Closed
Bug 580144
Opened 14 years ago
Closed 14 years ago
JM: mochitest-plain crash on Windows only: test_MochiKit-Base.html
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
People
(Reporter: dmandelin, Assigned: dmandelin)
References
Details
We crash getting a cached native iterator.
Assignee | ||
Updated•14 years ago
|
Summary: JM: mochitest-plain crash: test_sanity.html → JM: mochitest-plain crash: test_MochiKit-Base.html
Assignee | ||
Comment 1•14 years ago
|
||
This is a tough one. It appears that the last 10-15 elements of the native iterator cache get corrupted. The corruption does not appear to happen in the interpreter; it seems to be either something with JM or something with the browser. The crash happens every time, but not always at the same point, so it seems hard to pinpoint the corruption using watchpoints.
This appears only on Windows.
The bug started in moo rev 47887, which is basically a build-fix of rev 47885, which is a merge from TM. The parent revs to the merge rev are OK, so the bug somehow appeared either due to error performing the merge, or more likely, an interaction that appeared with the merge change.
The crash appears if the method JIT is turned off via browser pref (in automation.py).
The crash does not appear if the method JIT is disabled in the build (with --disable-methodjit).
Summary: JM: mochitest-plain crash: test_MochiKit-Base.html → JM: mochitest-plain crash on Windows only: test_MochiKit-Base.html
Assignee | ||
Comment 2•14 years ago
|
||
http://hg.mozilla.org/users/danderson_mozilla.com/moo/rev/1661c73938c5
JS_METHODJIT wasn't getting put in js-config.h, so different files saw different layouts for JSThreadData => lose.
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•