crash in js::ObjectImpl::hasClass




JavaScript Engine
6 years ago
5 years ago


(Reporter: Scoobidiver (away), Assigned: dvander)


(Blocks: 1 bug, {crash, regression, reproducible})

17 Branch
Windows 7
crash, regression, reproducible

Firefox Tracking Flags

(firefox18- affected)


(Whiteboard: [js:p1], crash signature)



6 years ago
It first appeared in 17.0a1/20120827. The regression range is:

It spiked after the release of IonMonkey.

The stack traces are:
* Before IonMonkey and in 17.0a2:
Frame 	Module 	Signature 	Source
0 	mozjs.dll 	js::ObjectImpl::hasClass 	js/src/vm/ObjectImpl-inl.h:299
1 	mozjs.dll 	JS::StatsCellCallback 	js/src/MemoryMetrics.cpp:124
2 	mozjs.dll 	js::IterateCellCallbackOp::operator 	js/src/jsgc.cpp:4635
3 	mozjs.dll 	js::gc::ForEachArenaAndCell<js::IterateArenaCallbackOp,js::IterateCellCallbackOp 	js/src/jsgcinlines.h:378
4 	mozjs.dll 	js::IterateCompartmentsArenasCells 	js/src/jsgc.cpp:4658
5 	mozjs.dll 	JS::CollectRuntimeStats 	js/src/MemoryMetrics.cpp:230
6 	xul.dll 	xpc::JSMemoryMultiReporter::CollectReports 	js/xpconnect/src/XPCJSRuntime.cpp:2005
7 	xul.dll 	nsWindowMemoryReporter::CollectReports 	dom/base/nsWindowMemoryReporter.cpp:319
8 	xul.dll 	NS_InvokeByIndex_P 	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:70
9 	xul.dll 	XPCWrappedNative::CallMethod 	js/xpconnect/src/XPCWrappedNative.cpp:2406
10 	xul.dll 	XPC_WN_CallMethod 	js/xpconnect/src/XPCWrappedNativeJSOps.cpp:1478
11 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:352
12 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:2413
13 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:363
14 	mozjs.dll 	js::Invoke 	js/src/jsinterp.cpp:396
15 	mozjs.dll 	JS_CallFunctionValue 	js/src/jsapi.cpp:5846
16 	xul.dll 	nsXPCWrappedJSClass::CallMethod 	js/xpconnect/src/XPCWrappedJSClass.cpp:1430
17 	xul.dll 	nsRefreshDriver::Notify 	layout/base/nsRefreshDriver.cpp:412

* After IonMonkey:
Frame 	Module 	Signature 	Source
0 	mozjs.dll 	js::ObjectImpl::hasClass 	js/src/vm/ObjectImpl-inl.h:337
1 	mozjs.dll 	js::AddValues 	js/src/jsinterp.cpp:4121
2 		@0x36d9e0ef 	
3 	mozjs.dll 	js::ObjectImpl::nativeLookup 	js/src/vm/ObjectImpl.cpp:265
4 	mozjs.dll 	js::NameOperation 	js/src/jsinterpinlines.h:424
5 	mozjs.dll 	EnterIon 	js/src/ion/Ion.cpp:1325
6 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:378
7 	mozjs.dll 	js::Invoke 	js/src/jsinterp.h:119
8 	mozjs.dll 	js::CallOrConstructBoundFunction 	js/src/jsfun.cpp:1078
9 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:367
10 	mozjs.dll 	js::Invoke 	js/src/jsinterp.cpp:411
11 	mozjs.dll 	js::ion::InvokeFunction 	js/src/ion/VMFunctions.cpp:62
12 	mozjs.dll 	JSObject::removeProperty 	js/src/jsscope.cpp:871

More reports at:*%29

Comment 1

6 years ago

1. Go to
2. Enable MapsGL
3. Scroll/Zoom in a few times.

Crash happens soon afterwards with this signature or the signature in bug 790473.

Comment 2

6 years ago
It's #6 top crasher in today's build.
tracking-firefox18: --- → ?
Keywords: topcrash


6 years ago
status-firefox18: --- → affected
tracking-firefox18: ? → +

Comment 3

6 years ago
I got this because I minimized Firefox while it was starting up and restoring my tabs (app tabs). It is usually frozen in that time and does not react immediatelly. I clicked minimize button (Win XP). It did nothing, but after few seconds instead of minimizing it crashed (bp-28d0d2d0-713f-490b-985a-1469c2121009). Then session-restored itself fine to the state it should be in.

Comment 4

6 years ago
Hi all,

I got this on refreshing about:memory after a long browsing session. Haven't been using WebGL for anything. Windows 8 RTM.

Comment 5

6 years ago
(In reply to John Volikas from comment #1)
> bp-8b53c1fa-7ae0-4d2e-a2da-0a74d2120925
> bp-86e9edbb-4413-4cca-9a7a-84b522120925
> 1. Go to
> 2. Enable MapsGL
> 3. Scroll/Zoom in a few times.
> Crash happens soon afterwards with this signature or the signature in bug
> 790473.

This is a pretty good way to reproduce this crash as well.


6 years ago
Keywords: reproducible

Comment 6

6 years ago
Got this crash also on Google maps, with Nightly from:

While zooming in out on maps, crash report:

But what is maybe more important, my first crash with same scenario looks like something "new" (no related bug): Maybe will be helpful, somehow.
This is likely a dupe of bug 790473 as the STR is identical.
Mihaela, comment 26 in Bug 793126 suggests you are crashing with the signature of this bug . Can you please help with some testing to see if this happens on aurora/nightly along with STR and comment here. 
Will be helpful to know if you are seeing any signatures in Bug 790473 as well, as comment 7 suggests this may be a dup.Thanks !
QA Contact: mihaela.velimiroviciu
* Nightly:
- (crash with the signature from this bug)
- (crash with the signature from bug #790473)

* Aurora:
- (crash with the signature from this bug)
- (crash with signature from bug #790473)
- (crash with other signature)

The basic steps I did were:
1. Go to
2. Enable MapsGL 
3. Search a location and navigate on the map, zoom in and out
4. Enter street view mode and "walk" a while 
Note: Sometimes it crashed even without step 4, although that step triggered the crash more easily. Basically, using google maps with webgl enabled for a while (especially in street view, but not only) crashes Firefox with these signatures.
(In reply to David Anderson [:dvander] from comment #7)
> This is likely a dupe of bug 790473 as the STR is identical.

Taking per this comment, if we can get a fix in the other bug I'll verify here.
Assignee: general → dvander
Mozilla/5.0 (Windows NT 5.1; rv:19.0) Gecko/19.0 Firefox/19.0
Build id: 20121115030705

On win XP, I reproduce the crash even easier.
1. Go to google maps
2. Enable Maps GL
3. Search for Sunnyvale
4. Zoom in

Result: Nightly crashes with this signature.


Comment 12

6 years ago
This isn't a topcrash any more, but it's still reproducible, so something that probably warrants a look.
I'm also re-nominating for 18 as being not a topcrash it probably should not be tracking+ any longer.
tracking-firefox18: + → ?
Keywords: topcrash
Thanks KaiRo - untracking.
tracking-firefox18: ? → -
Whiteboard: [js:p1]

Comment 14

5 years ago
Ok so instead of it happening sometimes when loading about:memory, it happens on startup for me (I have about:memory as an app tab). Something made it worse in the last couple of nightlies.
Last Resolved: 5 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 790473
You need to log in before you can comment on or make changes to this bug.