1475821 - Crash in void js::GCMarker::traverse<T>

Status: NEW

(Core :: JavaScript: GC, defect, P4)

Description

[Julian Seward [:jseward]]

This bug was filed from the Socorro interface and is
report bp-ec67c033-f6ed-4eda-aca9-6e7ec0180715.
=============================================================

This is topcrash #21 in the Windows nightly 20180712100120.  That's quite
a long way down the ranking, but it occurred 4 times in 4 different 
installations, with good stacks all times.

Top 10 frames of crashing thread:

0 xul.dll void js::GCMarker::traverse<JSString*> js/src/gc/Marking.cpp:798
1 xul.dll js::GCMarker::processMarkStackTop js/src/gc/Marking.cpp:1685
2 xul.dll js::GCMarker::drainMarkStack js/src/gc/Marking.cpp:1545
3 xul.dll js::gc::GCRuntime::markGrayReferences<js::gc::SweepGroupZonesIter, js::CompartmentsOrRealmsIterT<js::gc::SweepGroupZonesIter, js::CompartmentsInZoneIter> > js/src/gc/GC.cpp:4577
4 xul.dll js::gc::GCRuntime::endMarkingSweepGroup js/src/gc/GC.cpp:5355
5 xul.dll js::gc::IncrementalProgress sweepaction::SweepActionSequence<js::gc::GCRuntime*, js::FreeOp*, js::SliceBudget&>::run js/src/gc/GC.cpp:6359
6 xul.dll js::gc::IncrementalProgress sweepaction::SweepActionRepeatFor<js::gc::SweepGroupsIter, JSRuntime*, js::gc::GCRuntime*, js::FreeOp*, js::SliceBudget&>::run js/src/gc/GC.cpp:6420
7 xul.dll js::gc::GCRuntime::performSweepActions js/src/gc/GC.cpp:6588
8 xul.dll js::gc::GCRuntime::incrementalCollectSlice js/src/gc/GC.cpp:7175
9 xul.dll js::gc::GCRuntime::gcCycle js/src/gc/GC.cpp:7505

=============================================================

Comment 2

[Jon Coppeard (:jonco)]

This is another ongoing crash.

Comment 3

[Paul Bone [:pbone]]

P4 because it's likely that there's nothing we can do (not P5 because that says we don't want to do anything).

Comment 4

[Jon Coppeard (:jonco)]

Infrequent GC crashes such as this are not a high impact issue.