1265024 - Crash in js::gc::Cell::getTraceKind

Status: RESOLVED DUPLICATE of bug 1280591

(Core :: JavaScript: GC, defect)

Description

[Nick Fitzgerald [:fitzgen] [⏰PST; UTC-8]]

I've got this twice in the last week on my dev edition install that I use as my main browser.

https://crash-stats.mozilla.com/report/index/dd43953c-2a66-4e01-b7a3-b31952160415
https://crash-stats.mozilla.com/report/index/aa7ba6dc-36d2-4c76-bb4f-378962160414

For some reason the top frame is listed as `js::` but if you click through it is `js::gc::Cell::getTraceKind`.

Here are all the other `js::` crashes, 261 in the last week all on OSX: https://crash-stats.mozilla.com/report/list?product=Firefox&signature=js%3A%3A

Here are all the other `js::gc::Cell::getTraceKind` crashes, 188 in the last week all on windows: https://crash-stats.mozilla.com/signature/?signature=js%3A%3Agc%3A%3ACell%3A%3AgetTraceKind&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=platform&_columns=reason&_columns=address&page=1#summary

Not sure if these are the same or not. Saw that there wasn't a bug on file yet, so here we go.

Comment 1

[Wayne Mery (:wsmwk)]

The signatures for https://crash-stats.mozilla.com/signature/?signature=js%3A%3Agc%3A%3ACell%3A%3AgetTraceKind&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=platform&_columns=reason&_columns=address&page=1#reports don't match up with your stacks

dup of bug 1280591?