1428743 - Crash in JS::PersistentRooted<T>::PersistentRooted

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect, P5)

Description

[Cervantes Yu [:cyu] [:cervantes]]

This bug was filed from the Socorro interface and is
report bp-b036c3f7-2778-4984-865d-434690180108.
=============================================================

Top 10 frames of crashing thread:

0 libc.so libc.so@0x4c0ad 
1 libxul.so JS::PersistentRooted<JSScript*>::PersistentRooted js/public/RootingAPI.h:1210
2 libxul.so js::InternalCallOrConstruct js/src/jscntxtinlines.h:291
3 libxul.so js::LookupNameWithGlobalDefault js/src/jsobj.cpp:2301
4 libxul.so js::GetEnvironmentName<js::GetNameMode::Normal> js/src/vm/Interpreter-inl.h:243
5 libxul.so js::TypeScript::MonitorAssign js/src/vm/TypeInference-inl.h
6 libxul.so <name omitted> js/src/vm/Interpreter.cpp:522
7 libxul.so Interpret js/src/vm/Interpreter.cpp:528
8 libxul.so js::jit::ICStubCompiler::getStubCode js/src/jit/SharedIC.cpp:512
9 libxul.so wcsrtombs 

=============================================================
6 crashes out of 4 installations on Android nightly build 20180105100135. The earliest build that has this crash is 20171204150510. About half of the crashes are SIGILL at a small address, and the others are SIGSEGV at 0x0.

Comment 1

[Cervantes Yu [:cyu] [:cervantes]]

Any ideas, Nicolas? Thanks.

Comment 2

[Nicolas B. Pierron [:nbp]]

I have no idea, these stacks make no sense, but this started to spike at the same time as Bug 1420742.
These sound like a stack corruption.

Comment 3

[Brian Hackett [Laid off!]]

I don't know what information I can provide here.  I don't know what's going on in bug 1420742 or whether it's related to this bug, and the stack here looks bogus.

Comment 4

[Jason Orendorff [:jorendorff]]

Unactionable. ->P5.

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.