1448144 - Crash in js::ctypes::ConvertToJS

Status: RESOLVED INVALID

(Core :: JavaScript Engine, defect)

Description

[Andrew McCreight [:mccr8]]

This bug was filed from the Socorro interface and is
report bp-74c551bd-901e-43fb-a278-0bdc80180321.
=============================================================

Top 10 frames of crashing thread:

0 XUL js::ctypes::ConvertToJS js/src/ctypes/CTypes.cpp:3256
1 XUL js::ctypes::PointerType::ContentsGetter js/src/ctypes/CTypes.cpp:5395
2 XUL js::ctypes::Property<& js/public/CallNonGenericMethod.h:100
3 XUL js::InternalCallOrConstruct js/src/vm/JSContext-inl.h:290
4 XUL js::CallGetter js/src/vm/Interpreter.cpp:516
5 XUL js::NativeGetProperty js/src/vm/NativeObject.cpp:2155
6 XUL js::ForwardingProxyHandler::get const js/src/vm/NativeObject.h:1629
7 XUL js::CrossCompartmentWrapper::get const js/src/proxy/CrossCompartmentWrapper.cpp:225
8 XUL js::Proxy::get js/src/proxy/Proxy.cpp:351
9 XUL js::GetProperty js/src/vm/NativeObject.h:1628

=============================================================

17 crashes with this signature have showed up starting with the 20180321102906 Nightly. There are only 3 install times across two builds, but there are both Linux and OSX crashes, so it can't be a single system. They are all null deref crashes.

Although, one of these crashes has the comment "Test Nightly 61 sign off", so maybe somebody is just using a crasher addon to test something... Feel free to close this.

Comment 1

[Andrew McCreight [:mccr8]]

I'll just go ahead and mark this invalid.

Comment 2

[Marcia Knous [:marcia]]

I still see a fair number of these showing up in 63 nightly and some in 62 as well. All of them have test in the comments, but I wonder why there are multiple submissions on the same build.