1260470 - crash in OOM | unknown | js::AutoEnterOOMUnsafeRegion::crash | js::gc::StoreBuffer::MonoTypeBuffer<T>::trace

Status: RESOLVED DUPLICATE of bug 1257387

(Core :: JavaScript: GC, defect)

Description

[Calixte Denizet (:calixte)]

This bug was filed from the Socorro interface and is 
report bp-77c1cba9-f4a4-45f7-b23c-44c4f2160329.
=============================================================

This signature appeared the 2016-03-24 and is currently the #34 in topcrash.
These crashes occured mainly in 45.0.1 (82.5%) and in 46.0b5 (12.6%)

Stack

js::AutoEnterOOMUnsafeRegion::crash(char const*)
js::gc::StoreBuffer::MonoTypeBuffer<js::gc::StoreBuffer::CellPtrEdge>::trace(js::gc::StoreBuffer*, js::TenuringTracer&)
js::Nursery::collect(JSRuntime*, JS::gcreason::Reason, mozilla::Vector<js::ObjectGroup*, 0, js::SystemAllocPolicy>*)
js::gc::GCRuntime::minorGCImpl(JS::gcreason::Reason, mozilla::Vector<js::ObjectGroup*, 0, js::SystemAllocPolicy>*)
js::gc::GCRuntime::evictNursery(JS::gcreason::Reason)
js::gc::ZoneCellIter::ZoneCellIter(JS::Zone*, js::gc::AllocKind)
js::GlobalHelperThreadState::mergeParseTaskCompartment(JSRuntime*, js::ParseTask*, JS::Handle<js::GlobalObject*>, JSCompartment*)

Comment 1

[Andrew McCreight [:mccr8]]

This is probably another variant of bug 1257387, where we attempt to tenure an object but we fail to allocate a new chunk.