Crash in js::jit::ReprotectRegion (due to MOZ_RELEASE_ASSERT(p >= base_ && uintptr_t(p) + bytes <= uintptr_t(base_) + MaxCodeBytesPerProcess))

NEW
Unassigned

Status

()

Product:
Core
Component:
JavaScript: GC
Importance:
P3
critical
Reported:
2 years ago
Modified:
a year ago

People

(Reporter: mats, Unassigned)

Tracking

({crash, triage-deferred})

Version:
53 Branch
Platform:
x86
Windows 7
Keywords:
crash, triage-deferred
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

(Reporter)

Description

•
2 years ago 
This bug was filed from the Socorro interface and is 
report bp-8a1e51b0-2c7d-4ec5-81df-928880170503.
=============================================================

MOZ_CRASH Reason: 	MOZ_RELEASE_ASSERT(p >= base_ && uintptr_t(p) + bytes <= uintptr_t(base_) + MaxCodeBytesPerProcess)


More reports at:
https://crash-stats.mozilla.com/signature/?moz_crash_reason=MOZ_RELEASE_ASSERT&signature=js%3A%3Ajit%3A%3AReprotectRegion#reports

Comment 1

•
2 years ago 
Crashes during GC, mainly.
Component: JavaScript Engine: JIT → JavaScript: GC
Keywords: triage-deferred
Priority: -- → P3
You need to log in before you can comment on or make changes to this bug.