1375445 - Crash in js::gc::GCRuntime::sweepAtomsTable

Status: RESOLVED WORKSFORME

(Core :: JavaScript: GC, defect, P3)

Description

[[:philipp]]

This bug was filed from the Socorro interface and is 
report bp-059adc6b-60ea-40cf-a93d-1abc00170622.
=============================================================
Crashing Thread (0)
Frame 	Module 	Signature 	Source
0 	xul.dll 	js::gc::GCRuntime::sweepAtomsTable(js::SliceBudget&) 	js/src/jsgc.cpp:5605
1 	xul.dll 	js::gc::GCRuntime::sweepAtomsTable(js::gc::GCRuntime*, js::FreeOp*, JS::Zone*, js::SliceBudget&, js::gc::AllocKind) 	js/src/jsgc.cpp:5582
2 	xul.dll 	js::gc::GCRuntime::performSweepActions(js::SliceBudget&, js::AutoLockForExclusiveAccess&) 	js/src/jsgc.cpp:5720
3 	xul.dll 	js::gc::GCRuntime::incrementalCollectSlice(js::SliceBudget&, JS::gcreason::Reason, js::AutoLockForExclusiveAccess&) 	js/src/jsgc.cpp:6329
4 	xul.dll 	js::gc::GCRuntime::gcCycle(bool, js::SliceBudget&, JS::gcreason::Reason) 	js/src/jsgc.cpp:6614
5 	xul.dll 	js::gc::GCRuntime::collect(bool, js::SliceBudget, JS::gcreason::Reason) 	js/src/jsgc.cpp:6763

crash reports with this signature are newly showing up in firefox 55 - so far only from windows users. it looks related to bug 1369444.

Comment 1

[Marcia Knous [:marcia]]

Discussed during triage, ni on jcoppeard since he has been working in this area.

Comment 2

[Jon Coppeard (:jonco)]

This is a continuation of the JSRuntime::sweepAtoms crashes (the code was moved into GCRuntime::sweepAtomsTable in bug 1369444).

https://crash-stats.mozilla.com/signature/?signature=JSRuntime%3A%3AsweepAtoms&date=%3E%3D2017-01-06T11%3A57%3A23.000Z&date=%3C2017-07-06T11%3A57%3A23.000Z&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=platform&_columns=reason&_columns=address&_columns=install_time&_sort=-date&page=1#graphs

This is probably heap corruption / bad memory.

Comment 3

[Marcia Knous [:marcia]]

(In reply to Jon Coppeard (:jonco) from comment #2)
> This is a continuation of the JSRuntime::sweepAtoms crashes (the code was
> moved into GCRuntime::sweepAtomsTable in bug 1369444).
> 
> https://crash-stats.mozilla.com/signature/
> ?signature=JSRuntime%3A%3AsweepAtoms&date=%3E%3D2017-01-06T11%3A57%3A23.
> 000Z&date=%3C2017-07-06T11%3A57%3A23.
> 000Z&_columns=date&_columns=product&_columns=version&_columns=build_id&_colum
> ns=platform&_columns=reason&_columns=address&_columns=install_time&_sort=-
> date&page=1#graphs
> 
> This is probably heap corruption / bad memory.

Jon: From Triage team: Are there are any next steps here? Volume is not extremely high, but about 140 crashes in the last week.

Comment 4

[Jon Coppeard (:jonco)]

I don't think there's anything we can usefully do here.

Comment 5

[Naveed Ihsanullah [:naveed]]

Not actionable as stated. Likely bad memory.

Comment 6

[Wayne Mery (:wsmwk)]

Crash is effectively gone after version 62 - only two crashes of newer versions in past two months
bp- 543e56d8-b801-4743-bcdd-f87050201012 81.0.1
bp-5bedf3dc-2da2-44df-b4bd-7de640200930 81.0