1151013 - Consistent startup crash (win64 nightly) at js::gc::StoreBuffer::isOkayToUseBuffer

Status: VERIFIED DUPLICATE of bug 1150906

(Core :: JavaScript Engine, defect)

Description

[Benjamin Smedberg]

I have a consistent crash on startup with yesterday's win64 nightly. This only happens with my main profile: another test profile starts properly.

>	xul.dll!js::gc::StoreBuffer::isOkayToUseBuffer() Line 339	C++
 	xul.dll!js::GetterSetterWriteBarrierPost(js::AccessorShape * shape, JSObject * * objp) Line 345	C++
 	xul.dll!js::NativeObject::putProperty(js::ExclusiveContext * cx, JS::Handle<js::NativeObject *> obj, JS::Handle<jsid> id, bool (JSContext *, JS::Handle<JSObject *>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>) * getter, bool (JSContext *, JS::Handle<JSObject *>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>, JS::ObjectOpResult &) * setter, unsigned int slot, unsigned int attrs, unsigned int flags) Line 824	C++
 	xul.dll!AddOrChangeProperty(js::ExclusiveContext * cx, JS::Handle<js::NativeObject *> obj, JS::Handle<jsid> id, JS::Handle<JSPropertyDescriptor> desc) Line 1254	C++
 	xul.dll!js::NativeDefineProperty(js::ExclusiveContext * cx, JS::Handle<js::NativeObject *> obj, JS::Handle<jsid> id, JS::Handle<JSPropertyDescriptor> desc_, JS::ObjectOpResult & result) Line 1471	C++
 	xul.dll!DefinePropertyOnObject(JSContext * cx, JS::Handle<js::NativeObject *> obj, JS::Handle<jsid> id, JS::Handle<JSPropertyDescriptor> desc, JS::ObjectOpResult & result) Line 557	C++
 	xul.dll!js::StandardDefineProperty(JSContext * cx, JS::Handle<JSObject *> obj, JS::Handle<jsid> id, JS::Handle<JSPropertyDescriptor> desc, JS::ObjectOpResult & result) Line 662	C++
 	xul.dll!js::CrossCompartmentWrapper::defineProperty(JSContext * cx, JS::Handle<JSObject *> wrapper, JS::Handle<jsid> id, JS::Handle<JSPropertyDescriptor> desc, JS::ObjectOpResult & result) Line 59	C++
 	xul.dll!js::Proxy::defineProperty(JSContext * cx, JS::Handle<JSObject *> proxy, JS::Handle<jsid> id, JS::Handle<JSPropertyDescriptor> desc, JS::ObjectOpResult & result) Line 147	C++
 	xul.dll!js::StandardDefineProperty(JSContext * cx, JS::Handle<JSObject *> obj, JS::Handle<jsid> id, JS::Handle<JSPropertyDescriptor> desc) Line 670	C++
 	xul.dll!js::obj_defineProperty(JSContext * cx, unsigned int argc, JS::Value * vp) Line 825	C++

I am using tree-style-tab in this profile and so bug 1150906 may be related. What can I do to help with debugging?

Comment 1

[Benjamin Smedberg]

Confirming that disabling tree-style-tab appears to have fixed this.