Latest comm-central trunk. MSVC2010 debug jumps to this code: JS_PUBLIC_API(JSBool) JS_ForwardGetPropertyTo(JSContext *cx, JSObject *obj, jsid id, JSObject *onBehalfOf, jsval *vp) { AssertNoGC(cx); CHECK_REQUEST(cx); assertSameCompartment(cx, obj, id); assertSameCompartment(cx, onBehalfOf); JSAutoResolveFlags rf(cx, JSRESOLVE_QUALIFIED); return obj->getGeneric(cx, onBehalfOf, id, vp); } obj->shape_->base_->clasp->ops: - ops {lookupGeneric=0x00000000 lookupProperty=0x00000000 lookupElement=0x00000000 ...} js::ObjectOps lookupGeneric 0x00000000 int (JSContext *, JSObject *, int, JSObject * *, JSProperty * *)* lookupProperty 0x00000000 int (JSContext *, JSObject *, js::PropertyName *, JSObject * *, JSProperty * *)* lookupElement 0x00000000 int (JSContext *, JSObject *, unsigned int, JSObject * *, JSProperty * *)* lookupSpecial 0x00000000 int (JSContext *, JSObject *, js::SpecialId, JSObject * *, JSProperty * *)* defineGeneric 0x00000000 int (JSContext *, JSObject *, int, const JS::Value *, int (JSContext *, JSObject *, int, JS::Value *)*, int (JSContext *, JSObject *, int, int, JS::Value *)*, unsigned int)* defineProperty 0x00000000 int (JSContext *, JSObject *, js::PropertyName *, const JS::Value *, int (JSContext *, JSObject *, int, JS::Value *)*, int (JSContext *, JSObject *, int, int, JS::Value *)*, unsigned int)* defineElement 0x00000000 int (JSContext *, JSObject *, unsigned int, const JS::Value *, int (JSContext *, JSObject *, int, JS::Value *)*, int (JSContext *, JSObject *, int, int, JS::Value *)*, unsigned int)* defineSpecial 0x00000000 int (JSContext *, JSObject *, js::SpecialId, const JS::Value *, int (JSContext *, JSObject *, int, JS::Value *)*, int (JSContext *, JSObject *, int, int, JS::Value *)*, unsigned int)* getGeneric 0x00000000 int (JSContext *, JSObject *, JSObject *, int, JS::Value *)* getProperty 0x00000000 int (JSContext *, JSObject *, JSObject *, js::PropertyName *, JS::Value *)* getElement 0x00000000 int (JSContext *, JSObject *, JSObject *, unsigned int, JS::Value *)* getElementIfPresent 0x00000000 int (JSContext *, JSObject *, JSObject *, unsigned int, JS::Value *, bool *)* getSpecial 0x00000000 int (JSContext *, JSObject *, JSObject *, js::SpecialId, JS::Value *)* setGeneric 0x00000000 int (JSContext *, JSObject *, int, JS::Value *, int)* setProperty 0x00000000 int (JSContext *, JSObject *, js::PropertyName *, JS::Value *, int)* setElement 0x00000000 int (JSContext *, JSObject *, unsigned int, JS::Value *, int)* setSpecial 0x00000000 int (JSContext *, JSObject *, js::SpecialId, JS::Value *, int)* getGenericAttributes 0x00000000 int (JSContext *, JSObject *, int, unsigned int *)* getPropertyAttributes 0x00000000 int (JSContext *, JSObject *, js::PropertyName *, unsigned int *)* getElementAttributes 0x00000000 int (JSContext *, JSObject *, unsigned int, unsigned int *)* getSpecialAttributes 0x00000000 int (JSContext *, JSObject *, js::SpecialId, unsigned int *)* setGenericAttributes 0x00000000 int (JSContext *, JSObject *, int, unsigned int *)* setPropertyAttributes 0x00000000 int (JSContext *, JSObject *, js::PropertyName *, unsigned int *)* setElementAttributes 0x00000000 int (JSContext *, JSObject *, unsigned int, unsigned int *)* setSpecialAttributes 0x00000000 int (JSContext *, JSObject *, js::SpecialId, unsigned int *)* deleteProperty 0x00000000 int (JSContext *, JSObject *, js::PropertyName *, JS::Value *, int)* deleteElement 0x00000000 int (JSContext *, JSObject *, unsigned int, JS::Value *, int)* deleteSpecial 0x00000000 int (JSContext *, JSObject *, js::SpecialId, JS::Value *, int)* enumerate 0x682211a9 XPC_WN_JSOp_Enumerate(JSContext *, JSObject *, JSIterateOp, JS::Value *, int *) int (JSContext *, JSObject *, JSIterateOp, JS::Value *, int *)* typeOf 0x680b53a5 `anonymous namespace'::PrincipalSubsume(JSPrincipals *, JSPrincipals *) JSType (JSContext *, JSObject *)* fix 0x00000000 int (JSContext *, JSObject *, bool *, js::AutoIdVector *)* thisObject 0x6821f549 XPC_WN_JSOp_ThisObject(JSContext *, JSObject *) JSObject * (JSContext *, JSObject *)* clear 0x68657c5c mozilla::plugins::PPluginSurfaceChild::DeallocSubtree(void) void (JSContext *, JSObject *)* Stack: > mozjs.dll!JS_ForwardGetPropertyTo(JSContext * cx, JSObject * obj, int id, JSObject * onBehalfOf, JS::Value * vp) Line 4059 + 0x16 bytes C++ mozjs.dll!JS_GetPropertyById(JSContext * cx, JSObject * obj, int id, JS::Value * vp) Line 4048 + 0x1a bytes C++ xul.dll!XPCWrappedNativeScope::SetGlobal(XPCCallContext & ccx, JSObject * aGlobal) Line 269 + 0x15 bytes C++ xul.dll!nsXPConnect::InitClassesWithNewWrappedGlobal(JSContext * aJSContext, nsISupports * aCOMObj, const nsID & aIID, nsIPrincipal * aPrincipal, nsISupports * aExtraPtr, unsigned int aFlags, nsIXPConnectJSObjectHolder * * _retval) Line 1338 C++ xul.dll!mozJSComponentLoader::GlobalForLocation(nsILocalFile * aComponentFile, nsIURI * aURI, JSObject * * aGlobal, char * * aLocation, JS::Value * exception) Line 706 + 0x2c bytes C++ xul.dll!mozJSComponentLoader::LoadModule(mozilla::FileLocation & aFile) Line 520 + 0x18 bytes C++ xul.dll!nsComponentManagerImpl::KnownModule::Load() Line 723 + 0xc bytes C++ xul.dll!nsFactoryEntry::GetFactory() Line 1738 + 0x5 bytes C++ xul.dll!nsComponentManagerImpl::CreateInstanceByContractID(const char * aContractID, nsISupports * aDelegate, const nsID & aIID, void * * aResult) Line 1060 + 0xb bytes C++ xul.dll!CallCreateInstance(const char * aContractID, nsISupports * aDelegate, const nsID & aIID, void * * aResult) Line 171 C++ xul.dll!nsCreateInstanceByContractID::operator()(const nsID & aIID, void * * aInstancePtr) Line 210 + 0x13 bytes C++ xul.dll!nsCOMPtr_base::assign_from_helper(const nsCOMPtr_helper & helper, const nsID & iid) Line 150 + 0xd bytes C++ xul.dll!nsAppStartupNotifier::Observe(nsISupports * aSubject, const char * aTopic, const wchar_t * someData) Line 104 C++ xul.dll!XRE_main(int argc, char * * argv, const nsXREAppData * aAppData) Line 3372 C++ seamonkey.exe!NS_internal_main(int argc, char * * argv) Line 104 C++ seamonkey.exe!wmain(int argc, wchar_t * * argv) Line 109 C++ seamonkey.exe!__tmainCRTStartup() Line 552 + 0x17 bytes C

(In reply to Edmund Wong from comment #0) > Latest comm-central trunk. Nightly or self-compiled? I think I see the same here, self-compiled, SeaMonkey (Win32) build on Win7 x64, VC9.

(This issue is just a few days old, definitely less than a week.)

> Nightly or self-compiled? Self compiled. For me Win7 x64 VS2008SP1

(In reply to Philip Chee from comment #3) > Self compiled. For me Win7 x64 VS2008SP1 Same for me (but no DirectX).

This crash signature also happens in Fx 10.0 with a very low volume. See: https://crash-stats.mozilla.com/report/list?signature=JS_ForwardGetPropertyTo

(In reply to Jens Hatlak (:InvisibleSmiley) from comment #1) > (In reply to Edmund Wong from comment #0) > > Latest comm-central trunk. > > Nightly or self-compiled? I think I see the same here, self-compiled, > SeaMonkey (Win32) build on Win7 x64, VC9. Self compiled. VC10 Win7 x64

Very possibly.

Copying blocker status from bug 718541. This issue has prevented me from building or working on other Firefox bugs for a week now.