435502 - something fishy in xpc_CloneJSFunction

Status: RESOLVED DUPLICATE of bug 434673

(Core :: XPConnect, defect)

Description

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

There are a bunch of crash reports in Socorro with xpc_CloneJSFunction as the second item in the stack, at http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/js/src/xpconnect/src/xpcwrappednativeinfo.cpp&rev=1.19&mark=76#76 .. the topmost is often JS_GetReservedSlot, but there are also a pile with bogus values at the top such as http://crash-stats.mozilla.com/report/index/f4120691-285e-11dd-9772-0013211cbf8a .  My guess is that 'scope' that's dereferenced just before line 76 is bogus, and that's where the actual problem is.

I can't get Socorro to successfully complete a query for xpc_CloneJSFunction using the nightly version as opposed to RC1, so I can't see if there's an obvious point where this started.  Filing this to track.

I've hit this very frequently myself, but using the Rhapsody plugin; my crashes look like http://crash-stats.mozilla.com/report/index/4353796e-2864-11dd-b3e3-001321b13766 (consistent from _geturl on down).

Comment 1

[Ben Turner (not reading bugmail, use the needinfo flag!)]

Could be bug 434673.