763073 - crash in JSObject::getGeneric

Status: RESOLVED DUPLICATE of bug 762197

(Core :: JavaScript Engine, defect)

Description

[Marcia Knous [:marcia]]

This bug was filed from the Socorro interface and is 
report bp-5855a9f4-135f-4eef-8251-564c62120608 .
============================================================= 

Seen while looking at crash stats:

https://crash-stats.mozilla.com/report/list?signature=JSObject%3A%3AgetGeneric%28JSContext*%2C%20JS%3A%3AHandle%3CJSObject*%3E%2C%20JS%3A%3AHandle%3Cint%3E%2C%20JS%3A%3AValue*%29

Windows crash which started showing up in higher volume in 2012060603 build.

I looked at the URLs and crashes with two of them on Mac but in slightly different stacks:

http://crash-stats.mozilla.com/report/index/bp-49db9406-e03c-46c6-ba1c-1a4862120608 and http://crash-stats.mozilla.com/report/index/bp-8f5e2ff6-a8bb-41df-b082-817092120608

Frame 	Module 	Signature 	Source
0 	mozjs.dll 	JSObject::getGeneric 	js/src/jsobjinlines.h:157
1 	mozjs.dll 	JSObject::getProperty 	js/src/jsobjinlines.h:183
2 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:2382
3 	mozjs.dll 	js::types::TypeSet::addType 	js/src/jsinferinlines.h:1116
4 	mozjs.dll 	js::types::TypeScript::SetThis 	js/src/jsinferinlines.h:690
5 	mozjs.dll 	js::Execute 	js/src/jsinterp.cpp:493

Comment 1

[Scoobidiver (away)]

Same remarks as in bug 714761.