1389575 - Crash in ShouldMark<T>

Status: RESOLVED DUPLICATE of bug 1275172

(Core :: JavaScript: GC, defect)

Description

[[:philipp]]

This bug was filed from the Socorro interface and is 
report bp-aabdba39-bce3-4116-8ce8-9ed9e0170811.
=============================================================
Crashing Thread (0)
Frame 	Module 	Signature 	Source
0 	xul.dll 	ShouldMark<JSScript* __ptr64> 	js/src/gc/Marking.cpp:775
1 	xul.dll 	DoMarking<JSScript>(js::GCMarker*, JSScript*) 	js/src/gc/Marking.cpp:804
2 	xul.dll 	JSFunction::trace(JSTracer*) 	js/src/jsfun.cpp:798
3 	xul.dll 	CallTraceHook<TraverseObjectFunctor, js::GCMarker* __ptr64 const, JSObject* __ptr64& __ptr64> 	js/src/gc/Marking.cpp:1545
4 	xul.dll 	js::GCMarker::processMarkStackTop(js::SliceBudget&) 	js/src/gc/Marking.cpp:1749
5 	xul.dll 	js::GCMarker::drainMarkStack(js::SliceBudget&) 	js/src/gc/Marking.cpp:1591
6 	xul.dll 	js::gc::GCRuntime::drainMarkStack(js::SliceBudget&, js::gcstats::PhaseKind) 	js/src/jsgc.cpp:5474
7 	xul.dll 	js::gc::GCRuntime::incrementalCollectSlice(js::SliceBudget&, JS::gcreason::Reason, js::AutoLockForExclusiveAccess&) 	js/src/jsgc.cpp:6612
8 	xul.dll 	js::gc::GCRuntime::gcCycle(bool, js::SliceBudget&, JS::gcreason::Reason) 	js/src/jsgc.cpp:6921
9 	xul.dll 	js::gc::GCRuntime::collect(bool, js::SliceBudget, JS::gcreason::Reason) 	js/src/jsgc.cpp:7070
10 	xul.dll 	js::gc::GCRuntime::gcSlice(JS::gcreason::Reason, __int64) 	js/src/jsgc.cpp:7156
11 	xul.dll 	nsJSContext::GarbageCollectNow(JS::gcreason::Reason, nsJSContext::IsIncremental, nsJSContext::IsShrinking, __int64) 	dom/base/nsJSEnvironment.cpp:1390
12 	xul.dll 	InterSliceGCRunnerFired(mozilla::TimeStamp, void*) 	dom/base/nsJSEnvironment.cpp:1983
13 	xul.dll 	CollectorRunner::Run() 	dom/base/nsJSEnvironment.cpp:260
14 	xul.dll 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp:1446
15 	xul.dll 	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp:97
16 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc:319
17 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc:299
18 	xul.dll 	nsBaseAppShell::Run() 	widget/nsBaseAppShell.cpp:156
19 	xul.dll 	nsAppShell::Run() 	widget/windows/nsAppShell.cpp:278
20 	xul.dll 	nsAppStartup::Run() 	toolkit/components/startup/nsAppStartup.cpp:287
21 	xul.dll 	XREMain::XRE_mainRun() 	toolkit/xre/nsAppRunner.cpp:4608
22 	xul.dll 	XREMain::XRE_main(int, char** const, mozilla::BootstrapConfig const&) 	toolkit/xre/nsAppRunner.cpp:4772
23 	xul.dll 	XRE_main(int, char** const, mozilla::BootstrapConfig const&) 	toolkit/xre/nsAppRunner.cpp:4867
24 	firefox.exe 	NS_internal_main(int, char**, char**) 	browser/app/nsBrowserApp.cpp:309
25 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:115
26 	firefox.exe 	__scrt_common_main_seh 	f:/dd/vctools/crt/vcstartup/src/startup/exe_common.inl:253
27 	kernel32.dll 	BaseThreadInitThunk 	
28 	ntdll.dll 	RtlUserThreadStart

this crash is newly showing up on windows and android in firefox 56, likely in relation to bug 1373214.

Comment 1

[Liz Henry (:lizzard) (privacy/fingerprinting team)]

jonco, if you want to take a look here, this may be related to bug 1373214.

Comment 2

[Jon Coppeard (:jonco)]

This is a continuation of bug 1275172 but with a new signature since the original function was renamed by bug 1373214.