714625 - crash in js::types::TypeCompartment::markSetsUnknown

Status: RESOLVED WONTFIX

(Core :: JavaScript Engine, defect)

Description

[Carsten Book [:Tomcat]]

noticed on Crash-stats -> Firefox 12.0a1 Crash Report [@ js::types::TypeCompartment::markSetsUnknown(JSContext*, js::types::TypeObject*) ]

Windows crashes only so far. example report https://crash-stats.mozilla.com/report/index/7e09b3ac-7826-46e6-a3d0-845aa2120101

Crashing Thread
Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	js::types::TypeCompartment::markSetsUnknown 	js/src/jsinfer.cpp:2317
1 	xul.dll 	js::PropertyTree::getChild 	js/src/jspropertytree.cpp:210
2 	xul.dll 	js::Shape::replaceLastProperty 	js/src/jsscope.cpp:376

Comment 1

[Scoobidiver (away)]

It spiked in 22.0b1, #26 crasher.

The stack trace is:
Frame 	Module 	Signature 	Source
0 	mozjs.dll 	js::types::TypeCompartment::markSetsUnknown 	js/src/jsinfer.cpp:3025
1 	mozjs.dll 	js::SetClassAndProto 	js/src/jsobj.cpp:2862
2 	mozjs.dll 	JS_SetPrototype 	js/src/jsapi.cpp:3279
3 	xul.dll 	nsXBLBinding::DoInitJSClass 	content/xbl/src/nsXBLBinding.cpp:1226
4 	xul.dll 	nsXBLProtoImpl::InitTargetObjects 	content/xbl/src/nsXBLProtoImpl.cpp:189
5 	xul.dll 	nsXBLProtoImpl::InstallImplementation 	content/xbl/src/nsXBLProtoImpl.cpp:75
6 	xul.dll 	nsXBLService::LoadBindings 	content/xbl/src/nsXBLService.cpp:517
7 	xul.dll 	nsCSSFrameConstructor::AddFrameConstructionItemsInternal 	layout/base/nsCSSFrameConstructor.cpp:5097
8 	xul.dll 	nsCSSFrameConstructor::AddFrameConstructionItems 	layout/base/nsCSSFrameConstructor.cpp:5041
9 	xul.dll 	nsCSSFrameConstructor::FrameConstructionItemList::~FrameConstructionItemList 	layout/base/nsCSSFrameConstructor.h:803
10 	xul.dll 	nsCSSFrameConstructor::CreateAnonymousFrames 	layout/base/nsCSSFrameConstructor.cpp:3756
11 	xul.dll 	nsCSSFrameConstructor::BeginBuildingScrollFrame 	layout/base/nsCSSFrameConstructor.cpp:4131
12 	xul.dll 	nsCSSFrameConstructor::SetUpDocElementContainingBlock 	layout/base/nsCSSFrameConstructor.cpp:2724
13 	xul.dll 	nsCSSFrameConstructor::ConstructDocElementFrame 	layout/base/nsCSSFrameConstructor.cpp:2489
14 	xul.dll 	nsRuleNode::SetDefaultOnRoot 	layout/style/nsRuleNode.cpp:2202
15 	xul.dll 	nsBoxFrame::BuildDisplayList 	layout/xul/base/src/nsBoxFrame.cpp:1311
16 	xul.dll 	nsContentSink::StartLayout 	content/base/src/nsContentSink.cpp:1174
17 	xul.dll 	nsHtml5TreeOpExecutor::FlushPendingNotifications 	parser/html/nsHtml5TreeOpExecutor.cpp:213
18 	xul.dll 	nsDocument::FlushPendingNotifications 	content/base/src/nsDocument.cpp:6961
19 	xul.dll 	nsRefPtr<nsNPAPIPluginInstance>::~nsRefPtr<nsNPAPIPluginInstance> 	obj-firefox/dist/include/nsAutoPtr.h:880
20 	xul.dll 	mozilla::dom::Element::GetStyledFrame 	content/base/src/Element.cpp:486
21 	xul.dll 	mozilla::dom::Element::GetScrollFrame 	content/base/src/Element.cpp:527
22 	xul.dll 	mozilla::dom::Element::GetClientAreaRect 	content/base/src/Element.cpp:645
23 	xul.dll 	mozilla::dom::ElementBinding::get_clientWidth 	obj-firefox/dom/bindings/ElementBinding.cpp:1598
24 	xul.dll 	mozilla::dom::ElementBinding::genericGetter 	obj-firefox/dom/bindings/ElementBinding.cpp:2065
25 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:384
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=js%3A%3Atypes%3A%3ATypeCompartment%3A%3AmarkSetsUnknown%28JSContext*%2C+js%3A%3Atypes%3A%3ATypeObject*%29

Comment 2

[Petr Vones]

Another one, Firefox 33.0 Windows XP
https://crash-stats.mozilla.com/report/index/5983c302-30e2-416f-b8ea-2ecd32141017

Comment 3

[Sylvestre Ledru [:Sylvestre]]

Closing because no crash reported since 12 weeks.