1037980 - Crash in [@ js::Shape::search(js::ExclusiveContext*, js::Shape*, jsid, js::Shape***, bool) ]

Status: RESOLVED DUPLICATE of bug 904492

(Core :: JavaScript Engine, defect)

Description

[Tanner Filip [:tanner]]

This bug was filed from the Socorro interface and is 
report bp-b434c310-5bef-47ab-8678-bcac32140713.
=============================================================

Found on Twitter, I was told that the only js on the page he was loading was https://ssl.gostats.com/js/counter.js. I'm not able to reproduce it, but I'm on Linux and he's on Windows.

Found bug 961969, but that was closed months ago, and there are ~2.2k crashes from this signature in the past week.

Comment 1

[Tobias B. Besemer [:BesTo] (QA)]

https://crash-stats.mozilla.com/report/index/b434c310-5bef-47ab-8678-bcac32140713

Crashing Thread (0)
Frame 	Module 	Signature 	Source
0 	mozjs.dll 	js::Shape::search(js::ExclusiveContext*, js::Shape*, jsid, js::Shape***, bool) 	js/src/vm/Shape-inl.h
1 	mozjs.dll 	js::ObjectImpl::nativeLookup(js::ExclusiveContext*, jsid) 	js/src/vm/ObjectImpl.cpp
2 	mozjs.dll 	js::baseops::LookupProperty<1>(js::ExclusiveContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::MutableHandle<JSObject*>, JS::MutableHandle<js::Shape*>) 	js/src/jsobj.cpp
3 	mozjs.dll 	JSObject::lookupGeneric(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::MutableHandle<JSObject*>, JS::MutableHandle<js::Shape*>) 	js/src/jsobj.cpp
4 	mozjs.dll 	JS_HasPropertyById(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, bool*) 	js/src/jsapi.cpp
5 	xul.dll 	mozilla::dom::GetPropertyOnPrototype(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, bool*, JS::Value*) 	dom/bindings/BindingUtils.cpp
6 	xul.dll 	mozilla::dom::HTMLDocumentBinding::DOMProxyHandler::get(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>) 	obj-firefox/dom/bindings/HTMLDocumentBinding.cpp

Comment 2

[Tobias B. Besemer [:BesTo] (QA)]

Tested with Win7, 64bit, FF46.0a1, 64bit.

Tried https://www.gostats.com/ -> WFM.

Have no page that loads https://ssl.gostats.com/js/counter.js.

Report is from FF30.0.

Bug 904492 is a generally bug about the signature "[@ js::Shape::search ]".

I make this bug to a dup of bug 904492.