1477545 - Crash in OOM | large | js::AutoEnterOOMUnsafeRegion::crash | js::AutoEnterOOMUnsafeRegion::crash | js::gc::AllocateCellInGC

Status: RESOLVED DUPLICATE of bug 1472062

(Core :: JavaScript: GC, defect)

Description

[Julian Seward [:jseward]]

This bug was filed from the Socorro interface and is
report bp-faf7fffe-ca43-4f98-849b-d81720180719.
=============================================================

This is topcrash #10 in the Windows nightly 20180719100142, with
5 crashes from 4 different installations.

Top 10 frames of crashing thread:

0 xul.dll js::AutoEnterOOMUnsafeRegion::crash js/src/vm/JSContext.cpp:1588
1 xul.dll js::AutoEnterOOMUnsafeRegion::crash js/src/vm/JSContext.cpp:1602
2 xul.dll js::gc::AllocateCellInGC js/src/gc/Allocator.cpp:360
3 xul.dll js::TenuringTracer::moveToTenuredSlow js/src/gc/Marking.cpp:2941
4 xul.dll js::TenuringTracer::traverse<JSObject> js/src/gc/Marking.cpp:2646
5 xul.dll union JS::Value js::DispatchTyped<js::TenuringTraversalFunctor<JS::Value>, js::TenuringTracer*> js/public/Value.h:1438
6 xul.dll js::gc::StoreBuffer::MonoTypeBuffer<js::gc::StoreBuffer::ValueEdge>::trace js/src/gc/Marking.cpp:2687
7 xul.dll js::Nursery::doCollection js/src/gc/Nursery.cpp:874
8 xul.dll js::Nursery::collect js/src/gc/Nursery.cpp:739
9 xul.dll js::gc::GCRuntime::minorGC js/src/gc/GC.cpp:7891

=============================================================

Comment 1

[Paul Bone [:pbone]]

This is a duplicate of Bug 1472062?.  The GC is unable to allocate a new chunk for the tenured heap while it's trying to collect the nursery.