1260453 - crash in OOM | unknown | js::AutoEnterOOMUnsafeRegion::crash | js::TenuringTracer::traverse<T>

Status: RESOLVED DUPLICATE of bug 1257387

(Core :: JavaScript: GC, defect)

Description

[Calixte Denizet (:calixte)]

This bug was filed from the Socorro interface and is 
report bp-85954b6c-4404-4339-8cd5-3b80c2160326.
=============================================================

This crash is #22 in beta topcrashes.

Stack
js::AutoEnterOOMUnsafeRegion::crash(char const*)
js::TenuringTracer::traverse<JSObject>(JSObject**)
js::TraceManuallyBarrieredEdge<JSObject*>(JSTracer*, JSObject**, char const*)
fun_trace
CallTraceHook<TenuringFunctor, js::TenuringTracer&>
js::Nursery::collectToFixedPoint(js::TenuringTracer&, js::gc::TenureCountCache&)
js::Nursery::collect(JSRuntime*, JS::gcreason::Reason, mozilla::Vector<js::ObjectGroup*, 0, js::SystemAllocPolicy>*)
js::gc::GCRuntime::minorGCImpl(JS::gcreason::Reason, mozilla::Vector<js::ObjectGroup*, 0, js::SystemAllocPolicy>*)

Comment 1

[Andrew McCreight [:mccr8]]

This looks like a variant of the stack in bug 1257387.

Comment 2

[philbogle]

Attachment: Memory report after reloading the page, right before FF crashes

Comment 3

[philbogle]

I got a second memory report.  It looks like FF crashed trying to create the .gz version of the memory report but it did manage to write the json.