970368 - crash in JSScript::code()

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[juan becerra [:juanb]]

This bug was filed from the Socorro interface and is 
report bp-977b4de4-f26c-4fbf-880b-be3752140209.
=============================================================

This is a new signature in Aurora 29, and it seems to have started happening around 2/07. It's in the top 10 at the moment. It also is showing up in Nightly, starting around the same time, but not at the top on that branch.

 	Module 	Signature 	Source
0 	mozjs.dll 	JSScript::code() 	js/src/jsinfer.h
1 	mozjs.dll 	JSScript::offsetToPC(unsigned int) 	js/src/jsscript.h
2 	mozjs.dll 	js::jit::InlineFrameIteratorMaybeGC<1>::findNextFrame() 	js/src/jit/IonFrames.cpp
3 	mozjs.dll 	js::jit::InlineFrameIteratorMaybeGC<1>::InlineFrameIteratorMaybeGC<1>(JSContext *,js::jit::IonFrameIterator const *) 	js/src/jit/IonFrameIterator.h
4 	mozjs.dll 	js::jit::GetPcScript(JSContext *,JSScript * *,unsigned char * *) 	js/src/jit/IonFrames.cpp
5 	mozjs.dll 	JSContext::currentScript(unsigned char * *,JSContext::MaybeAllowCrossCompartment) 	js/src/jscntxtinlines.h
6 	mozjs.dll 	js::jit::InvokeFunction(JSContext *,JS::Handle<JSObject *>,unsigned int,JS::Value *,JS::Value *) 	js/src/jit/VMFunctions.cpp
7 		@0x25da757c

Comment 1

[Andrei Purice]

Marking this as Resolved > Works for me since there are no more crashes in the past 6 months with this signature.