Closed Bug 1700536 Opened 4 years ago Closed 4 years ago

Crash in [@ JS_AssignObject]

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Version:
Firefox 89
Platform:
x86_64
Linux
Type:
defect

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1700525
Tracking Flags:
Tracking Status
firefox89 --- affected

People

(Reporter: u673061, Unassigned)

Details

Crash Data

Crash report: https://crash-stats.mozilla.org/report/index/913d0c83-d40d-4ec8-ae4a-5e40d0210324

Reason: SIGSEGV /SEGV_MAPERR

Top 10 frames of crashing thread:

0 libxul.so JS_AssignObject js/src/builtin/Object.cpp:1079
1 libxul.so obj_assign js/src/builtin/Object.cpp:1125
2 libxul.so js::InternalCallOrConstruct js/src/vm/Interpreter.cpp:520
3 libxul.so Interpret js/src/vm/Interpreter.cpp:3244
4 libxul.so js::InternalCallOrConstruct js/src/vm/Interpreter.cpp:552
5 libxul.so js::jit::DoCallFallback js/src/jit/BaselineIC.cpp:1841
6  @0x5f42fbccd27 
7  @0x7f0940e884df 
8  @0x5f42fbca56e 
9 libxul.so js::jit::MaybeEnterJit js/src/jit/Jit.cpp:206

Reproduces prevalently on https://quad9.net , regardless of whether Fission is enabled or disabled.

OS: Unspecified → Linux
Hardware: Unspecified → x86_64

Sorry, I noticed a duplicate.

Status: UNCONFIRMED → RESOLVED
Closed: 4 years ago
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.