1453572 - Crash in nsDocShell::AddState

Status: VERIFIED DUPLICATE of bug 1453567

(Core :: DOM: Navigation, defect)

Description

[Calixte Denizet (:calixte)]

This bug was filed from the Socorro interface and is
report bp-648737cb-c1a7-4510-9f28-645f10180412.
=============================================================

Top 10 frames of crashing thread:

0 xul.dll nsDocShell::AddState docshell/base/nsDocShell.cpp:11864
1 xul.dll nsHistory::PushOrReplaceState dom/base/nsHistory.cpp:292
2 xul.dll static bool mozilla::dom::HistoryBinding::replaceState dom/bindings/HistoryBinding.cpp:384
3 xul.dll mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions> dom/bindings/BindingUtils.cpp:3195
4 xul.dll js::InternalCallOrConstruct js/src/vm/Interpreter.cpp:467
5 xul.dll static bool js::jit::DoCallFallback js/src/jit/BaselineIC.cpp:2380
6  @0x159dbe8740e 
7 xul.dll xpc::NonVoidStringToJsval js/xpconnect/src/XPCString.cpp:90
8  @0xfffb01f8e98e67bf 
9 xul.dll static js::jit::EnterJitStatus EnterJit js/src/jit/Jit.cpp:99

=============================================================

There are 39 crashes (from 33 installations) in nightly 61 with buildid 20180412001050. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1434768.

[1] https://hg.mozilla.org/mozilla-central/rev?node=c1dc65552300

Comment 1

[Calixte Denizet (:calixte)]

The signature 'nsDocShell::AddState' is ranked #2 in nightly top-crashers.

Comment 2

[Nika Layzell [:nika] (ni? for response)]

I think this is a dup of bug 1453567.

Comment 3

[Ryan VanderMeulen [:RyanVM]]

Crash is verified gone in builds with the fix from bug 1453567.