830077 - crash in js::baseops::GetAttributes

Status: RESOLVED DUPLICATE of bug 829813

(Core :: JavaScript Engine, defect)

Description

[Scoobidiver (away)]

It's #5 top crasher in today's build and first showed up in 21.0a1/20130112. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=8592c41069c2&tochange=1761f4a9081c

Signature 	js::baseops::GetAttributes(JSContext*, JS::Handle<JSObject*>, JS::Handle<long>, unsigned int*) More Reports Search
UUID	1dc368b9-60f9-4ea8-b14a-50e422130112
Date Processed	2013-01-12 22:13:08
Uptime	1
Last Crash	41 seconds before submission
Install Age	2.3 hours since version was first installed.
Install Time	2013-01-12 19:57:08
Product	Firefox
Version	21.0a1
Build ID	20130112030947
Release Channel	nightly
OS	Linux
OS Version	0.0.0 Linux 3.6.11-gentoo #14 SMP Sat Jan 12 14:43:10 EST 2013 x86_64
Build Architecture	amd64
Build Architecture Info	family 6 model 42 stepping 7
Crash Reason	SIGSEGV
Crash Address	0x15
Processor Notes 	/data/socorro/stackwalk/bin/exploitable: ERROR: unable to analyze dump
EMCheckCompatibility	False

Frame 	Module 	Signature 	Source
0 	libxul.so 	js::baseops::GetAttributes 	js/src/jsobj.cpp:3977
1 	libxul.so 	JSObject::getGenericAttributes 	js/src/jsobjinlines.h:1271
2 	libxul.so 	obj_propertyIsEnumerable 	js/src/builtin/Object.cpp:102
3 	libxul.so 	js::InvokeKernel 	js/src/jscntxtinlines.h:373
4 	libxul.so 	js::Invoke 	js/src/jsinterp.h:112
5 	libxul.so 	js_fun_call 	js/src/jsfun.cpp:848
6 	libxul.so 	js::InvokeKernel 	js/src/jscntxtinlines.h:373
7 	libxul.so 	js::Interpret 	js/src/jsinterp.cpp:2368
8 	libxul.so 	js::RunScript 	js/src/jsinterp.cpp:348
9 	libxul.so 	js::InvokeKernel 	js/src/jsinterp.cpp:406
10 	libxul.so 	js::Invoke 	js/src/jsinterp.h:112
11 	libxul.so 	js_fun_apply 	js/src/jsfun.cpp:960
12 	libxul.so 	js::InvokeKernel 	js/src/jscntxtinlines.h:373
13 	libxul.so 	js::Interpret 	js/src/jsinterp.cpp:2368
14 	libxul.so 	js::RunScript 	js/src/jsinterp.cpp:348
15 	libxul.so 	js::InvokeKernel 	js/src/jsinterp.cpp:406
16 	libxul.so 	js::Invoke 	js/src/jsinterp.h:112
17 	libxul.so 	js_fun_call 	js/src/jsfun.cpp:848
18 	libxul.so 	js::InvokeKernel 	js/src/jscntxtinlines.h:373
19 	libxul.so 	js::Interpret 	js/src/jsinterp.cpp:2368
20 	libxul.so 	js::RunScript 	js/src/jsinterp.cpp:348
21 	libxul.so 	js::InvokeKernel 	js/src/jsinterp.cpp:406
22 	libxul.so 	js::Invoke 	js/src/jsinterp.h:112
23 	libxul.so 	JS_CallFunctionValue 	js/src/jsapi.cpp:5829
24 	libxul.so 	nsXPCWrappedJSClass::CallMethod 	js/xpconnect/src/XPCWrappedJSClass.cpp:1432
25 	libxul.so 	nsXPCWrappedJS::CallMethod 	js/xpconnect/src/XPCWrappedJS.cpp:580
26 	libxul.so 	PrepareAndDispatch 	xptcstubs_x86_64_linux.cpp:122
27 	libxul.so 	libxul.so@0x1a610d6 	
28 	libxul.so 	nsIOService::NewChannelFromURI 	netwerk/base/src/nsIOService.cpp:598
29 	libxul.so 	NS_NewChannel 	nsNetUtil.h:199
30 	libxul.so 	NS_OpenURI 	nsNetUtil.h:251
31 	libxul.so 	mozilla::css::Loader::LoadSheet 	layout/style/Loader.cpp:1412
32 	libxul.so 	mozilla::css::Loader::InternalLoadNonDocumentSheet 	layout/style/Loader.cpp:2198
33 	libxul.so 	mozilla::css::Loader::LoadSheetSync 	layout/style/Loader.cpp:2106
34 	libxul.so 	nsStyleSheetService::LoadAndRegisterSheetInternal 	layout/base/nsStyleSheetService.cpp:183
35 	libxul.so 	nsStyleSheetService::LoadAndRegisterSheet 	layout/base/nsStyleSheetService.cpp:141
36 	libxul.so 	NS_InvokeByIndex_P 	xptcinvoke_x86_64_unix.cpp:164
37 	libxul.so 	XPCWrappedNative::CallMethod 	js/xpconnect/src/XPCWrappedNative.cpp:3085
38 	libxul.so 	XPC_WN_CallMethod 	js/xpconnect/src/XPCWrappedNativeJSOps.cpp:1488
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=js%3A%3Abaseops%3A%3AGetAttributes%28JSContext*%2C+JS%3A%3AHandle%3CJSObject*%3E%2C+JS%3A%3AHandle%3Clong%3E%2C+unsigned+int*%29

Comment 1

[Scoobidiver (away)]

More reports also at:
https://crash-stats.mozilla.com/report/list?signature=js%3A%3Abaseops%3A%3AGetAttributes%28JSContext*%2C+JS%3A%3AHandle%3CJSObject*%3E%2C+JS%3A%3AHandle%3Cint%3E%2C+unsigned+int*%29