1502452 - Crash in js::ReportMagicWordFailure

Status: RESOLVED DUPLICATE of bug 1112741

(Core :: JavaScript Engine: JIT, defect)

Description

[Julian Seward [:jseward]]

This bug was filed from the Socorro interface and is
report bp-600771f6-84c6-4cba-8e89-726030181025.
=============================================================

This is topcrash #4 in the Windows nightly 20181025100246,
with 10 crashes in 4 different installs.

Top 10 frames of crashing thread:

0 mozglue.dll MOZ_CrashPrintf mfbt/Assertions.cpp:67
1 xul.dll js::ReportMagicWordFailure js/src/vm/TypeInference.cpp:2886
2 xul.dll js::ConstraintTypeSet::sweep js/src/vm/TypeInference.cpp:4603
3 xul.dll JSScript::sweepTypes js/src/vm/TypeInference.cpp:4899
4 xul.dll js::gc::GCRuntime::sweepTypeInformation js/src/gc/GC.cpp:6335
5 xul.dll js::gc::IncrementalProgress sweepaction::SweepActionSequence<js::gc::GCRuntime*, js::FreeOp*, js::SliceBudget&, JS::Zone*>::run js/src/gc/GC.cpp:6746
6 xul.dll js::gc::IncrementalProgress sweepaction::SweepActionForEach<js::gc::SweepGroupZonesIter, JSRuntime*, js::gc::GCRuntime*, js::FreeOp*, js::SliceBudget&>::run js/src/gc/GC.cpp:6779
7 xul.dll js::gc::IncrementalProgress sweepaction::SweepActionSequence<js::gc::GCRuntime*, js::FreeOp*, js::SliceBudget&>::run js/src/gc/GC.cpp:6746
8 xul.dll js::gc::IncrementalProgress sweepaction::SweepActionRepeatFor<js::gc::SweepGroupsIter, JSRuntime*, js::gc::GCRuntime*, js::FreeOp*, js::SliceBudget&>::run js/src/gc/GC.cpp:6810
9 xul.dll js::gc::GCRuntime::performSweepActions js/src/gc/GC.cpp:6988

=============================================================

Comment 1

[Jan de Mooij [:jandem]]

Bitflip:

  Got 0xa1a2b3b4c5c6d3da expected magic word 0xa1a2b3b4c5c6d7da 

See bug 1112741 and related bugs. Marking this for JS crash triage.