Crash in js::DispatchTyped<T>

NEW
Unassigned

Status

()

Core
JavaScript: GC
P3
critical
11 months ago
28 days ago

People

(Reporter: jchen, Unassigned, NeedInfo)

Tracking

(Blocks: 1 bug, {crash, triage-deferred})

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

(Reporter)

Description

11 months ago
This bug was filed from the Socorro interface and is 
report bp-0cb28457-5469-484c-bf39-b6db92170119.
=============================================================

This low-volume crash has been showing up in nightlies over the last couple of months. This crash has `js::GCMarker::lazilyMarkChildren` as the second frame, which I think is different from the previously resolved bugs (bug 1260198 and bug 1266579) that have similar top frame signature.

Crash addresses are all over the place so it could be security sensitive as well.

Any ideas, Jon?
Flags: needinfo?
(Reporter)

Updated

11 months ago
Flags: needinfo?(jcoppeard)
(Reporter)

Updated

11 months ago
Flags: needinfo?

Updated

11 months ago
Group: core-security → javascript-core-security
This is a pretty generic crash so I'll just unhide it. If somebody figures out something more specific, file a new sec bug.
Group: javascript-core-security
Keywords: triage-deferred
Priority: -- → P3
78% of crashes are on amd64.
Blocks: 1400237

Comment 3

28 days ago
1 failures in 849 pushes (0.001 failures/push) were associated with this bug in the last 7 days.    

Repository breakdown:
* autoland: 1

Platform breakdown:
* android-7-1-armv8-api16: 1

For more details, see:
https://brasstacks.mozilla.com/orangefactor/?display=Bug&bugid=1332175&startday=2017-11-06&endday=2017-11-12&tree=all
You need to log in before you can comment on or make changes to this bug.