1359657 - Crash in js::GCMarker::eagerlyMarkChildren(js::Shape*)

Status: RESOLVED DUPLICATE of bug 1441002

(Core :: JavaScript: GC, defect, P1)

Description

[Ting-Yu Chou [:ting] (away)]

This bug was filed from the Socorro interface and is 
report bp-b35eac91-eb78-4561-a7c6-2ea1a0170425.
=============================================================
Top #24 of Nightly 20170423030206 on Windows, 6 reports from 5 installations. There are 48 reports from 41 installations after landing bug 1337578.

Comment 1

[Ting-Yu Chou [:ting] (away)]

(In reply to Ting-Yu Chou [:ting] from comment #0)
> This bug was filed from the Socorro interface and is 
> report bp-b35eac91-eb78-4561-a7c6-2ea1a0170425.
> =============================================================
> Top #24 of Nightly 20170423030206 on Windows, 6 reports from 5
> installations.

It seems that they are different crashes with the same signature. 3 of them are with this stack:

  js::GCMarker::eagerlyMarkChildren(js::Shape*)
  js::GCMarker::traverseEdge<JSObject*, js::Shape>(JSObject*, js::Shape*)
  js::GCMarker::processMarkStackTop(js::SliceBudget&)
  js::GCMarker::drainMarkStack(js::SliceBudget&)
  js::gc::GCRuntime::drainMarkStack(js::SliceBudget&, js::gcstats::Phase)
  js::gc::GCRuntime::incrementalCollectSlice(js::SliceBudget&, JS::gcreason::Reason, js::AutoLockForExclusiveAccess&)
  js::gc::GCRuntime::gcCycle(bool, js::SliceBudget&, JS::gcreason::Reason)
  js::gc::GCRuntime::collect(bool, js::SliceBudget, JS::gcreason::Reason)

Comment 2

[Wayne Mery (:wsmwk)]

#32 crash for THunderbird 52.6.0

Comment 3

[Sylvestre Ledru [:Sylvestre]]

Andrew, could you please help with this issue? (just like in bug 1441002) 
We have this crash for a while but the volume is still huge (more than 90 000 installs impacted at least) on release.

Comment 4

[Andrew Overholt [:overholt]]

Steve's going to think of some ideas for how we could get more information to get this (and bug 1441002) fixed.

Comment 5

[Andrew Overholt [:overholt]]

Ugh, more e5e5e5 addresses (page 109 of the reports).

Comment 6

[Steve Fink [:sfink] [:s:]]

There are zero occurrences of this specific type (js::Shape*) in the last 6 months.