1474214 - Crash in js::jit::AutoWritableJitCode::~AutoWritableJitCode

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine: JIT, defect, P3)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

This bug was filed from the Socorro interface and is
report bp-2805a910-9eca-464f-ade2-090670180708.
=============================================================

Top 1 frames of crashing thread:

0 xul.dll js::jit::AutoWritableJitCode::~AutoWritableJitCode js/src/jit/SharedIC.cpp:2371

=============================================================

When I opened a pinned mana.mozilla.org tab, Nightly 63.0a1 20180708100828 (32 bit) on Windows 8.1 said the tab had crashed. The system had encountered a low memory situation hours before (that Nightly session was still running at that time).

Crash stats shows this almost only affects Windows 8.1, mostly 32-bit and most of the crashes are either in the first minute after Nightly startup (foreground tab?) or >1h after startup (background tab?)

Comment 1

[Nicolas B. Pierron [:nbp]]

My guess would be that we failed to protect the pages and map them as executable. [1]

However I do not know what would have caused this issue, except if we have a lot of different memory protection flags for a lot of pages.

[1] https://searchfox.org/mozilla-central/rev/a80651653faa78fa4dfbd238d099c2aad1cec304/js/src/jit/JitRealm.h#671

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.