566429 - Crash in [@ JSObject::getSlot(unsigned int) ]

Status: RESOLVED DUPLICATE of bug 564344

(Core :: JavaScript Engine, defect)

Description

[Marcia Knous [:marcia]]

Seen while reviewing crash stats. #2 top crash on the trunk, 2035 crashes in two weeks time. http://tinyurl.com/26kdekt is a link to the crash reports. Crashes are characterized by a high amount up uptime. Some comments:

*I tried to right click and open a new tab for a link on your Firefox Addons site
*Intermittantly flash enabled webpages will cause windows to partially freeze up to the extent one cannot run new programs. Though closing the suspect tab restores windows to it's normal state but causes Minefield to crash.
*Playing Treasure Island Facebook app

Have not yet been able to reproduce but i will try a few scenarios of loading some of the URLs and leaving the browser open overnight.

Frame  	Module  	Signature [Expand]  	Source
0 	mozjs.dll 	JSObject::getSlot 	js/src/jsobj.h:310
1 	mozjs.dll 	JSScope::methodWriteBarrier 	js/src/jsscopeinlines.h:152
2 	mozjs.dll 	js_DefineNativeProperty 	
3 	mozjs.dll 	js_DefineProperty 	js/src/jsobj.cpp:4096
4 	mozjs.dll 	JS_DefinePropertyById 	js/src/jsapi.cpp:2958
5 	xul.dll 	DefinePropertyIfFound 	js/src/xpconnect/src/xpcwrappednativejsops.cpp:534
6 	xul.dll 	XPC_WN_NoHelper_Resolve 	js/src/xpconnect/src/xpcwrappednativejsops.cpp:805
7 	mozjs.dll 	js_LookupPropertyWithFlags 	js/src/jsobj.cpp:4406
8 	mozjs.dll 	mozjs.dll@0x6731f 	
9 	xul.dll 	xul.dll@0x90d0f 	
10 	mozjs.dll 	js_GetPropertyHelper 	js/src/jsobj.cpp:4765

Comment 1

[Marcia Knous [:marcia]]

Forget to mention this is a Windows only crash and has been trending down since 5/12, but there are still reports with today's trunk build.

Comment 2

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Just hit this with 20100517 after a very long uptime.  No correlation with an action; I was waiting for a page to load when things went down.  Is there any data that would be useful to get if I can capture this in the debugger?