1378365 - Crash in js::jit::GetNativeDataPropertyByValue<T>

Status: RESOLVED DUPLICATE of bug 1502853

(Core :: JavaScript Engine: JIT, defect, P5)

Description

[[:philipp]]

This bug was filed from the Socorro interface and is 
report bp-6853e173-520b-42c5-8ff6-655920170705.
=============================================================
Crashing Thread (0)
Frame 	Module 	Signature 	Source
0 	xul.dll 	js::jit::GetNativeDataPropertyByValue<1>(JSContext*, JSObject*, JS::Value*) 	js/src/jit/VMFunctions.cpp:1668
1 	xul.dll 	NewObject 	js/src/jsobj.cpp:679
2 	xul.dll 	EnterIon 	js/src/jit/Ion.cpp:2804
3 	xul.dll 	js::TraceNullableRoot<js::Shape*>(JSTracer*, js::Shape**, char const*) 	js/src/gc/Marking.cpp:526
4 	xul.dll 	js::TypeScript::SetArgument(JSContext*, JSScript*, unsigned int, js::TypeSet::Type) 	js/src/vm/TypeInference-inl.h:669
5 	xul.dll 	js::jit::IonCannon(JSContext*, js::RunState&) 	js/src/jit/Ion.cpp:2902
6 		@0xffffff81

crash reports with this signature are showing up cross-platform since version 55, the first one in 55.0a1 build 20170327030203. maybe that's related to bug 1328140?

Comment 1

[Mike Taylor [:miketaylr]]

(gonna fix-optional for 55 due to low volume)

Comment 2

[Liz Henry (:lizzard) (relman/hg->git project)]

Too late for a fix for 56, crash is still fairly low volume.

Comment 3

[Jan de Mooij [:jandem]]

Low volume, mostly Android, I don't see anything actionable. Probably not worth spending a lot of time on this right now.

Comment 4

[Firefox Bug Husbandry Bot]

https://wiki.mozilla.org/Bug_Triage/Projects/Bug_Handling/Bug_Husbandry#Move_fix-optionals

Comment 5

[Ted Campbell [:tcampbell]]

This is now tracked under a different signature.