Open Bug 1294610 Opened 4 years ago Updated 3 years ago

Crash in js::TenuringTracer::moveObjectToTenured (Unhandled JSCLASS_SKIP_NURSERY_FINALIZE Class)

Categories

(Core :: JavaScript: GC, defect, P3, critical)

Unspecified
Windows 10
defect

Tracking

()

Tracking Status
firefox48 --- affected
firefox49 --- affected
firefox-esr45 --- affected
firefox50 --- affected
firefox51 --- affected

People

(Reporter: jchen, Unassigned)

References

Details

(Keywords: crash, triage-deferred)

Crash Data

This bug was filed from the Socorro interface and is 
report bp-a0eb5298-ee2a-4818-9e74-a347f2160812.
=============================================================

Crash at [1], which is an intentional crash:

> MOZ_CRASH("Unhandled JSCLASS_SKIP_NURSERY_FINALIZE Class");

Seems to have started with the 8-06 Nightly, but the volume is low (7 crashes for the 8-09 Nightly, making it the #19 crash on Windows for that Nightly).

[1] https://hg.mozilla.org/mozilla-unified/annotate/720b5d2c84d5/js/src/gc/Marking.cpp#l2353
I think this is a variant of bug 1293244, based on tsmith running a test case in that bug a few times.
Depends on: 1293244
Crash volume for signature 'js::TenuringTracer::moveObjectToTenured':
 - nightly (version 51): 95 crashes from 2016-08-01.
 - aurora  (version 50): 3 crashes from 2016-08-01.
 - beta    (version 49): 376 crashes from 2016-08-02.
 - release (version 48): 11 crashes from 2016-07-25.
 - esr     (version 45): 1 crash from 2016-05-02.

Crash volume on the last weeks (Week N is from 08-22 to 08-28):
            W. N-1  W. N-2  W. N-3
 - nightly      29      52       4
 - aurora        1       1       0
 - beta        131     127      40
 - release       4       4       1
 - esr           0       0       0

Affected platforms: Windows, Mac OS X, Linux

Crash rank on the last 7 days:
           Browser   Content     Plugin
 - nightly #97       #58
 - aurora  #1327     #759
 - beta    #127      #200
 - release #3673
 - esr
Keywords: triage-deferred
Priority: -- → P3
You need to log in before you can comment on or make changes to this bug.