Closed Bug 594501 Opened 15 years ago Closed 12 years ago

Crash in [@ js::Shape::removeFromDictionary(JSObject*) ]

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
Windows XP
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: marcia, Unassigned)

Details

(Keywords: crash)

Crash Data

Seen while reviewing trunk crash stats. http://tinyurl.com/2gxopay to the crashes, which are all Windows. No comments, but a number of the crash reports happened on Yahoo Mail. Currently the #37 top crash on the trunk. Crash-Stats table indicates the crashes started showing up in the 2010090200 build. Frame Module Signature [Expand] Source 0 xul.dll js::Shape::removeFromDictionary js/src/jsscope.h:689 1 xul.dll JSObject::changeProperty js/src/jsscope.cpp:863 2 xul.dll js_DefineNativeProperty js/src/jsobj.cpp:4166 3 xul.dll js_DefineProperty js/src/jsobj.cpp:4095 4 xul.dll js_obj_defineGetter js/src/jsobj.cpp:1565 5 xul.dll DefineGetterOrSetter js/src/xpconnect/src/xpcquickstubs.cpp:367 6 xul.dll SharedDefineGetter js/src/xpconnect/src/xpcquickstubs.cpp:380 7 xul.dll js::mjit::stubs::SlowCall js/src/methodjit/InvokeHelpers.cpp:407
A number of the users seem to have no extensions installed.
Crash Signature: [@ js::Shape::removeFromDictionary(JSObject*) ]
on crashes newer than version 14.0.1 in the past 3 months
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.