http://hg.mozilla.org/mozilla-central/rev/22b9018bf95c
user:        Byron Campen [:bwc]
date:        Mon Nov 25 10:37:21 2013 -0800
summary:     Bug 942940 - Fix bug where a destroyed peerreflexive candidate could be left in the component list if candidate pair creation/insertion failed for some reason. r=abr

changeset:   http://hg.mozilla.org/mozilla-central/rev/5544b1b9b81e
user:        Byron Campen [:bwc]
date:        Tue Dec 03 16:11:29 2013 -0800
summary:     Bug 942940 - Fix a potential memory leak. r=abr

changeset:   http://hg.mozilla.org/mozilla-central/rev/0d405a9b2a8a
user:        Dan Glastonbury
date:        Fri Dec 06 10:36:13 2013 -0500
summary:     Bug 945023 - Extract CreateTextureXXX and CreateRenderbufferXXX from GLContext. r=bjacob

changeset:   http://hg.mozilla.org/mozilla-central/rev/815cd189ae2c
user:        Andy Wingo
date:        Wed Dec 04 14:53:25 2013 +0100
summary:     Bug 945813 - Paper over cycle collection problem in IndexedDB. r=mccr8, r=khuey

changeset:   http://hg.mozilla.org/mozilla-central/rev/5880bbf6182c
user:        Andrea Marchesini
date:        Fri Dec 06 16:40:49 2013 +0000
summary:     Bug 947134 - Enable datastore/tests/test_certifiedApp.html for B2G Emulator, r=ehsan

changeset:   http://hg.mozilla.org/mozilla-central/rev/f4f8faa3771c
user:        Jan Gerber
date:        Fri Dec 06 03:19:00 2013 -0800
summary:     Bug 918550 - Update libvpx to 1.3.0 r=glandium,cpearce

changeset:   http://hg.mozilla.org/mozilla-central/rev/e070e04b0795
user:        Jan Gerber
date:        Tue Dec 03 16:21:00 2013 -0800
summary:     Bug 833023 - Enable VP9 playback in HTML media elements. r=kinetik

changeset:   http://hg.mozilla.org/mozilla-central/rev/79d1a5a93b64
parent:      159184:e070e04b0795
parent:      159215:b746f594a884
user:        Ryan VanderMeulen
date:        Fri Dec 06 15:56:46 2013 -0500
summary:     Merge b2g-inbound to m-c.

changeset:   http://hg.mozilla.org/mozilla-central/rev/b3806ae5399d
parent:      159216:79d1a5a93b64
parent:      159246:7bda9296f32b
user:        Ryan VanderMeulen
date:        Fri Dec 06 16:03:56 2013 -0500
summary:     Merge fx-team to m-c.

changeset:   http://hg.mozilla.org/mozilla-central/rev/5aecc00ca4dd
parent:      159251:c1c2a5695550
parent:      159247:b3806ae5399d
user:        Ryan VanderMeulen
date:        Fri Dec 06 16:12:01 2013 -0500
summary:     Merge m-c to b-i.

changeset:   http://hg.mozilla.org/mozilla-central/rev/bcdcc7f548bf
user:        Anshul Jain
date:        Fri Dec 06 12:01:30 2013 -0800
summary:     Bug 946942 - Update APN settings on start if MMS call is already connected. r=gene

changeset:   http://hg.mozilla.org/mozilla-central/rev/fa482552d1aa
parent:      159184:e070e04b0795
user:        Christian Holler
date:        Fri Dec 06 18:39:42 2013 +0100
summary:     Bug 937083 - Make js::CharsToNumber propagate OOM. r=shu

changeset:   http://hg.mozilla.org/mozilla-central/rev/9d99e9ca7b32
user:        Andy Wingo
date:        Fri Dec 06 17:56:20 2013 +0100
summary:     Bug 927782 - Part 1: Expose JSScript::getBlockScope(jsbytecode *). r=luke

changeset:   http://hg.mozilla.org/mozilla-central/rev/c8304ccf88e9
user:        Andy Wingo
date:        Mon Nov 25 12:19:38 2013 +0100
summary:     Bug 927782 - Part 2: Remove HAS_BLOCKCHAIN. r=luke

changeset:   http://hg.mozilla.org/mozilla-central/rev/fc7a979712fc
user:        Andy Wingo
date:        Mon Nov 25 12:19:58 2013 +0100
summary:     Bug 927782 - Part 3: Add DEBUGLEAVEBLOCK opcode to invalidate live DebugScopes. r=luke

changeset:   http://hg.mozilla.org/mozilla-central/rev/cbdd50c96b85
user:        Andy Wingo
date:        Fri Dec 06 18:22:06 2013 +0100
summary:     Bug 927782 - Part 4: Generators allocate all locals on the scope chain. r=luke

changeset:   http://hg.mozilla.org/mozilla-central/rev/d6946bd743b3
user:        Andy Wingo
date:        Tue Nov 26 10:11:06 2013 +0100
summary:     Bug 927782 - Part 5: Clean up bytecode generation for catch clauses. r=jorendorff

changeset:   http://hg.mozilla.org/mozilla-central/rev/f1237f11edcd
user:        Andy Wingo
date:        Tue Nov 26 10:13:59 2013 +0100
summary:     Bug 927782 - Part 6: Fix for-let nesting so nonlocal exits are easier. r=luke

changeset:   http://hg.mozilla.org/mozilla-central/rev/8c74b1f68590
user:        Andy Wingo
date:        Fri Dec 06 18:25:55 2013 +0100
summary:     Bug 927782 - Part 7: Refactor entering and leaving block scopes in BytecodeEmitter. r=luke

changeset:   http://hg.mozilla.org/mozilla-central/rev/5f086f95b305
user:        Andy Wingo
date:        Fri Dec 06 18:27:55 2013 +0100
summary:     Bug 927782 - Part 8: Record block scope ranges more precisely. r=luke

changeset:   http://hg.mozilla.org/mozilla-central/rev/b971de7edfff
user:        Andy Wingo
date:        Fri Dec 06 18:30:05 2013 +0100
summary:     Bug 927782 - Part 9: Fix js_DumpScriptDepth to not abort on unreachable bytecodes. r=luke

changeset:   http://hg.mozilla.org/mozilla-central/rev/eed9795fa80e
user:        Andy Wingo
date:        Fri Dec 06 18:42:08 2013 +0100
summary:     Bug 927782 - Part 10: Iterate block chain from compile-time block scope maps, not runtime blockChain. r=luke

changeset:   http://hg.mozilla.org/mozilla-central/rev/51d6617835d1
user:        Andy Wingo
date:        Tue Nov 26 12:07:02 2013 +0100
summary:     Bug 927782 - Part 11: Optimize block scopes without aliased locals. r=luke

changeset:   http://hg.mozilla.org/mozilla-central/rev/f86d2d4cfadf
user:        Andy Wingo
date:        Tue Nov 26 12:17:08 2013 +0100
summary:     Bug 927782 - Part 12: Remove blockChain from StackFrame. r=luke

changeset:   http://hg.mozilla.org/mozilla-central/rev/4dcb040e3c84
user:        Andrew McCreight
date:        Fri Dec 06 10:17:19 2013 -0800
summary:     Bug 937766, part 1 - Remove dying nodes from gCCBlackMarkedNodes. r=smaug

changeset:   http://hg.mozilla.org/mozilla-central/rev/b015eac4566f
user:        Andrew McCreight
date:        Fri Dec 06 10:17:20 2013 -0800
summary:     Bug 937766, part 2 - Make SnowWhiteKiller remove dying things from the CC graph. r=smaug

changeset:   http://hg.mozilla.org/mozilla-central/rev/9a4f57330003
user:        Andrew McCreight
date:        Fri Dec 06 10:17:20 2013 -0800
summary:     Bug 937766, part 3 - Add mParticipant null checks. r=smaug

changeset:   http://hg.mozilla.org/mozilla-central/rev/abc785d60d75
user:        Andrew McCreight
date:        Fri Dec 06 10:17:20 2013 -0800
summary:     Bug 937766, part 4 - Add GCGraph::IsEmpty method. r=smaug

changeset:   http://hg.mozilla.org/mozilla-central/rev/edb01fe9d000
user:        Andrew McCreight
date:        Fri Dec 06 10:17:20 2013 -0800
summary:     Bug 937766, part 5 - Implement PrepareForGarbageCollection. r=smaug

changeset:   http://hg.mozilla.org/mozilla-central/rev/60e84998a0a2
user:        EKR
date:        Fri Dec 06 10:20:19 2013 -0800
summary:     Bug 906968 - Add support for TURN TCP. r=abr

changeset:   http://hg.mozilla.org/mozilla-central/rev/2f8a83944e71
user:        Jan de Mooij
date:        Fri Dec 06 19:31:57 2013 +0100
summary:     Bug 937540 part 10 - Use placement new syntax for PendingMove. r=luke

changeset:   http://hg.mozilla.org/mozilla-central/rev/1ba23d5502e1
user:        Jan Gerber
date:        Fri Dec 06 10:00:00 2013 -0800
summary:     Date:   Fri Dec 6 18:58:44 2013 +0100

changeset:   http://hg.mozilla.org/mozilla-central/rev/06c8949f78a0
user:        Alexander Surkov
date:        Fri Dec 06 13:47:00 2013 -0500
summary:     Bug 944396 - remove GetRelativeOffset, r=tbsaunde

changeset:   http://hg.mozilla.org/mozilla-central/rev/d701e36c7ca8
user:        Gian-Carlo Pascutto
date:        Fri Dec 06 20:34:40 2013 +0100
summary:     Bug 946865 - Move Load Adaption preference to the main thread. r=jesup

changeset:   http://hg.mozilla.org/mozilla-central/rev/1d9356c6c769
user:        Luke Wagner
date:        Fri Nov 22 15:45:18 2013 -0600
summary:     Bug 931864 - remove the activeGCInAtomsZone limitation in JS::CanCompileOffThread (r=billm)

changeset:   http://hg.mozilla.org/mozilla-central/rev/b183f613840c
user:        Chris Peterson
date:        Fri Dec 06 09:47:28 2013 -0800
summary:     Bug 945613 - Part 3: #ifdef pragma for gcc >= 4.7.0. r=ehsan

changeset:   http://hg.mozilla.org/mozilla-central/rev/bf2019278b77
user:        Bobby Holley
date:        Fri Dec 06 12:01:41 2013 -0800
summary:     Bug 937317 - Make TabChildGlobal implement nsIGlobalObject. r=bz

changeset:   http://hg.mozilla.org/mozilla-central/rev/1c03be82647e
user:        Bobby Holley
date:        Fri Dec 06 12:01:41 2013 -0800
summary:     Bug 937317 - Factor out the shareable parts of CallSetup into AutoEntryScript and AutoIncubentScript. r=bz

changeset:   http://hg.mozilla.org/mozilla-central/rev/c95c51d24d1c
user:        Bobby Holley
date:        Fri Dec 06 12:01:41 2013 -0800
summary:     Bug 937317 - Implement basic script settings stack machinery. r=bz

changeset:   http://hg.mozilla.org/mozilla-central/rev/82df7174496c
user:        Bobby Holley
date:        Fri Dec 06 12:01:42 2013 -0800
summary:     Bug 937317 - Manipulate the script settings stack from the RAII classes. r=bz

changeset:   http://hg.mozilla.org/mozilla-central/rev/a6b672cbd54d
user:        Bobby Holley
date:        Fri Dec 06 12:01:42 2013 -0800
summary:     Bug 937317 - Implement and expose GetIncumbentGlobal. r=bz,luke

changeset:   http://hg.mozilla.org/mozilla-central/rev/c5940c217bd9
user:        Bobby Holley
date:        Fri Dec 06 12:01:42 2013 -0800
summary:     Bug 937317 - Pass the entire CallbackObject to CallSetup. r=bz

changeset:   http://hg.mozilla.org/mozilla-central/rev/7be223bdc61a
user:        Bobby Holley
date:        Fri Dec 06 12:01:42 2013 -0800
summary:     Bug 937317 - When invoking a callback object, restore the incumbent script settings object from when the callback was created. r=bz

changeset:   http://hg.mozilla.org/mozilla-central/rev/d8a07b335193
user:        Bobby Holley
date:        Fri Dec 06 12:01:42 2013 -0800
summary:     Bug 937317 - Return null from ToWebIDLCallback if one doesn't already exist. r=bz

changeset:   http://hg.mozilla.org/mozilla-central/rev/6c504f06a0fb
user:        Bobby Holley
date:        Fri Dec 06 12:01:42 2013 -0800
summary:     Bug 937317 - Replace all instance of null cx pushing with AutoSystemCaller. r=bz

changeset:   http://hg.mozilla.org/mozilla-central/rev/97e479dec2cf
user:        Bobby Holley
date:        Fri Dec 06 12:01:43 2013 -0800
summary:     Bug 937317 - Remove unnecessary AutoSystemCaller usage. r=bz

changeset:   http://hg.mozilla.org/mozilla-central/rev/35371620801a
user:        Bobby Holley
date:        Fri Dec 06 12:01:43 2013 -0800
summary:     Bug 937317 - Tests. r=bz

changeset:   http://hg.mozilla.org/mozilla-central/rev/e38e402fa80c
user:        Bobby Holley
date:        Fri Dec 06 12:01:43 2013 -0800
summary:     Bug 937317 - touch clobber file. r=me

changeset:   http://hg.mozilla.org/mozilla-central/rev/6fd483b8cf66
user:        David Keeler
date:        Fri Dec 06 11:59:26 2013 -0800
summary:     bug 946791 - remove unused GLContextGLX::mLibType (leaving GLXLibrary::mLibType alone) r=bjacob

changeset:   http://hg.mozilla.org/mozilla-central/rev/94cdaced90bf
user:        Ryan VanderMeulen
date:        Fri Dec 06 15:03:19 2013 -0500
summary:     Backed out 12 changesets (bug 927782) for SM rootanalysis orange.

changeset:   http://hg.mozilla.org/mozilla-central/rev/d86f10836597
user:        Jan de Mooij
date:        Fri Dec 06 21:03:27 2013 +0100
summary:     Bug 946883 - Use NSPR thread for AsmJSMachExceptionHandler on OS X, so that it works with PosixNSPR. r=luke

changeset:   http://hg.mozilla.org/mozilla-central/rev/17760eeea357
user:        Trevor Saunders
date:        Fri Dec 06 16:03:40 2013 -0500
summary:     bug 931399 - shutdown DocAccessibles in nsDocumentViewer::Destroy r=bz

changeset:   http://hg.mozilla.org/mozilla-central/rev/7229b03abd0f
parent:      159294:17760eeea357
parent:      159247:b3806ae5399d
user:        Ryan VanderMeulen
date:        Fri Dec 06 16:13:37 2013 -0500
summary:     Merge m-c to inbound.

changeset:   http://hg.mozilla.org/mozilla-central/rev/54eac2d5c039
user:        Jeff Walden
date:        Mon Dec 17 14:53:35 2012 -0500
summary:     Bug 724768 - Store the various properties of Error objects in reserved slots, and eagerly create the stack string for them.  r=bhackett for the TI bits, r=jimb otherwise

changeset:   http://hg.mozilla.org/mozilla-central/rev/479975fcd736
user:        Jeff Walden
date:        Thu Dec 05 01:56:40 2013 -0800
summary:     Bug 724768 - Set every blank class prototype as a delegate immediately after birth, so that we can properly and correctly cache the shape for new instances of that class that use that prototype.  r=bhackett

changeset:   http://hg.mozilla.org/mozilla-central/rev/3907208b88c5
user:        Douglas Crosher
date:        Fri Dec 06 16:26:35 2013 -0500
summary:     Bug 942027 - Ionmonkey ARM: Add float32 support to callWithABIPost. r=mjrosenb

changeset:   http://hg.mozilla.org/mozilla-central/rev/fac17c3d3efd
user:        Benjamin Smedberg
date:        Fri Dec 06 12:03:47 2013 -0500
summary:     Bug 767343 - Use fallible allocation in nsSupportsString::SetData because people are putting arbitrarily-large data in it, perhaps session-restore data but I'm not sure, r=froydnj

changeset:   http://hg.mozilla.org/mozilla-central/rev/16628db76c3c
user:        Mike Conley
date:        Fri Dec 06 16:37:52 2013 -0500
summary:     Bug 863872 - If we have overdue TelemetryPings, try to send them all. r=nfroyd, feedback=irving.

changeset:   http://hg.mozilla.org/mozilla-central/rev/6cc28fece8bf
user:        Daniel Holbert
date:        Fri Dec 06 13:38:49 2013 -0800
summary:     Bug 946269: Rename nsFlexContainerFrame::ComputeFlexContainerCrossSize to ComputeCrossSize. implicit-rs=mats

changeset:   http://hg.mozilla.org/mozilla-central/rev/5fda7fbcc45b
user:        Camilo Viecco
date:        Fri Dec 06 13:42:44 2013 -0800
summary:     Bug 945349 - CertVerifier should check early for bad usages. r=briansmith

changeset:   http://hg.mozilla.org/mozilla-central/rev/9d2035e2155b
user:        Benoit Girard
date:        Fri Dec 06 16:44:22 2013 -0500
summary:     Bug 904227 - Print ? if we don't have a test object. r=bjacob

changeset:   http://hg.mozilla.org/mozilla-central/rev/d441322e0ad0
user:        Benjamin Smedberg
date:        Fri Dec 06 16:59:35 2013 -0500
summary:     Bustage followup to bug 767343 in non-unified builds

changeset:   http://hg.mozilla.org/mozilla-central/rev/d8d1d24d7893
user:        Terrence Cole
date:        Fri Dec 06 13:52:13 2013 -0800
summary:     Bug 941766 - Fix an exact rooting hazard in NPAPI; r=johns

changeset:   http://hg.mozilla.org/mozilla-central/rev/1e7ec87921a5
user:        Ehsan Akhgari
date:        Fri Dec 06 17:26:56 2013 -0500
summary:     Bug 924972 - Try to increase the timeout in test_reftests_with_caret.html for emulator b2g runs

changeset:   http://hg.mozilla.org/mozilla-central/rev/53a3cde703de
user:        Brian Hackett
date:        Fri Dec 06 14:46:36 2013 -0800
summary:     Bug 936156 - Mark run once lambdas inner to other run once lambdas, allow inlining foo.call(a) calls, r=jandem.

changeset:   http://hg.mozilla.org/mozilla-central/rev/9da422e00e1c
user:        Mike Hommey
date:        Sat Dec 07 07:47:27 2013 +0900
summary:     Bug 947083 - Kill elf-dynstr-gc. r=ted

changeset:   http://hg.mozilla.org/mozilla-central/rev/723e6647e64f
user:        Mike Hommey
date:        Sat Dec 07 07:47:55 2013 +0900
summary:     Bug 947453 - Remove media/libogg/src/moz.build. r=mshal

changeset:   http://hg.mozilla.org/mozilla-central/rev/9521a7b7b881
user:        Geoff Brown
date:        Fri Dec 06 16:02:48 2013 -0700
summary:     Bug 936226 - (4) Adjust crashtest manifest for Android x86; r=dminor

changeset:   http://hg.mozilla.org/mozilla-central/rev/36bd64203d5d
user:        Geoff Brown
date:        Fri Dec 06 16:02:49 2013 -0700
summary:     Bug 945675 - Disable testMozPay on Android 2.2 for too many intermittent failures

changeset:   http://hg.mozilla.org/mozilla-central/rev/5f6a0a22b19c
user:        Daniel Holbert
date:        Fri Dec 06 15:06:13 2013 -0800
summary:     (no bug) Drop bogus 'flex-wrap' / 'flex-direction' declarations from non-flex-container style rules, in reftest reference cases. (test-only)

changeset:   http://hg.mozilla.org/mozilla-central/rev/769e5d448b1e
user:        Wes Kocher
date:        Fri Dec 06 17:10:09 2013 -0600
summary:     Backed out changeset 16628db76c3c (bug 863872) for debug xpcshell test failures

changeset:   http://hg.mozilla.org/mozilla-central/rev/2099f78b7dea
parent:      159253:bcdcc7f548bf
parent:      159313:769e5d448b1e
user:        Wes Kocher
date:        Fri Dec 06 20:26:03 2013 -0600
summary:     merge inbound to m-c

changeset:   http://hg.mozilla.org/mozilla-central/rev/f9e31850d15e
parent:      159247:b3806ae5399d
user:        Matt Brubeck
date:        Fri Dec 06 13:09:31 2013 -0800
summary:     Bug 946990 - Remember whether Metro or desktop Firefox was last used [r=bbondy]

changeset:   http://hg.mozilla.org/mozilla-central/rev/12df8614fc1d
user:        Brad Lassey
date:        Wed Nov 27 15:14:26 2013 -0500
summary:     Bug 944041 - Failure to make geckoview from m-c. r=khuey

changeset:   http://hg.mozilla.org/mozilla-central/rev/05643bb0c75e
user:        Brian Grinstead
date:        Fri Dec 06 11:34:21 2013 -0600
summary:     Bug 947257 - Splitters have a dark squary sort of thing in their center. r=paul

changeset:   http://hg.mozilla.org/mozilla-central/rev/0e7592478aa5
parent:      159314:2099f78b7dea
parent:      159317:05643bb0c75e
user:        Wes Kocher
date:        Fri Dec 06 20:45:11 2013 -0600
summary:     merge fx-team to m-c

changeset:   http://hg.mozilla.org/mozilla-central/rev/42b2a2adda8f
user:        Phil Ringnalda
date:        Fri Dec 06 19:11:11 2013 -0800
summary:     Back out 567d2bba4f97 (bug 933483) for causing bug 946726

changeset:   http://hg.mozilla.org/mozilla-central/rev/d5d23d937ffc
parent:      159313:769e5d448b1e
user:        Randell Jesup
date:        Fri Dec 06 18:43:02 2013 -0500
summary:     Bug 947429: add prefs that let us disable gum video and peerconnection video r=jib

changeset:   http://hg.mozilla.org/mozilla-central/rev/10edfe4c3208
user:        Felipe Gomes
date:        Fri Dec 06 22:02:05 2013 -0200
summary:     Bug 897061 - [e10s] Implement support for form autocomplete. r=markh

changeset:   http://hg.mozilla.org/mozilla-central/rev/86307d61bcb3
user:        Donovan Preston
date:        Fri Dec 06 16:17:50 2013 -0800
summary:     Bug 707294 -- Change some strings in the webapprt to say "application" instead of "page". r=myk

changeset:   http://hg.mozilla.org/mozilla-central/rev/61cda1f28ce4
user:        Brian Hackett
date:        Fri Dec 06 16:22:20 2013 -0800
summary:     Bug 943924 - Use default stack size for JS worker threads on Windows, r=billm.

changeset:   http://hg.mozilla.org/mozilla-central/rev/2c5a87384e5b
user:        Gregory Szorc
date:        Sat Dec 07 09:30:19 2013 +0900
summary:     Bug 945577 - Followup to mach rbt so argument parsing works as expected

changeset:   http://hg.mozilla.org/mozilla-central/rev/26fb7e60d288
user:        Geoff Brown
date:        Fri Dec 06 17:48:45 2013 -0700
summary:     Bug 945675 - Disable testMozPay (entirely) for too many failures

changeset:   http://hg.mozilla.org/mozilla-central/rev/5c34885094e4
user:        Steve Fink
date:        Fri Dec 06 17:00:48 2013 -0800
summary:     Bug 947400 - Make the analysis consider whether a virtual call can GC when all targets are known, r=bhackett

changeset:   http://hg.mozilla.org/mozilla-central/rev/a55439a67e05
user:        Steve Fink
date:        Fri Dec 06 17:11:03 2013 -0800
summary:     Bug 947400 - Comment fixup, DONTBUILD

changeset:   http://hg.mozilla.org/mozilla-central/rev/957d85b31ff3
user:        Cameron McCormack
date:        Sat Dec 07 12:25:07 2013 +1100
summary:     Bug 914072 - Have nsCSSScanner store any implied characters at EOF needed for correct serialization. r=dbaron

changeset:   http://hg.mozilla.org/mozilla-central/rev/d58ca9a622c0
user:        Nicholas D. Matsakis
date:        Mon Sep 30 10:19:09 2013 -0400
summary:     Bug 922115 - Unsized array support in Typed Objects r=sfink

changeset:   http://hg.mozilla.org/mozilla-central/rev/c996211971a8
user:        Nicholas D. Matsakis
date:        Fri Nov 01 11:10:47 2013 -0400
summary:     Bug 933760 - Track a type object for each type representation, associate with the type descriptor r=bhackett

changeset:   http://hg.mozilla.org/mozilla-central/rev/ffc6dc19cc05
user:        Drew Willcoxon
date:        Fri Dec 06 18:07:09 2013 -0800
summary:     Bug 898593 - Fix intermittent failures in test_bug413958.html and others by making SimpleTest.monitorConsole() ignore unexpected messages by default. r=ted

changeset:   http://hg.mozilla.org/mozilla-central/rev/9765cb37859d
parent:      159333:ffc6dc19cc05
parent:      159318:0e7592478aa5
user:        Wes Kocher
date:        Fri Dec 06 20:47:24 2013 -0600
summary:     merge m-c to inbound

changeset:   http://hg.mozilla.org/mozilla-central/rev/80db40e98167
user:        Shu-yu Guo
date:        Fri Dec 06 19:31:09 2013 -0800
summary:     Bug 946641 - Part 1: Clear delayed events on closed documents. (r=smaug)

changeset:   http://hg.mozilla.org/mozilla-central/rev/b7186d67c952
user:        Shu-yu Guo
date:        Fri Dec 06 19:31:09 2013 -0800
summary:     Bug 946641 - Part 2: Revert in Debugger frontend to balance event suppression/unsuppression. (r=past)

changeset:   http://hg.mozilla.org/mozilla-central/rev/5ca175317475
user:        Phil Ringnalda
date:        Fri Dec 06 19:40:44 2013 -0800
summary:     Bug 939620 - Disable browser_tabview_bug599626.js on Linux, where it fails all the time and takes out the whole run

changeset:   http://hg.mozilla.org/mozilla-central/rev/910ea4847f84
user:        Joshua Cranmer
date:        Fri Dec 06 21:23:06 2013 -0600
summary:     Bug 929200, part 1: Add MOZ_HEAP_ALLOCATOR to stack-only/non-heap analyses, r=Waldo.

changeset:   http://hg.mozilla.org/mozilla-central/rev/baf7b0f169a1
user:        Joshua Cranmer
date:        Fri Dec 06 21:21:54 2013 -0600
summary:     Bug 929200, part 2: Add MOZ_HEAP_ALLOCATOR to JSContext::new_, r=jimb.

changeset:   http://hg.mozilla.org/mozilla-central/rev/84cb9cf72c02
user:        Phil Ringnalda
date:        Fri Dec 06 19:50:54 2013 -0800
summary:     Back out d5d23d937ffc (bug 947429) on suspicion of breaking gaia-ui-test

changeset:   http://hg.mozilla.org/mozilla-central/rev/5ac63cd8d6f4
parent:      159340:84cb9cf72c02
parent:      159319:42b2a2adda8f
user:        Phil Ringnalda
date:        Fri Dec 06 21:11:17 2013 -0800
summary:     Merge m-c to m-i

changeset:   http://hg.mozilla.org/mozilla-central/rev/921be552b22f
user:        Alexander Surkov
date:        Sat Dec 07 00:40:02 2013 -0500
summary:     Bug 943482 - remove a11y support of not existing xul:menulist@droppable, r=tbsaunde

changeset:   http://hg.mozilla.org/mozilla-central/rev/33e4d9281b5d
user:        Randell Jesup
date:        Fri Dec 06 18:43:02 2013 -0500
summary:     Bug 947429: add prefs that let us disable gum video and peerconnection video r=jib

changeset:   http://hg.mozilla.org/mozilla-central/rev/77d06ee9ac48
parent:      159343:33e4d9281b5d
user:        Ehsan Akhgari
date:        Fri Dec 06 21:07:02 2013 -0500
summary:     Bug 947299 - Don't build ICU as a shared library when building JS in standalone mode; r=glandium

This iteration took 341.877 seconds to run.

Comment 7

[Niko Matsakis [:nmatsakis]]

I ported the test to the modern API:

var Vec3 = TypedObject.float32.array(3);
var Sprite = Vec3.array(3);
var mario = new Sprite();
new Vec3(mario);

Not yet reproduced but I am digging further.

Comment 8

[Felix S. Klock II [:pnkfelix, :fklock]]

I'm poking at trying to do a better job with the bisection.  Build failures related to ICU make it difficult (I assume that's what is going on in comment 6).

Comment 9

[Felix S. Klock II [:pnkfelix, :fklock]]

So, instead of continuing blind bisection, I changed tactics.

I started with the latest revision that on which I could replicate the original problem, namely:

  changeset:   159250:e10be8b04544
  tag:         qparent
  user:        Arno Puder <[e-mail]>
  date:        Mon Nov 11 18:05:01 2013 -0800
  summary:     Bug 933585 - NFC Worker changes. r=yoshi

and then I applied these two changesets from nmatsakis atop that:

  changeset:   d58ca9a622c0
  user:        Nicholas D. Matsakis <[e-mail]>
  date:        Mon Sep 30 10:19:09 2013 -0400
  summary:     Bug 922115 - Unsized array support in Typed Objects r=sfink

  changeset:   c996211971a8
  user:        Nicholas D. Matsakis <[e-mail]>
  date:        Fri Nov 01 11:10:47 2013 -0400
  summary:     Bug 933760 - Track a type object for each type representation, associate with the type descriptor r=bhackett

With just those two changesets cherry-picked atop the failing revision, I can still build the spidermonkey js shell (yay!), and the problem (using the revised test case that nmatsakis posted) goes away.

So, having isolated the problem going away to these changesets (which are direct revisions to the Typed Objects code), I think we can close this ticket as fixed.  (In fact, because I was curious, I qpop the latter of the two commits, and the problem was still fixed.  So I think d58ca9a622c0 is the one that fixed the bug, perhaps indirectly.)

However, I will defer to nmatsakis to decide whether he wants to investigate further.

Comment 10

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

> However, I will defer to nmatsakis to decide whether he wants to investigate
> further.

Setting needinfo? as described.

Comment 11

[Niko Matsakis [:nmatsakis]]

Fixed.

Comment 12

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.