461323 - Crash [@ js_GetLengthProperty]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Chen Ruo Fei]

User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.0.3) Gecko/2008092414 Firefox/3.0.3
Build Identifier: 

#48 top crash for Firefox 3.1b1

This crash occurs on both Windows and Mac. I'm filing this as critical since it is a crash.

Stack Trace:
0     libmozjs.dylib     js_GetLengthProperty       js/src/jsarray.cpp:229
1     libmozjs.dylib     PushObject                 js/src/json.cpp:499
2     libmozjs.dylib     js_ConsumeJSONText         js/src/json.cpp:535
3     libmozjs.dylib     js_json_parse              js/src/json.cpp:81
4     libmozjs.dylib     js_Interpret               js/src/jsinterp.cpp:4985
5     libmozjs.dylib     js_Invoke                  js/src/jsinvoke.cpp:1324
6     libmozjs.dylib     js_fun_apply               js/src/jsfun.cpp:1731
7     libmozjs.dylib     js_Interpret               js/src/jsinterp.cpp:4985
8     libmozjs.dylib     js_Invoke                  js/src/jsinvoke.cpp:1324
9     libmozjs.dylib     js_InternalInvoke          js/src/jsinvoke.cpp:1381
10    libmozjs.dylib     JS_CallFunctionValue       js/src/jsapi.cpp:5136
11    XUL                nsJSContext::CallEventHandler     dom/src/base/nsJSEnvironment.cpp:2000
12    XUL                nsGlobalWindow::RunTimeout        dom/src/base/nsGlobalWindow.cpp:7721

Reproducible: Didn't try




Discovered this from analysis of top crashes in Firefox 3.1b1

http://crash-stats.mozilla.com/report/list?product=Firefox&version=Firefox%3A3.1b1&query_search=signature&query_type=contains&query=&date=&range_value=1&range_unit=weeks&do_query=1&signature=js_GetLengthProperty

example crash report:
http://crash-stats.mozilla.com/report/index/0e37eaa6-9f1e-11dd-8ff8-001cc45a2ce4

Comment 1

[Robert Sayre]

Looks FIXED by bug 462778.