Closed Bug 991854 Opened 10 years ago Closed 10 years ago

crash in JSObject::getPropertyNoGC(JSContext*, JSObject*, JSObject*, js::PropertyName*, JS::Value*)

Categories

(Core :: JavaScript Engine, defect)

31 Branch
x86
Windows NT
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 992535
Tracking Status
firefox31 - affected

People

(Reporter: u279076, Unassigned)

Details

(Keywords: crash)

Crash Data

This bug was filed from the Socorro interface and is 
report bp-afb45dc6-ccdd-4060-8eaf-900cf2140403.
=============================================================
0 	mozjs.dll 	JSObject::getPropertyNoGC(JSContext *,JSObject *,JSObject *,js::PropertyName *,JS::Value *) 	js/src/jsobj.h
1 	mozjs.dll 	js::jit::GetElementIC::update(JSContext *,unsigned int,JS::Handle<JSObject *>,JS::Handle<JS::Value>,JS::MutableHandle<JS::Value>) 	js/src/jit/IonCaches.cpp
2 		@0x2eb51c8c 	

More reports:
https://crash-stats.mozilla.com/report/list?product=Firefox&signature=JSObject%3A%3AgetPropertyNoGC%28JSContext%2A%2C+JSObject%2A%2C+JSObject%2A%2C+js%3A%3APropertyName%2A%2C+JS%3A%3AValue%2A%29

This started to spike as of 2014-03-29, the same day we enabled GGC on Nightly. It's currently #29 @ 0.46% on Nightly. Based on URLs this seems highly correlated to Bing Maps.
Flags: needinfo?(terrence)
Bug 992535 appears to have fixed the issue: no new crashes since the 8 Apr build.
Status: NEW → RESOLVED
Closed: 10 years ago
Flags: needinfo?(terrence)
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.