Closed Bug 992306 Opened 11 years ago Closed 11 years ago

crash in JSObject::getGeneric(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>)

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Version:
31 Branch
Platform:
x86
Windows NT
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 992535
Tracking Flags:
Tracking Status
firefox31 - affected

People

(Reporter: u279076, Unassigned)

Details

(Keywords: crash, regression, Whiteboard: [GGC])

Crash Data

This bug was filed from the Socorro interface and is 
report bp-d4e04823-53d4-4ad6-8698-065832140403.
=============================================================
0 	mozjs.dll 	JSObject::getGeneric(JSContext *,JS::Handle<JSObject *>,JS::Handle<JSObject *>,JS::Handle<jsid>,JS::MutableHandle<JS::Value>) 	js/src/jsobj.h
1 	mozjs.dll 	js::jit::DoGetPropFallback 	js/src/jit/BaselineIC.cpp
2 		@0x3fcf54a9 	
3 		@0x1cb8d276 	

More reports:
https://crash-stats.mozilla.com/report/list?signature=JSObject%3A%3AgetGeneric%28JSContext*%2C+JS%3A%3AHandle%3CJSObject*%3E%2C+JS%3A%3AHandle%3CJSObject*%3E%2C+JS%3A%3AHandle%3Cjsid%3E%2C+JS%3A%3AMutableHandle%3CJS%3A%3AValue%3E%29&product=Firefox&query_type=contains&range_unit=weeks&process_type=any&version=Firefox%3A31.0a1&hang_type=any&date=2014-04-04+17%3A00%3A00&range_value=1

I'm seeing these crashes first show up on 2014-03-29 for Firefox 31 which may correlate to enabling GGC on Nightly. 

A note about the above stack is that each report seems to have a slightly different stack, though they all seem to start with the same two frames. A couple of comments mention Soundcloud (similar to several other signatures reported recently).

It should also be noted that this is not yet a topcrash. It currently sits at #36, accounting for 0.32% of all Firefox 31 crashes.
Flags: needinfo?(terrence)
Summary: [GGC?] crash in JSObject::getGeneric(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>) → crash in JSObject::getGeneric(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>)
Whiteboard: [GGC]
I got this crash whilst navigating around treeherder:
http://treeherder-dev.allizom.org/ui/#/jobs

bp-5ddfe59e-f10e-4463-96a6-31acd2140409

RyanVM said he had a similar crash on treeherder this morning too.
No crashes with this signature reported on builds after 8 Apr.
Status: NEW → RESOLVED
Closed: 11 years ago
Flags: needinfo?(terrence)
Resolution: --- → DUPLICATE
Duplicate, untracking.
tracking-firefox31: + → -
Since the linked dupe is "Access Denied" (to me) I'm reporting here this has reappeared as of 2014/11/18 in Nightly.  Example: https://crash-stats.mozilla.com/report/index/917ab93a-d762-4449-9144-9d06d2141119
You need to log in before you can comment on or make changes to this bug.