Closed Bug 1494271 Opened 7 years ago Closed 16 days ago

Crash in js::TenuringTracer::traceObject

Categories

(Core :: JavaScript: GC, defect, P2)

Product:
Core
Component:
JavaScript: GC
Type:
defect

Tracking

()

Status:
RESOLVED WORKSFORME
Tracking Flags:
Tracking Status
thunderbird_esr52 --- affected
thunderbird_esr60 --- affected
firefox-esr60 --- affected
firefox62 --- affected
firefox63 --- affected
firefox64 --- affected

People

(Reporter: baffclan, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: crash, Whiteboard: qa-not-actionable)

Crash Data

This bug was filed from the Socorro interface and is report bp-b682599d-9017-4eae-a296-bbdea0180926. ============================================================= Top 10 frames of crashing thread: 0 xul.dll js::TenuringTracer::traceObject js/src/gc/Marking.cpp:3029 1 xul.dll js::Nursery::doCollection js/src/gc/Nursery.cpp:970 2 xul.dll js::Nursery::collect js/src/gc/Nursery.cpp:790 3 xul.dll js::gc::GCRuntime::minorGC js/src/gc/GC.cpp:8354 4 xul.dll class JSObject* js::Allocate<JSObject, js::CanGC> js/src/gc/Allocator.cpp:60 5 xul.dll js::NativeObject::create js/src/vm/NativeObject-inl.h:569 6 xul.dll static class JSObject* NewObject js/src/vm/JSObject.cpp:810 7 xul.dll js::NewObjectWithGroupCommon js/src/vm/JSObject.cpp:999 8 xul.dll js::CreateThisForFunctionWithProto js/src/vm/JSObject.cpp:1155 9 xul.dll js::CreateThisForFunction js/src/vm/JSObject.cpp:1191 ============================================================= Application Basics: Name: Firefox Version: 64.0a1 Build ID: 20180925220052 Update Channel: nightly User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0 OS: Windows_NT 10.0
Component: JavaScript Engine: JIT → JavaScript: GC
Flags: needinfo?(pbone)
Somehow the linked list built into the relocation overlay is becomming currupt and crashing as the next item is retrived. Hard to say what could be causing thsi curruption, it's probably be in a very short window during the current nursery coillection, which I think makes it less likly to be a problem elsewhere in firefox, like a stray pointer write.
Blocks: GCCrashes
Has STR: --- → no
status-firefox62: --- → affected
status-firefox63: --- → affected
status-firefox-esr60: --- → affected
status-thunderbird_esr52: --- → affected
status-thunderbird_esr60: --- → affected
Flags: needinfo?(pbone)
OS: Windows 10 → All
Priority: -- → P2
Hardware: x86_64 → All
Whiteboard: qa-not-actionable
Severity: critical → S2

Infrequent GC crashes such as this are not a high impact issue.

Severity: S2 → S3
Keywords: stalled

Closing because no crashes reported for 12 weeks.

Status: NEW → RESOLVED
Closed: 16 days ago
Resolution: --- → WORKSFORME

Since the bug is closed, the stalled keyword is now meaningless.
For more information, please visit BugBot documentation.

Keywords: stalled
You need to log in before you can comment on or make changes to this bug.