1689497 - Release assert crash in [@ JSScript::innermostScope]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Andrew McCreight [:mccr8]]

Maybe Fission related. (DOMFissionEnabled=1)

Crash report: https://crash-stats.mozilla.org/report/index/cbf1e24b-7607-4a02-bfcb-ce5df0210128

MOZ_CRASH Reason: MOZ_RELEASE_ASSERT(idx < storage_.size())

Top 10 frames of crashing thread:

0 XUL JSScript::innermostScope const js/src/vm/JSScript.cpp:4829
1 XUL js::EnvironmentIter::EnvironmentIter js/src/vm/EnvironmentObject.cpp:1284
2 XUL js::InterpreterFrame::epilogue js/src/vm/Stack.cpp:220
3 XUL Interpret js/src/vm/Interpreter.cpp:4561
4 XUL js::InternalCallOrConstruct js/src/vm/Interpreter.cpp:619
5 XUL JS_CallFunctionValue js/src/jsapi.cpp:2798
6 XUL nsXPCWrappedJS::CallMethod js/xpconnect/src/XPCWrappedJSClass.cpp:970
7 XUL PrepareAndDispatch xpcom/reflect/xptcall/md/unix/xptcstubs_x86_64_darwin.cpp:117
8 XUL SharedStub 
9 XUL mozilla::dom:: dom/base/Document.cpp:16034

The crash volume is low, but there's a release assert so I'd figured I'd file it. Only about a third of the crashes with this signature have the assert.

Comment 1

[Ted Campbell [:tcampbell]]

The new crashes look related to the crash in Bug 1689505.

Comment 2

[Julien Cristau [:jcristau] (back April 22)]

Fixed by backout:
https://hg.mozilla.org/mozilla-central/rev/751ecfca72b1fd7e210cfa845e008e6e5d9ca107