1429552 - Crash in bool FinalizeTypedArenas<T>

Status: RESOLVED DUPLICATE of bug 1400641

(Core :: JavaScript: GC, defect, P5)

Description

[Emma Mason]

This bug was filed from the Socorro interface and is
report bp-ab14e37e-a2ab-4491-9750-407510180110.
=============================================================

Top 10 frames of crashing thread:

0  @0x100000000 
1 libxul.so bool FinalizeTypedArenas<JSObject> 
2 libxul.so FinalizeArenas 
3 libxul.so js::gc::ArenaLists::backgroundFinalize js/src/jsgc.cpp:3015
4 libxul.so js::gc::GCRuntime::sweepBackgroundThings 
5 libxul.so js::GCHelperState::doSweep js/src/jsgc.cpp:3603
6 libxul.so js::GCHelperState::work 
7 libxul.so js::HelperThread::handleGCHelperWorkload js/src/vm/HelperThreads.cpp:2170
8 libxul.so js::HelperThread::threadLoop 
9 libxul.so js::detail::ThreadTrampoline<void , js::HelperThread*>::Start js/src/threading/Thread.h:234

=============================================================

Comment 1

[Jon Coppeard (:jonco)]

This is mostlly showing up in ESR releases, starting perhaps in 52.5 although possibly earlier.

Comment 2

[Jason Orendorff [:jorendorff]]

Introduced December 27, apparently? Lowish volume, hardly actionable. -> P5.