1202584 - SIGSEGV in JS_ResolveStandardClass(JSContext*, JS::Handle<T>, JS::Handle<T>, bool*)

Status: RESOLVED WONTFIX

(Core :: JavaScript Engine, defect)

Description

[Frederik Braun [:freddy]]

Aurora perma-crashes for me, even without add-ons.

Happy to provide any extra info if required.
See also the crash report at https://crash-stats.mozilla.com/report/index/aa4b4349-b476-430f-b644-a3d272150908

Comment 1

[Boris Zbarsky [:bzbarsky]]

Does this happen with a clean profile?

The crash seems to be happening on this line, according to breakpad:

    for (unsigned i = 0; !table[i].isSentinel(); i++) {

in LookupStdName.  But "table" is passed in the caller like so:

    stdnm = LookupStdName(cx->names(), idAtom, standard_class_names);

and standard_class_names is just a static const array, so there should be no issues with accessing it...

Comment 2

[Frederik Braun [:freddy]]

No, I can't repro in a clean profile.

Comment 3

[Boris Zbarsky [:bzbarsky]]

OK, what if you copy the prefs.js from the crashing profile to the other one?

Comment 4

[Frederik Braun [:freddy]]

The crash stopped reproducing in Aurora for me after running the profile with firefox-release and then with aurora again.

Now copying the prefs.js to a new profile doesn't cause any crashes - obviously. So I can't meaningfully continue testing.


Will remember to make copy of the crashy profile next time.

Comment 5

[Boris Zbarsky [:bzbarsky]]

OK.  It's possible that something in the xul cache was corrupted so clearing it made things better.  :(  Please reopen if this happens again.

Comment 6

[Frederik Braun [:freddy]]

I hope this will be of any help, but it just crashed again, while I was busy doing other things, so I can not completely re-call what I did.

But I allowed the crash reporter to submit the crash (https://crash-stats.mozilla.com/report/index/6c7058b1-e935-4d58-8b92-7ecb52150914) and quit Aurora.

I then wanted to create a new profile and run Aurora with it, so I can copy over the prefs.js from the faulty profile. After going through the profile-creation dialog, the new profile crashed *without* me copying over any kind of file, which I reported again (https://crash-stats.mozilla.com/report/index/eac4b865-5901-404f-8e84-801152150914).

I then copied over the prefs.js from my default-profile to the newly created and started aurora a 3rd time. It did not crash again, so I closed the window and went on with my default profile.

Comment 7

[Sylvestre Ledru [:Sylvestre]]

Closing because no crash reported since 12 weeks.

Comment 8

[Sylvestre Ledru [:Sylvestre]]

Closing because no crash reported since 12 weeks.