Crash in js::jit::ReprotectRegion (due to MOZ_RELEASE_ASSERT(p >= base_ && uintptr_t(p) + bytes <= uintptr_t(base_) + MaxCodeBytesPerProcess))

NEW
Unassigned

Status

()

P3
critical
2 years ago
a year ago

People

(Reporter: mats, Unassigned)

Tracking

({crash, triage-deferred})

53 Branch
x86
Windows 7
crash, triage-deferred
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

(Reporter)

Description

2 years ago
This bug was filed from the Socorro interface and is 
report bp-8a1e51b0-2c7d-4ec5-81df-928880170503.
=============================================================

MOZ_CRASH Reason: 	MOZ_RELEASE_ASSERT(p >= base_ && uintptr_t(p) + bytes <= uintptr_t(base_) + MaxCodeBytesPerProcess)


More reports at:
https://crash-stats.mozilla.com/signature/?moz_crash_reason=MOZ_RELEASE_ASSERT&signature=js%3A%3Ajit%3A%3AReprotectRegion#reports

Comment 1

2 years ago
Crashes during GC, mainly.
Component: JavaScript Engine: JIT → JavaScript: GC
Keywords: triage-deferred
Priority: -- → P3
You need to log in before you can comment on or make changes to this bug.