1020805 - crash in [@ js::ShapeTable::search(jsid, bool) ]

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Carsten Book [:Tomcat]]

This bug was filed from the Socorro interface and is 
report bp-2121a057-3871-4833-aa73-9cb052140605.
=============================================================

just crashed on bmo while filing a different bug :/

Crashing Thread
Frame 	Module 	Signature 	Source
0 	XUL 	js::ShapeTable::search(jsid, bool) 	js/src/vm/Shape.h
1 	XUL 	js::Shape::search(js::ExclusiveContext*, js::Shape*, jsid, js::Shape***, bool) 	js/src/vm/Shape-inl.h
2 	XUL 	js::ObjectImpl::nativeLookup(js::ExclusiveContext*, jsid) 	js/src/vm/ObjectImpl.cpp
3 	XUL 	js::LookupNativeProperty(js::ExclusiveContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::MutableHandle<JSObject*>, JS::MutableHandle<js::Shape*>) 	js/src/jsobj.cpp
4 	XUL 	bool js::baseops::SetPropertyHelper<(js::ExecutionMode)0>(js::ExecutionModeTraits<(js::ExecutionMode)0>::ContextType, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<jsid>, js::baseops::QualifiedBool, JS::MutableHandle<JS::Value>, bool) 	js/src/jsobj.cpp
5 	XUL 	bool js::SetProperty<false>(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::Value const&) 	js/src/jsobj.h
6 	XUL 	js::jit::DoSetPropFallback 	js/src/jit/BaselineIC.cpp
7 		@0x1000dc7a0

Comment 1

[me]

I got this just right now, https://crash-stats.mozilla.com/report/index/bb06bfd7-d33e-413e-8a40-762be2140611

Comment 2

[Wayne Mery (:wsmwk)]

me bp-74261a48-7b61-469c-aa10-298002141029 Thunderbird daily build. First time with this signature

Comment 3

[Wayne Mery (:wsmwk)]

again bp-03cf6e2c-5561-46f9-acb5-011ba2150104 thunderbird daily build. I deleted a message and crashed.

Comment 4

[Wayne Mery (:wsmwk)]

I was in compose, finisihing an email address. (autocomplete?)   bp-8cee1d98-3fda-4e77-9e49-1000c2150206

Comment 5

[Tobias B. Besemer [:BesTo] (QA)]

https://crash-stats.mozilla.com/report/index/54533acd-8ef8-4bce-a072-bad282150727

Crashing Thread
Frame 	Module 	Signature 	Source
0 	xul.dll 	js::ShapeTable::search(jsid, bool) 	js/src/vm/Shape.cpp
1 	xul.dll 	js::NativeObject::lookup(js::ExclusiveContext*, jsid) 	js/src/vm/NativeObject.cpp
2 	xul.dll 	js::GetProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>) 	js/src/vm/NativeObject.h
3 	xul.dll 	GetPropertyOperation 	js/src/vm/Interpreter.cpp
4 	xul.dll 	Interpret 	js/src/vm/Interpreter.cpp
5 	xul.dll 	js::RunScript(JSContext*, js::RunState&) 	js/src/vm/Interpreter.cpp
6 	xul.dll 	js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
7 	xul.dll 	js::fun_apply(JSContext*, unsigned int, JS::Value*) 	js/src/jsfun.cpp
8 	xul.dll 	js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
9 	xul.dll 	js::jit::DoCallFallback 	js/src/jit/BaselineIC.cpp
10 		@0x171ad9d646c

Comment 6

[alex_mayorga]

¡Hola!

This is a thing on Nightly, Developer, Beta and Release it seems to me per https://crash-stats.mozilla.com/report/list?product=Firefox&range_unit=days&range_value=28&signature=js%3A%3AShapeTable%3A%3Asearch

Report ID 	Date Submitted
bp-77e409de-1869-4a42-a101-3ee3d2151228
	28/12/2015	9:05


Crashing Thread (0)
Frame 	Module 	Signature 	Source
0 	xul.dll 	js::ShapeTable::search(jsid, bool) 	js/src/vm/Shape.cpp
1 	xul.dll 	js::NativeObject::lookup(js::ExclusiveContext*, jsid) 	js/src/vm/NativeObject.cpp
2 	xul.dll 	js::GetPropertyNoGC(JSContext*, JSObject*, JSObject*, js::PropertyName*, JS::Value*) 	js/src/jsobj.h
3 	xul.dll 	Interpret 	js/src/vm/Interpreter.cpp
4 	xul.dll 	js::RunScript(JSContext*, js::RunState&) 	js/src/vm/Interpreter.cpp
5 	xul.dll 	js::Invoke(JSContext*, JS::CallArgs const&, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
6 	xul.dll 	js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value const*, JS::MutableHandle<JS::Value>) 	js/src/vm/Interpreter.cpp
7 	xul.dll 	js::jit::DoCallFallback 	js/src/jit/BaselineIC.cpp
8 		@0x2088ef8908c

Comment 7

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'js::ShapeTable::search':
 - nightly (version 50): 0 crash from 2016-06-06.
 - aurora  (version 49): 0 crash from 2016-06-07.
 - beta    (version 48): 0 crash from 2016-06-06.
 - release (version 47): 0 crash from 2016-05-31.
 - esr     (version 45): 58 crashes from 2016-04-07.

Crash volume on the last weeks:
             Week N-1   Week N-2   Week N-3   Week N-4   Week N-5   Week N-6   Week N-7
 - nightly          0          0          0          0          0          0          0
 - aurora           0          0          0          0          0          0          0
 - beta             0          0          0          0          0          0          0
 - release          0          0          0          0          0          0          0
 - esr              9         10          4          6          7          7          1

Affected platforms: Windows, Mac OS X, Linux

Comment 8

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.