1267686 - crash in js::GCMarker::markAndTraceChildren<T>

Status: RESOLVED WORKSFORME

(Core :: JavaScript: GC, defect)

Description

[Marco Castelluccio [:marco]]

This bug was filed from the Socorro interface and is 
report bp-eb9e41fe-3ac7-49a9-9ea3-a05062160426.
=============================================================

Filing this bug because there is no associated report to that signature yet.

#23 top crasher (with 806 crashes) on Firefox 46.

This crash first appeared on 2015-07-15, but seems to affect Firefox 46 more than Firefox 45.

Comment 1

[Calixte Denizet (:calixte)]

In release, the crash is spiking since 2016-05-05 (increased by ~200% until 2016-05-08) and is #33 in top-crashes for 46.0.1.

Comment 2

[Terrence Cole [:terrence]]

Nothing has changed in the GC in this area in ages. This is either a new UAF error in gecko or an inlining change. Have any other GC tracing signatures dropped precipitously in the same time frame?

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'js::GCMarker::markAndTraceChildren<T>':
 - nightly (version 50): 5 crashes from 2016-06-06.
 - aurora  (version 49): 25 crashes from 2016-06-07.
 - beta    (version 48): 440 crashes from 2016-06-06.
 - release (version 47): 554 crashes from 2016-05-31.
 - esr     (version 45): 41 crashes from 2016-04-07.

Crash volume on the last weeks:
             Week N-1   Week N-2   Week N-3   Week N-4   Week N-5   Week N-6   Week N-7
 - nightly          0          2          0          0          1          0          0
 - aurora           4          0          3          6          5          6          0
 - beta            79         53         67         87         57         54         15
 - release        104         66         94         87         85         69         22
 - esr              4          5          8          2          0          2          4

Affected platforms: Windows, Linux

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'js::GCMarker::markAndTraceChildren<T>':
 - nightly (version 52): 0 crashes from 2016-09-19.
 - aurora  (version 51): 2 crashes from 2016-09-19.
 - beta    (version 50): 270 crashes from 2016-09-20.
 - release (version 49): 929 crashes from 2016-09-05.
 - esr     (version 45): 67 crashes from 2016-07-25.

Crash volume on the last weeks (Week N is from 10-17 to 10-23):
            W. N-1  W. N-2  W. N-3  W. N-4
 - nightly       0       0       0       0
 - aurora        0       2       0       0
 - beta         73      74      74       6
 - release     304     238     232      72
 - esr           7       7       7       6

Affected platforms: Windows, Linux

Crash rank on the last 7 days:
           Browser   Content     Plugin
 - nightly
 - aurora            #385
 - beta    #158      #210
 - release #273      #138
 - esr     #1168

Comment 5

[Pablo]

Reopening bug since there are crash reports in the last 6 months.

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.