1918959 - Crash in [@ js::NativeShape::propMap]

Status: NEW

(Core :: JavaScript: GC, defect, P5)

Description

[BugBot [:suhaib / :marco/ :calixte]]

Crash report: https://crash-stats.mozilla.org/report/index/f18e294a-12ef-43f4-8506-a5d980240914

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0  xul.dll  js::NativeShape::propMap const  js/src/vm/Shape.h:505
0  xul.dll  js::GCMarker::eagerlyMarkChildren  js/src/gc/TraceMethods-inl.h:69
0  xul.dll  js::GCMarker::scanChildren  js/src/gc/Marking.cpp:1091
0  xul.dll  js::GCMarker::traverse  js/src/gc/Marking.cpp:1056
0  xul.dll  js::GCMarker::markAndTraverse  js/src/gc/Marking.cpp:990
0  xul.dll  js::GCMarker::markAndTraverseEdge  js/src/gc/Marking.cpp:1160
0  xul.dll  js::GCMarker::processMarkStackTop  js/src/gc/Marking.cpp:1609
0  xul.dll  js::GCMarker::markCurrentColorInParallel  js/src/gc/Marking.cpp:1347
1  xul.dll  js::gc::ParallelMarkTask::tryMarking  js/src/gc/ParallelMarking.cpp:185
1  xul.dll  js::gc::ParallelMarkTask::run  js/src/gc/ParallelMarking.cpp:162

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2024-07-20
• Process type: Multiple distinct types
• Is startup crash: No
• Has user comments: No
• Is null crash: Yes - 1 out of 7 crashes happened on null or near null memory address

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::JavaScript: GC' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[Steven DeTar [:sdetar]]

Jon, could you do a quick look at this crash when you have time.

Comment 3

[Jon Coppeard (:jonco)]

Low volume crash during marking. This does not look actionable.