599601 - crash in js::PropertyTree::getChild

Status: RESOLVED INVALID

(Core :: JavaScript Engine, defect)

Description

[Scoobidiver (away)]

Build : Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0b7pre) Gecko/20100924
Firefox/4.0b7pre

This is a new crash signature that was introduced in b7pre/20100911 build.
The crash daily rate is 1-2 crashes/day and 8 in today's build.
It happens mainly on Windows XP.
It is #15 top crasher for b7pre/20100924 build.

There is a lot of kinds of crashing thread.

Signature	js::PropertyTree::getChild(JSContext*, js::Shape*, js::Shape const&)
UUID	a4029bf0-b2d5-4983-a843-31dd02100925
Time 	2010-09-25 00:50:06.268433
Uptime	24645
Install Age	24645 seconds (6.8 hours) since version was first installed.
Product	Firefox
Version	4.0b7pre
Build ID	20100924040732
Branch	2.0
OS	Windows NT
OS Version	5.1.2600 Service Pack 2
CPU	x86
CPU Info	AuthenticAMD family 15 model 107 stepping 2
Crash Reason	EXCEPTION_ACCESS_VIOLATION_WRITE
Crash Address	0xfde1f5c
App Notes 	AdapterVendorID: 10de, AdapterDeviceID: 0422

Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	js::PropertyTree::getChild 	js/src/jspropertytree.cpp:425
1 	xul.dll 	JSObject::putProperty 	js/src/jsscope.cpp:835
2 	xul.dll 	js_DefineNativeProperty 	js/src/jsobj.cpp:4412
3 	xul.dll 	xpc_qsDefineQuickStubs 	js/src/xpconnect/src/xpcquickstubs.cpp:449
4 	xul.dll 	nsXPConnect::DefineDOMQuickStubs 	js/src/xpconnect/src/nsXPConnect.cpp:2369
5 	xul.dll 	nsDOMClassInfo::PostCreatePrototype 	dom/base/nsDOMClassInfo.cpp:4680
6 	xul.dll 	XPCWrappedNativeProto::Init 	js/src/xpconnect/src/xpcwrappednativeproto.cpp:143
7 	xul.dll 	XPCWrappedNativeProto::GetNewOrUsed 	js/src/xpconnect/src/xpcwrappednativeproto.cpp:264
8 	xul.dll 	XPCWrappedNative::GetNewOrUsed 	js/src/xpconnect/src/xpcwrappednative.cpp:540
9 	xul.dll 	XPCConvert::NativeInterface2JSObject 	js/src/xpconnect/src/xpcconvert.cpp:1238
10 	xul.dll 	NativeInterface2JSObject 	js/src/xpconnect/src/nsXPConnect.cpp:1182
11 	xul.dll 	nsContentUtils::WrapNative 	content/base/src/nsContentUtils.cpp:5541
12 	xul.dll 	nsJSContext::ConvertSupportsTojsvals 	dom/base/nsJSEnvironment.cpp:2752
13 	xul.dll 	nsJSContext::CallEventHandler 	dom/base/nsJSEnvironment.cpp:2125
14 	xul.dll 	nsJSEventListener::HandleEvent 	dom/src/events/nsJSEventListener.cpp:228
15 	xul.dll 	nsEventListenerManager::HandleEventSubType 	content/events/src/nsEventListenerManager.cpp:1112
16 	xul.dll 	nsEventListenerManager::HandleEventInternal 	content/events/src/nsEventListenerManager.cpp:1208
17 	xul.dll 	nsEventTargetChainItem::HandleEventTargetChain 	content/events/src/nsEventDispatcher.cpp:341
18 	mozcrt19.dll 	arena_dalloc_small 	obj-firefox/memory/jemalloc/crtsrc/jemalloc.c:4204
19 		@0x60b7ff 	

More reports at :
http://crash-stats.mozilla.com/report/list?product=Firefox&query_search=signature&query_type=exact&range_value=4&range_unit=weeks&hang_type=any&process_type=any&plugin_field=&plugin_query_type=&plugin_query=&do_query=1&admin=&signature=js%3A%3APropertyTree%3A%3AgetChild%28JSContext*%2C%20js%3A%3AShape*%2C%20js%3A%3AShape%20const%26%29

Comment 1

[Sheila Mooney]

This still appears in recent builds. In the past week..

+ 22 crashes on 7.0.1
+ 8 crashes on 8.0
+ 1 on 11.0a1

Comment 2

[Scoobidiver (away)]

It still happens with various stack traces at a very low volume:
* 41 crashes in 22.0
* 8 in 23.0b9

More reports at:
https://crash-stats.mozilla.com/report/list?product=Firefox&signature=js%3A%3APropertyTree%3A%3AgetChild%28JSContext*%2C+js%3A%3AShape*%2C+unsigned+int%2C+js%3A%3AStackShape+const%26%29

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Since the crash volume is low (less than 5 per week), the severity is downgraded to S3. Feel free to change it back if you think the bug is still critical.

For more information, please visit auto_nag documentation.

Comment 4

[Jan de Mooij [:jandem]]

This code no longer exists. Remaining crashes must be for older release branches.