1046461 - Crash in js::BaseProxyHandler::get while stability testing

Status: RESOLVED DUPLICATE of bug 1008791

(Core :: JavaScript Engine, defect)

Description

[Greg Grisco]

[Blocking Requested - why for this release]:

Test steps:
1. Play music for some time.
2. Take pictures.
3. BT ON/OFF multiple time.

Resulted in crash with signature:


 [@ js::BaseProxyHandler::get(JSContext*, JS::Handle, JS::Handle, JS::Handle, JS::MutableHandleJS::Value) | js::Proxy::get(JSContext*, JS::Handle, JS::Handle, JS::Handle, JS::MutableHandleJS::Value) | js::proxy_GetElement(JSContext*, JS::Handle, JS::Handle, unsigned int, JS::MutableHandleJS::Value) | JSObject::getElement(JSContext*, JS::Handle, JS::Handle, unsigned int, JS::MutableHandleJS::Value) ]

Comment 1

[cafbot (PoC: ggrisco)]

Attachment: EXTRA file attachment

Comment 2

[cafbot (PoC: ggrisco)]

Attachment: decoded minidump

Comment 3

[bhavana bajaj [:bajaj]]

Starting with a NI on Naveed to get help on investigation given this is a JS signature. Naveed, can someone from your team please help here ?

Comment 4

[cafbot (PoC: ggrisco)]

Observed on: 

Device: msm8226
Gonk Version: AU_LINUX_GECKO_B2G_KK_3.6.01.04.00.000.043
Moz BuildID: 20140721000201
B2G Version: 2.0
Gecko Version: 32.0a2
Gaia:  http://git.mozilla.org/?p=releases/gaia.git;a=commit;h=8cb1a949f2e9650bb2c5598e78a6f24a58bbaf97
Gecko: http://git.mozilla.org/?p=releases/gecko.git;a=commit;h=5f27d3ee3ccf01ac91a3efacb5e3e22ea62fd73c

Comment 5

[bhavana bajaj [:bajaj]]

Blocking as this is deemed a blocker by CAF and is a p1 to get to the MTBF

Comment 6

[Jan de Mooij [:jandem]]

The decoded minidump has "Crash address: 0x0", so it's probably a nullptr dereference in js::BaseProxyHandler::get.

Eric, any idea what's going on?

Comment 7

[cafbot (PoC: ggrisco)]

Observed on: 

Device: msm8610
Gonk Version: AU_LINUX_GECKO_B2G_KK_3.6.01.04.00.000.048
Moz BuildID: 20140728000238
B2G Version: 2.0
Gecko Version: 32.0
Gaia:  http://git.mozilla.org/?p=releases/gaia.git;a=commit;h=0a864988f5dce7f9f3dea9609e8ef054679c30ff
Gecko: http://git.mozilla.org/?p=releases/gecko.git;a=commit;h=745b486db495248e4d4503039e374cb8d5bb244f

Comment 8

[bhavana bajaj [:bajaj]]

marking as DUP per https://bugzilla.mozilla.org/show_bug.cgi?id=1008791#c118