1463972 - Crash in js::ObjectGroup::traceChildren

Status: RESOLVED WORKSFORME

(Core :: JavaScript: GC, defect, P5)

Description

[(inactive) Jim Chen [:jchen] [:darchons]]

This bug was filed from the Socorro interface and is
report bp-35c3e9cb-9f42-4517-b61e-7f32a0180523.
=============================================================

Top 10 frames of crashing thread:

0 xul.dll js::ObjectGroup::traceChildren js/src/gc/Marking.cpp:1488
1 xul.dll js::gc::TraceCycleCollectorChildren js/src/gc/Tracer.cpp:279
2 xul.dll TraversalTracer::onChild xpcom/base/CycleCollectedJSRuntime.cpp:445
3 xul.dll JS::CallbackTracer::onObjectGroupEdge js/public/TracingAPI.h:159
4 xul.dll DoCallback<js::ObjectGroup*> js/src/gc/Tracer.cpp:48
5 xul.dll DispatchToTracer<js::ObjectGroup*> js/src/gc/Marking.cpp:691
6 xul.dll js::NativeIterator::trace js/src/vm/Iteration.cpp:65
7 xul.dll js::PropertyIteratorObject::trace js/src/vm/Iteration.cpp:1037
8 xul.dll JSObject::traceChildren js/src/vm/JSObject.cpp:4005
9 xul.dll JS::DispatchTraceKindTyped<TraceChildrenFunctor, JSTracer*&, void*&> js/public/TraceKind.h:201

=============================================================

Seems to have been a spike around Nightly build 20180519100118. May be related to the spike in bug 1112741?

Comment 1

[Jeff Walden [:Waldo]]

I'm pretty sure this is a duplicate of bug 1462939.  It may be the case that some of the spike in bug 1112741 is due to that bug, as well.  But anything crashing not too far beneath NativeIterator::trace is very likely to be bug 1462939, generally.

Comment 2

[Jon Coppeard (:jonco)]

ObjectGroup has been removed in bug 1689413.