1167244 - crash in js::UnboxedLayout::makeNativeGroup(JSContext*, js::ObjectGroup*)

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[James Willcox (:snorp) ([e-mail]) (he/him)]

This bug was filed from the Socorro interface and is 
report bp-f02a1255-4c46-4809-b823-7f3562150521.
=============================================================

Got this crash today under Nightly e10s. Not sure which tab caused the issue, but I opened Google Maps most recently.

Comment 1

[Benjamin Bouvier [:bbouvier] (inactive)]

Brian, this one might be different from bug 1166700?

Comment 2

[Andrew McCreight [:mccr8]]

Based on the fact that the STR involves Google Maps, this might be a dupe of bug 1166542.

Comment 3

[James Willcox (:snorp) ([e-mail]) (he/him)]

I got this again just now without having Google Maps open.

Comment 4

[Brian Hackett [Laid off!]]

Do you have any STR?  This looks like a NULL deref that should be easy to fix but it would be nice to know why the pointer involved is NULL (since it shouldn't be).

Comment 5

[James Willcox (:snorp) ([e-mail]) (he/him)]

I don't, sorry. I'll try to come up with some if it happens again (so far no more instances).

Comment 6

[Johannes Pfrang [:johnp]]

Crashed an e10s tab with today's Nightly with a similar stack trace:

00c66232-f4dc-4a4c-8275-af6d02150527

Comment 7

[Patrick McManus [:mcmanus]]

https://crash-stats.mozilla.com/report/index/70e9f401-753b-4d49-a0bf-8fddc2150603

crashed an e10s nightly tab with this. I think it was the slate.com homepage. It doesn't reproduce.

Comment 8

[(not currently active) Ted Mielczarek]

My Nightly is about a week out of date, but I just crashed on Amazon doing something in the shopping cart view:
https://crash-stats.mozilla.com/report/index/fdc1a179-ba77-41b4-ae48-dd0902150610

Comment 9

[Sean Stangl [:sstangl]]

Attachment: 0001-Bug-1167244-Handle-nullptr-return-from-maybeGetPrope.patch

Saw this bug as the top JS crasher. maybeGetProperty() is missing a nullptr check.

There are a few other uses of maybeGetProperty() in the codebase that also don't have a check, but most of them look safe. Probably a 5-minute auditing job for bhackett just to make sure :)

Comment 10

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/30e375742c0a

Comment 11

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/30e375742c0a