1373927 - Crash in js::DependentAddPtr<T>::DependentAddPtr<T><T>

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect, P3)

Description

[baffclan]

This bug was filed from the Socorro interface and is 
report bp-a221d9e5-14ab-491e-b180-8b3810170615.
=============================================================

Crashing Thread (0)
Frame 	Module 	Signature 	Source
0 	xul.dll 	js::DependentAddPtr<JS::WeakCache<JS::GCHashSet<js::InitialShapeEntry, js::InitialShapeEntry, js::SystemAllocPolicy> > >::DependentAddPtr<JS::WeakCache<JS::GCHashSet<js::InitialShapeEntry, js::InitialShapeEntry, js::SystemAllocPolicy> > ><js::InitialShapeEntry::Lookup>(JSContext const*, JS::WeakCache<JS::GCHashSet<js::InitialShapeEntry, js::InitialShapeEntry, js::SystemAllocPolicy> > const&, js::InitialShapeEntry::Lookup const&) 	js/src/jshashutil.h:29
1 	xul.dll 	js::EmptyShape::getInitialShape(JSContext*, js::Class const*, js::TaggedProto, unsigned __int64, unsigned int) 	js/src/vm/Shape.cpp:1440
2 	xul.dll 	NewObject 	js/src/jsobj.cpp:670
3 	xul.dll 	js::NewFunctionWithProto(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), unsigned int, JSFunction::Flags, JS::Handle<JSObject*>, JS::Handle<JSAtom*>, JS::Handle<JSObject*>, js::gc::AllocKind, js::NewObjectKind, js::NewFunctionProtoHandling) 	js/src/jsfun.cpp:2033
4 	xul.dll 	js::NewNativeFunction(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), unsigned int, JS::Handle<JSAtom*>, js::gc::AllocKind, js::NewObjectKind) 	js/src/jsfun.cpp:1974
5 	xul.dll 	DefinePropertyById 	js/src/jsapi.cpp:2165
6 	xul.dll 	JS_DefineProperties(JSContext*, JS::Handle<JSObject*>, JSPropertySpec const*) 	js/src/jsapi.cpp:3226
7 	xul.dll 	mozilla::dom::DefinePrefable<JSPropertySpec const >(JSContext*, JS::Handle<JSObject*>, mozilla::dom::Prefable<JSPropertySpec const > const*) 	dom/bindings/BindingUtils.cpp:658
8 	xul.dll 	mozilla::dom::DefineProperties(JSContext*, JS::Handle<JSObject*>, mozilla::dom::NativePropertiesN<7> const*, mozilla::dom::NativePropertiesN<7> const*) 	dom/bindings/BindingUtils.cpp:913
9 	xul.dll 	mozilla::dom::CreateInterfacePrototypeObject 	dom/bindings/BindingUtils.cpp:869
10 	xul.dll 	mozilla::dom::CreateInterfaceObjects(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, js::Class const*, JS::Heap<JSObject*>*, JS::Handle<JSObject*>, js::Class const*, unsigned int, mozilla::dom::NamedConstructor const*, JS::Heap<JSObject*>*, mozilla::dom::NativePropertiesN<7> const*, mozilla::dom::NativePropertiesN<7> const*, char const*, bool, char const* const*, bool) 	dom/bindings/BindingUtils.cpp:988
11 	xul.dll 	mozilla::dom::XULElementBinding::CreateInterfaceObjects(JSContext*, JS::Handle<JSObject*>, mozilla::dom::ProtoAndIfaceCache&, bool) 	obj-firefox/dom/bindings/XULElementBinding.cpp:9103
12 	xul.dll 	mozilla::dom::XULElementBinding::GetProtoObjectHandle(JSContext*) 	obj-firefox/dom/bindings/XULElementBinding.cpp:9131
13 	xul.dll 	mozilla::dom::XULElementBinding::Wrap(JSContext*, nsXULElement*, nsWrapperCache*, JS::Handle<JSObject*>, JS::MutableHandle<JSObject*>) 	obj-firefox/dom/bindings/XULElementBinding.cpp:9010
14 	xul.dll 	nsXULElement::WrapNode(JSContext*, JS::Handle<JSObject*>) 	dom/xul/nsXULElement.cpp:2031
15 	xul.dll 	nsINode::WrapObject(JSContext*, JS::Handle<JSObject*>) 	dom/base/nsINode.cpp:2946
16 	xul.dll 	mozilla::dom::Element::WrapObject(JSContext*, JS::Handle<JSObject*>) 	dom/base/Element.cpp:535
17 	xul.dll 	XPCConvert::NativeInterface2JSObject(JS::MutableHandle<JS::Value>, nsIXPConnectJSObjectHolder**, xpcObjectHelper&, nsID const*, bool, nsresult*) 	js/xpconnect/src/XPCConvert.cpp:792
18 	xul.dll 	nsXPConnect::WrapNativeToJSVal(JSContext*, JSObject*, nsISupports*, nsWrapperCache*, nsID const*, bool, JS::MutableHandle<JS::Value>) 	js/xpconnect/src/nsXPConnect.cpp:686
19 	xul.dll 	nsContentUtils::WrapNative(JSContext*, nsISupports*, nsWrapperCache*, nsID const*, JS::MutableHandle<JS::Value>, bool) 	dom/base/nsContentUtils.cpp:6606
20 	xul.dll 	nsXBLProtoImpl::InitTargetObjects(nsXBLPrototypeBinding*, nsIContent*, JS::MutableHandle<JSObject*>, bool*) 	dom/xbl/nsXBLProtoImpl.cpp:218
21 	xul.dll 	nsXBLProtoImpl::InstallImplementation(nsXBLPrototypeBinding*, nsXBLBinding*) 	dom/xbl/nsXBLProtoImpl.cpp:66
22 	xul.dll 	nsXBLBinding::InstallImplementation() 	dom/xbl/nsXBLBinding.cpp:589
23 	xul.dll 	nsXBLService::LoadBindings(nsIContent*, nsIURI*, nsIPrincipal*, nsXBLBinding**, bool*) 	dom/xbl/nsXBLService.cpp:543
24 	xul.dll 	nsCSSFrameConstructor::AddFrameConstructionItemsInternal(nsFrameConstructorState&, nsIContent*, nsContainerFrame*, nsIAtom*, int, bool, nsStyleContext*, unsigned int, nsTArray<nsIAnonymousContentCreator::ContentInfo>*, nsCSSFrameConstructor::FrameConstructionItemList&) 	layout/base/nsCSSFrameConstructor.cpp:5809
25 	xul.dll 	nsCSSFrameConstructor::AddFCItemsForAnonymousContent(nsFrameConstructorState&, nsContainerFrame*, nsTArray<nsIAnonymousContentCreator::ContentInfo>&, nsCSSFrameConstructor::FrameConstructionItemList&, unsigned int) 	layout/base/nsCSSFrameConstructor.cpp:11082
26 	xul.dll 	nsCSSFrameConstructor::BeginBuildingScrollFrame(nsFrameConstructorState&, nsIContent*, nsStyleContext*, nsContainerFrame*, nsIAtom*, bool, nsContainerFrame*&) 	layout/base/nsCSSFrameConstructor.cpp:4644
27 	xul.dll 	nsCSSFrameConstructor::SetUpDocElementContainingBlock(nsIContent*) 	layout/base/nsCSSFrameConstructor.cpp:2946
28 	xul.dll 	nsCSSFrameConstructor::ConstructDocElementFrame(mozilla::dom::Element*, nsILayoutHistoryState*) 	layout/base/nsCSSFrameConstructor.cpp:2461
29 	xul.dll 	nsCSSFrameConstructor::ContentRangeInserted(nsIContent*, nsIContent*, nsIContent*, nsILayoutHistoryState*, bool, bool, TreeMatchContext*) 	layout/base/nsCSSFrameConstructor.cpp:7988
30 	xul.dll 	nsCSSFrameConstructor::ContentInserted(nsIContent*, nsIContent*, nsILayoutHistoryState*, bool) 	layout/base/nsCSSFrameConstructor.cpp:7869
31 	xul.dll 	mozilla::PresShell::Initialize(int, int) 	layout/base/PresShell.cpp:1794
32 	xul.dll 	nsContentSink::StartLayout(bool) 	dom/base/nsContentSink.cpp:1239
33 	xul.dll 	nsHtml5TreeOpExecutor::StartLayout(bool*) 	parser/html/nsHtml5TreeOpExecutor.cpp:625
34 	xul.dll 	nsHtml5TreeOperation::Perform(nsHtml5TreeOpExecutor*, nsIContent**, bool*) 	parser/html/nsHtml5TreeOperation.cpp:998
35 	xul.dll 	nsHtml5TreeOpExecutor::RunFlushLoop() 	parser/html/nsHtml5TreeOpExecutor.cpp:458
36 	xul.dll 	nsHtml5ExecutorFlusher::Run() 	parser/html/nsHtml5StreamParser.cpp:129
37 	xul.dll 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp:1406
38 	xul.dll 	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp:96
39 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc:231
40 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc:211
41 	xul.dll 	nsBaseAppShell::Run() 	widget/nsBaseAppShell.cpp:156
42 	xul.dll 	nsAppShell::Run() 	widget/windows/nsAppShell.cpp:271
43 	xul.dll 	nsAppStartup::Run() 	toolkit/components/startup/nsAppStartup.cpp:283
44 	xul.dll 	XREMain::XRE_mainRun() 	toolkit/xre/nsAppRunner.cpp:4569
45 	xul.dll 	XREMain::XRE_main(int, char** const, mozilla::BootstrapConfig const&) 	toolkit/xre/nsAppRunner.cpp:4749
46 	xul.dll 	XRE_main(int, char** const, mozilla::BootstrapConfig const&) 	toolkit/xre/nsAppRunner.cpp:4844
47 	firefox.exe 	NS_internal_main(int, char**, char**) 	browser/app/nsBrowserApp.cpp:310
48 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:115
49 	firefox.exe 	__scrt_common_main_seh 	f:/dd/vctools/crt/vcstartup/src/startup/exe_common.inl:253
50 	kernel32.dll 	BaseThreadInitThunk 	
51 	ntdll.dll 	RtlUserThreadStart 	



Application Basics: 
Name: Firefox
Version: 55.0b2
Build ID: 20170615063713
Update Channel: beta
User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55.0
OS: Windows_NT 10.0

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.