1295120 - Crash in js::Call

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect, P3)

Description

[[:philipp]]

This bug was filed from the Socorro interface and is 
report bp-b6fd719a-c4c8-4746-b593-3572b2160815.
=============================================================
Crashing Thread (0)
Frame 	Module 	Signature 	Source
0 	xul.dll 	js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) 	js/src/vm/Interpreter.cpp:513
1 	xul.dll 	js::GetProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>) 	js/src/vm/NativeObject.h:1508
2 	xul.dll 	GetPropertyOperation 	js/src/vm/Interpreter.cpp:189
3 	xul.dll 	Interpret 	js/src/vm/Interpreter.cpp:2557
4 	xul.dll 	js::RunScript(JSContext*, js::RunState&) 	js/src/vm/Interpreter.cpp:398
5 	xul.dll 	js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp:470
6 	xul.dll 	InternalCall 	js/src/vm/Interpreter.cpp:497
7 	xul.dll 	Interpret 	js/src/vm/Interpreter.cpp:2840
8 	xul.dll 	js::RunScript(JSContext*, js::RunState&) 	js/src/vm/Interpreter.cpp:398
9 	xul.dll 	js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp:470
10 	xul.dll 	InternalCall 	js/src/vm/Interpreter.cpp:497
11 	xul.dll 	js::frontend::Parser<js::frontend::FullParseHandler>::unaryExpr(js::frontend::YieldHandling, js::frontend::TripledotHandling, js::frontend::Parser<js::frontend::FullParseHandler>::PossibleError*, js::frontend::Parser<js::frontend::FullParseHandler>::InvokedPrediction) 	js/src/frontend/Parser.cpp:8281
12 	xul.dll 	js::RunScript(JSContext*, js::RunState&) 	js/src/vm/Interpreter.cpp:398
13 	xul.dll 	js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp:470
14 	xul.dll 	InternalCall 	js/src/vm/Interpreter.cpp:497
15 	xul.dll 	Interpret 	js/src/vm/Interpreter.cpp:2840
16 	xul.dll 	js::RunScript(JSContext*, js::RunState&) 	js/src/vm/Interpreter.cpp:398
17 	xul.dll 	js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp:470
18 	xul.dll 	InternalCall 	js/src/vm/Interpreter.cpp:497
19 	xul.dll 	js::TypeScript::ThisTypes(JSScript*) 	js/src/vm/TypeInference-inl.h:491
20 	xul.dll 	js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp:452
21 	xul.dll 	js::TypeMonitorResult(JSContext*, JSScript*, unsigned char*, JS::Value const&) 	js/src/vm/TypeInference.cpp:3268
22 		@0x2

cross-platform crashes with this signature seem to have started in firefox 48 and become more frequent in 49.0b.

Comment 1

[Sylvestre Ledru [:Sylvestre]]

Low volume, wontfix for 48 but happy to take a patch in 49

Comment 2

[Milan Sreckovic [:milan] (needinfo for best results)]

So, this went from ~40 to ~80 to ~200 over the last six months, 40% of the crashes are in the first minute - maybe worth a look again?

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'js::Call':
 - nightly (version 52): 4 crashes from 2016-09-19.
 - aurora  (version 51): 2 crashes from 2016-09-19.
 - beta    (version 50): 204 crashes from 2016-09-20.
 - release (version 49): 493 crashes from 2016-09-05.
 - esr     (version 45): 0 crashes from 2016-06-01.

Crash volume on the last weeks (Week N is from 10-03 to 10-09):
            W. N-1  W. N-2
 - nightly       2       2
 - aurora        2       0
 - beta        174      30
 - release     377     115
 - esr           0       0

Affected platform: Windows

Crash rank on the last 7 days:
           Browser   Content     Plugin
 - nightly #432
 - aurora  #638
 - beta    #102      #134
 - release #196      #108
 - esr

Comment 4

[Liz Henry (:lizzard) (relman/hg->git project)]

This shows up in moderate volume on 50 (release/beta) and I don't see much happening yet with the signature for beta 51; 52 seems unaffected. Maybe it's been fixed in 51.  We may want to close this bug if it goes another week or so with no crashes in 52/53.

Comment 5

[Andrei Purice]

Marking this as Resolved > Worksforme since no other crashes with this signature have been reported in the last 6 months.