1046465 - Crash in js::BaseProxyHandler::get while stability testing

Status: RESOLVED DUPLICATE of bug 1008791

(Core :: JavaScript Engine, defect)

Description

[Greg Grisco]

[Blocking Requested - why for this release]:

Could be a dup of 1046461, although signature slightly different.  STR not available at this time.

[@ js::BaseProxyHandler::get(JSContext*, JS::Handle, JS::Handle, JS::Handle, JS::MutableHandleJS::Value) | js::Proxy::get(JSContext*, JS::Handle, JS::Handle, JS::Handle, JS::MutableHandleJS::Value) | js::proxy_GetElement(JSContext*, JS::Handle, JS::Handle, unsigned int, JS::MutableHandleJS::Value) | Interpret ]

Comment 1

[cafbot (PoC: ggrisco)]

Attachment: EXTRA file attachment

Comment 2

[cafbot (PoC: ggrisco)]

Attachment: decoded minidump

Comment 3

[Preeti Raghunath(:Preeti)]

Naveed

Can we please get this investigated?

Comment 4

[Nicolas B. Pierron [:nbp]]

Based on Bug 1008791 comment 109, I think these bugs are already being investigated by Eric.

Comment 5

[bhavana bajaj [:bajaj]]

marking as DUP per https://bugzilla.mozilla.org/show_bug.cgi?id=1008791#c118