603478 - Crash methodjit [@ xpc::WrapperFactory::PrepareForWrapping(JSContext*, JSObject*, JSObject*, unsigned int) ]

Status: RESOLVED DUPLICATE of bug 603677

(Core :: JavaScript Engine, defect)

Description

[Aaron Kaluszka]

For the past week or so, I've been getting crashes almost immediately after startup, but only when javascript.options.methodjit.content is set to true.  Most of the time, the browser crashes without invoking a report, but today, I got a string of reported crashes -- I'm not completely sure if they're the same cause or coincidence.  Often, when starting the browser, the window would never come up, and the browser would silently exit or crash.  If I ran the browser loading a link, it would start to load the page and then crash.  This has been happening on all of my 64-bit Windows 7 machines with the 64-bit build.

bp-e52a8d00-22ac-4b69-b9bc-4e1062101011
bp-8c546335-be08-4f65-bded-bc4052101011
bp-e35540e5-60b7-45a6-ac36-cbad52101011
bp-c3a4d5c8-50a5-454a-ab0d-251522101011
bp-4d492c17-2f3a-443c-ad29-6a2832101011

Comment 1

[Andreas Gal :gal]

Crashing on

if (wn->GetProto()->ClassIsDOMObject())

Any chance that wn doesn't have a proto?

Comment 2

[Aaron Kaluszka]

My other crashes might actually be bug 601355.

Comment 3

[Peter Van der Beken [:peterv]]

The GetProto crash has a patch in bug 603677.