1459485 - Crash in static bool IsAboutToBeFinalizedInternal<T>

Status: RESOLVED WONTFIX

(Core :: JavaScript: GC, defect)

Description

[Julian Seward [:jseward]]

This bug was filed from the Socorro interface and is
report bp-c1d237cb-f54a-4e96-b29a-e02b40180505.
=============================================================

This is topcrash #13 in the Nightly 20180503100146.

Top 10 frames of crashing thread:

0 xul.dll static bool IsAboutToBeFinalizedInternal<js::ObjectGroup> js/src/gc/Marking.cpp:3382
1 xul.dll static bool IsObjectKeyAboutToBeFinalized js/src/vm/TypeInference.cpp:846
2 xul.dll js::ConstraintTypeSet::sweep js/src/vm/TypeInference.cpp:4289
3 xul.dll JSScript::sweepTypes js/src/vm/TypeInference.cpp:4562
4 xul.dll static bool SweepArenaList<JSScript, js::AutoClearTypeInferenceStateOnOOM* __ptr64> js/src/gc/GC.cpp:5937
5 xul.dll js::gc::GCRuntime::sweepTypeInformation js/src/gc/GC.cpp:5967
6 xul.dll sweepaction::SweepActionSequence<js::gc::GCRuntime*, js::FreeOp*, js::SliceBudget&, JS::Zone*>::run js/src/gc/GC.cpp:6375
7 xul.dll sweepaction::SweepActionForEach<js::gc::SweepGroupZonesIter, JSRuntime*, js::gc::GCRuntime*, js::FreeOp*, js::SliceBudget&>::run js/src/gc/GC.cpp:6406
8 xul.dll sweepaction::SweepActionSequence<js::gc::GCRuntime*, js::FreeOp*, js::SliceBudget&>::run js/src/gc/GC.cpp:6375
9 xul.dll sweepaction::SweepActionRepeatFor<js::gc::SweepGroupsIter, JSRuntime*, js::gc::GCRuntime*, js::FreeOp*, js::SliceBudget&>::run js/src/gc/GC.cpp:6436

=============================================================

Comment 1

[Jon Coppeard (:jonco)]

Similar to bug 1289075, although the stacks are not exactly the same.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.