1718928 - Crash at @js::InternalCallOrConstruct

Status: RESOLVED DUPLICATE of bug 1718842

(Core :: JavaScript Engine, defect)

Description

[Shawn Huang [:shawnjohnjr][:shuang] (as a happy gecko contributor)]

I can easily reproduce the content crash via visiting "https://shop.maoup.com.tw/collections/%E7%8B%97%E7%8B%97%E6%B4%97%E6%AF%9B%E7%B2%BE".

Build ID 20210701211644 (2021-07-01)
OS macOS 11
OS Version 11.3.1 20E241
Build Architecture amd64

https://crash-stats.mozilla.org/report/index/8a19b2c6-8523-4e43-8dd8-cd5550210702#tab-details

Frame Module Signature Source Trust
0 XUL js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) js/src/vm/Interpreter.cpp:511 context
1 XUL js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICFallbackStub*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) js/src/jit/BaselineIC.cpp:1595 cfi
2 @0x3a81a270fd87 cfi
3 @0x141449bff frame_pointer
4 @0x3a81a272d3f2 frame_pointer
5 @0x13dca109f frame_pointer
6 @0x3a81a272d3f2 frame_pointer
7 @0x13dc9106f frame_pointer
8 @0x3a81a270d56e frame_pointer
9 XUL js::jit::MaybeEnterJit(JSContext*, js::RunState&) js/src/jit/Jit.cpp:207 frame_pointer
10 XUL Interpret(JSContext*, js::RunState&) js/src/vm/Interpreter.cpp:3265 cfi
11 XUL js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) js/src/vm/Interpreter.cpp:543 cfi
12 XUL js::jit::InvokeFromInterpreterStub(JSContext*, js::jit::InterpreterStubExitFrameLayout*) js/src/jit/VMFunctions.cpp:784 cfi
13 @0x3a81a270ddf3 cfi
14 @0x13e1ce13f frame_pointer
15 @0x3a81a270d56e frame_pointer
16 XUL js::jit::MaybeEnterJit(JSContext*, js::RunState&) js/src/jit/Jit.cpp:207 frame_pointer
17 XUL Interpret(JSContext*, js::RunState&) js/src/vm/Interpreter.cpp:3265 cfi
18 XUL js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) js/src/vm/Interpreter.cpp:543 cfi
19 XUL js::jit::InvokeFromInterpreterStub(JSContext*, js::jit::InterpreterStubExitFrameLayout*) js/src/jit/VMFunctions.cpp:784 cfi
20 @0x3a81a270ddf3 cfi
21 @0x13c0cc2e7 frame_pointer
22 @0x3a81a270d56e frame_pointer
23 XUL js::jit::MaybeEnterJit(JSContext*, js::RunState&) js/src/jit/Jit.cpp:207 frame_pointer
24 XUL Interpret(JSContext*, js::RunState&) js/src/vm/Interpreter.cpp:3265 cfi
25 XUL js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) js/src/vm/Interpreter.cpp:543 cfi
26 XUL js::jit::InvokeFromInterpreterStub(JSContext*, js::jit::InterpreterStubExitFrameLayout*) js/src/jit/VMFunctions.cpp:784 cfi

Comment 1

[André Bargull [:anba]]

Same issue as bug 1718842.