1002544 - crash in js::gc::CrashAtUnhandlableOOM(char const*) | js::types::TypeObject::sweep(js::FreeOp*)

Status: RESOLVED DUPLICATE of bug 988619

(Core :: JavaScript: GC, defect)

Description

[juan becerra [:juanb]]

This bug was filed from the Socorro interface and is 
report bp-2e3be84e-3125-4991-8c31-1d75f2140425.
=============================================================

This is suddenly the top #11 crash signature on Fx29. It started appearing around 4/17. It's mostly on Windows 7. There's not a lot of information in the crash report comments, only that the browser seem to stop responding before crashing.

Frame 	Module 	Signature 	Source
0 	mozjs.dll 	js::gc::CrashAtUnhandlableOOM(char const *) 	js/src/gc/Verifier.cpp
1 	mozjs.dll 	js::types::TypeObject::sweep(js::FreeOp *) 	js/src/jsinfer.cpp
2 	mozjs.dll 	js::types::TypeZone::sweep(js::FreeOp *,bool) 	js/src/jsinfer.cpp
3 	mozjs.dll 	JS::Zone::sweep(js::FreeOp *,bool) 	js/src/gc/Zone.cpp
4 	mozjs.dll 	BeginSweepingZoneGroup 	js/src/jsgc.cpp
5 	mozjs.dll 	SweepPhase 	js/src/jsgc.cpp
6 	mozjs.dll 	IncrementalCollectSlice 	js/src/jsgc.cpp
7 	mozjs.dll 	Collect 	js/src/jsgc.cpp

Comment 1

[Robert Kaiser]

This is a dupe of bug 988619, which is fixed in 30+ but didn't make 29.