Open Bug 1361914 Opened 8 years ago Updated 3 years ago

Crash in js::jit::ReprotectRegion (due to MOZ_RELEASE_ASSERT(p >= base_ && uintptr_t(p) + bytes <= uintptr_t(base_) + MaxCodeBytesPerProcess))

Categories

(Core :: JavaScript: GC, defect, P3)

53 Branch
x86
Windows 7
defect

Tracking

()

REOPENED

People

(Reporter: MatsPalmgren_bugz, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: crash, triage-deferred)

Crash Data

This bug was filed from the Socorro interface and is report bp-8a1e51b0-2c7d-4ec5-81df-928880170503. ============================================================= MOZ_CRASH Reason: MOZ_RELEASE_ASSERT(p >= base_ && uintptr_t(p) + bytes <= uintptr_t(base_) + MaxCodeBytesPerProcess) More reports at: https://crash-stats.mozilla.com/signature/?moz_crash_reason=MOZ_RELEASE_ASSERT&signature=js%3A%3Ajit%3A%3AReprotectRegion#reports
Crashes during GC, mainly.
Component: JavaScript Engine: JIT → JavaScript: GC
Keywords: triage-deferred
Priority: -- → P3

Closing this as resolved:worksforme since there were no crashes in the last 6 months for this signature.

Status: NEW → RESOLVED
Closed: 4 years ago
Resolution: --- → WORKSFORME

There have been recent crashes with this signature, including the same release assert.
bp-9cc21d13-f809-495e-9450-3e1930210602

Status: RESOLVED → REOPENED
Resolution: WORKSFORME → ---
QA Whiteboard: qa-not-actionable
Severity: critical → S2

Since the crash volume is low (less than 5 per week), the severity is downgraded to S3. Feel free to change it back if you think the bug is still critical.

For more information, please visit auto_nag documentation.

Severity: S2 → S3
You need to log in before you can comment on or make changes to this bug.