761948 - crash in JSObject::addPropertyInternal

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Scoobidiver (away)]

It first appeared in 16.0a1/20120605. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=dd6ec482a85d&tochange=a7a905fd70d5

Stacks are various:
Frame 	Module 	Signature 	Source
0 	mozjs.dll 	JSObject::addPropertyInternal 	js/src/jsscope.cpp:556
1 	mozjs.dll 	JSObject::putProperty 	js/src/jsscope.cpp:637
2 	mozjs.dll 	js::DefineNativeProperty 	js/src/jsobj.cpp:4554
3 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:3231
4 	mozjs.dll 	js::RunScript 	js/src/jsinterp.cpp:258
5 	mozjs.dll 	js::ExecuteKernel 	js/src/jsinterp.cpp:466
6 	mozjs.dll 	js::Execute 	js/src/jsinterp.cpp:508
7 	mozjs.dll 	JS_ExecuteScript 	js/src/jsapi.cpp:5354
8 	mozjs.dll 	JS_ExecuteScriptVersion 	js/src/jsapi.cpp:5362
...

Frame 	Module 	Signature 	Source
0 	mozjs.dll 	JSObject::addPropertyInternal 	js/src/jsscope.cpp:556
1 	mozjs.dll 	JSObject::addProperty 	js/src/jsscope.cpp:498
2 	mozjs.dll 	AddLengthProperty 	js/src/jsarray.cpp:1304
3 	mozjs.dll 	js::NewSlowEmptyArray 	js/src/jsarray.cpp:3853
4 	mozjs.dll 	CreateRegExpMatchResult 	js/src/builtin/RegExp.cpp:65
5 	mozjs.dll 	ExecuteRegExpImpl<js::RegExpShared> 	js/src/builtin/RegExp.cpp:130
6 	mozjs.dll 	DoMatch 	js/src/jsstr.cpp:1541
7 	mozjs.dll 	js::str_match 	js/src/jsstr.cpp:1621
8 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:310
9 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:2512
...

Frame 	Module 	Signature 	Source
0 	mozjs.dll 	JSObject::addPropertyInternal 	js/src/jsscope.cpp:562
1 	mozjs.dll 	js::FoldConstants 	js/src/frontend/FoldConstants.cpp:412
2 	xul.dll 	nsIDOMHTMLElement_GetTitle 	obj-firefox/js/xpconnect/src/dom_quickstubs.cpp:13894
3 	xul.dll 	nsIDOMHTMLElement_SetId 	obj-firefox/js/xpconnect/src/dom_quickstubs.cpp:13877
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=JSObject%3A%3AaddPropertyInternal%28JSContext*%2C+int%2C+int+%28*%29%28JSContext*%2C+JS%3A%3AHandle%3CJSObject*%3E%2C+JS%3A%3AHandle%3Cint%3E%2C+JS%3A%3AValue*%29%2C+int+%28*%29%28JSContext*%2C+JS%3A%3AHandle%3CJSObject*%3E%2C+JS%3A%3AHandle%3Cint%3E%2C+int%2C+JS%3A%3AValue*%29%2C+unsigned+int%2C+unsigned+int%2C+unsigned+int%2C+int%2C+js%3A%3ASha...

Comment 1

[Scoobidiver (away)]

There have been no crashes for the last four weeks across all versions.