Closed
Bug 487215
Opened 16 years ago
Closed 16 years ago
Crash [@ js_Interpret ]
Categories
(Core :: JavaScript Engine, defect, P1)
Core
JavaScript Engine
Tracking
()
VERIFIED
FIXED
mozilla1.9.2a1
People
(Reporter: dev-null, Assigned: mrbkap)
References
()
Details
(Keywords: crash, regression, verified1.9.1)
Crash Data
Attachments
(1 file)
|
(deleted),
patch
|
brendan
:
review+
|
Details | Diff | Splinter Review |
Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2a1pre) Gecko/20090407 Minefield/3.6a1pre
Steps to reproduce:
1. Open the URL.
Actual result:
Crashes.
BuildID=20090406035346 SourceStamp=b14428284d51 works fine
BuildID=20090407030745 SourceStamp=f0507c4d0abb fails
Crash Report:
http://crash-stats.mozilla.com/report/index/84fe518c-c2c1-4a6b-9168-18c422090407
Flags: blocking1.9.1?
|
Reporter | |
Comment 1•16 years ago
|
||
http://hg.mozilla.org/mozilla-central/rev/7d681f116714 works
http://hg.mozilla.org/mozilla-central/rev/2cf0bbe3772a fails
Maybe caused by bug 452498
Blocks: upvar2
|
|
Reporter | |
Comment 2•16 years ago
|
||
I guess it's triggered by
(function () {
Math.min(10, items.length-index).times(proceed);
if (index < items.length)
setTimeout(arguments.callee, 50);
})();
in http://res.nicovideo.jp/js/ads.js
|
||
Updated•16 years ago
|
Assignee: general → brendan
Status: NEW → ASSIGNED
OS: Mac OS X → All
Priority: -- → P1
Hardware: x86 → All
Target Milestone: --- → mozilla1.9.1b4
|
||
Updated•16 years ago
|
Flags: blocking1.9.1? → blocking1.9.1+
|
Assignee | |
Comment 3•16 years ago
|
||
We can't unset the funarg flag if the lambda uses arguments.
Assignee: brendan → mrbkap
Attachment #371543 -
Flags: review?(brendan)
|
|
||
Comment 4•16 years ago
|
||
Comment on attachment 371543 [details] [diff] [review]
Proposed fix
Argh, my todo list had these two items, forgotten till now:
* arguments.callee hazard not flagged via PND_FUNARG
* named function expr name not flagged via PND_FUNARG
The second is still an issue, but one fix at a time.
/be
Attachment #371543 -
Flags: review?(brendan) → review+
|
|
Assignee | |
Comment 5•16 years ago
|
||
Status: ASSIGNED → RESOLVED
Closed: 16 years ago
Resolution: --- → FIXED
|
|
||
Comment 6•16 years ago
|
||
Keywords: fixed1.9.1
|
||
Comment 7•16 years ago
|
||
Verified fixed with the given URL from comment 0 on trunk and 1.9.1 with the
following debug builds:
Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2a1pre)
Gecko/20090422 Minefield/3.6a1pre ID:20090422224452
Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b4pre)
Gecko/20090422 Shiretoko/3.5b4pre ID:20090422122043
Status: RESOLVED → VERIFIED
Keywords: fixed1.9.1 → verified1.9.1
Target Milestone: mozilla1.9.1b4 → mozilla1.9.2a1
|
||
Updated•13 years ago
|
Crash Signature: [@ js_Interpret ]
You need to log in
before you can comment on or make changes to this bug.
Description
•