1935284 - Crash in [@ js::PropMap::lookupLinear]

Status: NEW

(Core :: JavaScript Engine, defect, P5)

Description

[BugBot [:suhaib / :marco/ :calixte]]

Crash report: https://crash-stats.mozilla.org/report/index/4322e56c-8c41-42dc-aa9b-783d20240919

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0  xul.dll  js::PropMap::lookupLinear  js/src/vm/PropMap-inl.h:67
0  xul.dll  js::PropMap::lookup  js/src/vm/PropMap-inl.h:138
0  xul.dll  js::NativeShape::lookup  js/src/vm/Shape-inl.h:53
0  xul.dll  js::NativeLookupOwnPropertyInline  js/src/vm/NativeObject-inl.h:757
0  xul.dll  js::NativeLookupPropertyInline  js/src/vm/NativeObject-inl.h:817
0  xul.dll  PreprocessFastValue  js/src/builtin/JSON.cpp:1176
0  xul.dll  FastSerializeJSONProperty  js/src/builtin/JSON.cpp:1357
0  xul.dll  js::Stringify  js/src/builtin/JSON.cpp:1700
1  xul.dll  JS_Stringify  js/src/jsapi.cpp:3645
1  xul.dll  nsContentUtils::StringifyJSON  dom/base/nsContentUtils.cpp:11154

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2024-12-03
• Process type: Multiple distinct types
• Is startup crash: No
• Has user comments: No
• Is null crash: Yes - 1 out of 2 crashes happened on null or near null memory address

Comment 1

[Nicolas B. Pierron [:nbp]]

Looking at the low volume and the bit-flip probability, I will classify it as a symptom of bad hardware.