682621 - Startup crash in JS interpreter [@ js::Bindings::getLocalNameArray ]

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Benoit Jacob [:bjacob] (mostly away)]

This is the 2nd topcrash on Firefox 7.0b1 on Linux with 18 crashes last week.

https://crash-stats.mozilla.com/report/list?product=Firefox&version=Firefox%3A7.0b1&platform=linux&query_search=signature&query_type=contains&reason_type=contains&date=08%2F27%2F2011%2014%3A51%3A23&range_value=1&range_unit=weeks&hang_type=any&process_type=any&do_query=1&signature=js%3A%3ABindings%3A%3AgetLocalNameArray

Here's one crash report:

https://crash-stats.mozilla.com/report/index/715de085-306a-40c7-9c02-db1152110826

We're always crashing by dereferencing 0x46 which is probably a null pointer deref.

http://hg.mozilla.org/releases/mozilla-beta/annotate/00f56713eab6/js/src/jsinterp.cpp#l4598

This code was last touched by

http://hg.mozilla.org/releases/mozilla-beta/rev/b79cf02287c6

-> bug 646574

Comment 1

[Robert Kaiser]

Looking at https://crash-stats.mozilla.com/report/list?signature=js::Bindings::getLocalNameArray most of those are duplicate reports, looks like 3 unique ones on Linux, and this is at startup. Still extremely low volume.

Comment 2

[Wayne Mery (:wsmwk)]

nothing here for the last 2.5 months for any current version
https://crash-stats.mozilla.com/search/?signature=~js%3A%3ABindings%3A%3AgetLocalNameArray&date=%3E2016-04-01&_facets=signature&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#crash-reports