Closed Bug 594501 Opened 14 years ago Closed 11 years ago

Crash in [@ js::Shape::removeFromDictionary(JSObject*) ]

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
Windows XP
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: marcia, Unassigned)

Details

(Keywords: crash)

Crash Data

Seen while reviewing trunk crash stats. http://tinyurl.com/2gxopay to the crashes, which are all Windows. No comments, but a number of the crash reports happened on Yahoo Mail. Currently the #37 top crash on the trunk.

Crash-Stats table indicates the crashes started showing up in the 2010090200 build.

Frame  	Module  	Signature [Expand]  	Source
0 	xul.dll 	js::Shape::removeFromDictionary 	js/src/jsscope.h:689
1 	xul.dll 	JSObject::changeProperty 	js/src/jsscope.cpp:863
2 	xul.dll 	js_DefineNativeProperty 	js/src/jsobj.cpp:4166
3 	xul.dll 	js_DefineProperty 	js/src/jsobj.cpp:4095
4 	xul.dll 	js_obj_defineGetter 	js/src/jsobj.cpp:1565
5 	xul.dll 	DefineGetterOrSetter 	js/src/xpconnect/src/xpcquickstubs.cpp:367
6 	xul.dll 	SharedDefineGetter 	js/src/xpconnect/src/xpcquickstubs.cpp:380
7 	xul.dll 	js::mjit::stubs::SlowCall 	js/src/methodjit/InvokeHelpers.cpp:407
A number of the users seem to have no extensions installed.
Crash Signature: [@ js::Shape::removeFromDictionary(JSObject*) ]
on crashes newer than version 14.0.1 in the past 3 months
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.