1577303 - Crash in [@ js::TenuringTracer::moveToTenured]

Status: RESOLVED WONTFIX

(Core :: JavaScript: GC, defect, P5)

Description

[Worcester12345]

This bug is for crash report bp-92ad9d55-d6c4-416c-9a7a-f6f720190828.

Top 10 frames of crashing thread:

0 xul.dll js::TenuringTracer::moveToTenured js/src/gc/Marking.cpp:3087
1 xul.dll class mozilla::Maybe<JS::Value> js::MapGCThingTyped<`lambda at z:/task_1563378307/build/src/js/src/gc/Marking.cpp:2652:43'> js/public/Value.h:1318
2 xul.dll js::TenuringTracer::traceObject js/src/gc/Marking.cpp:2830
3 xul.dll js::Nursery::collectToFixedPoint js/src/gc/Marking.cpp:3105
4 xul.dll js::Nursery::doCollection js/src/gc/Nursery.cpp:972
5 xul.dll js::Nursery::collect js/src/gc/Nursery.cpp:786
6 xul.dll js::gc::GCRuntime::minorGC js/src/gc/GC.cpp:7873
7 xul.dll js::gc::GCRuntime::gcCycle js/src/gc/GC.cpp:7448
8 xul.dll js::gc::GCRuntime::collect js/src/gc/GC.cpp:7654
9 xul.dll js::gc::GCRuntime::startGC js/src/gc/GC.cpp

Comment 2

[[:philipp]]

geckoview is not the right home for this bug.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

The priority flag is not set for this bug.
:jonco, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 4

[Jon Coppeard (:jonco)]

This does seem to have picked up in 67.

Comment 5

[Jon Coppeard (:jonco)]

The TenuringTracer::moveToTenured method is for JSStrings only so this is potentially related to allocating strings in the nursery, which landed in 67. However the more generic signature associated with crashes while tenuring (bug 1582214) is much higher, so this doesn't necessarily indicate a bug in string tenuring.

I'm going to needinfo sfink for a cursory look, but I suspect there's nothing we can do here.

Comment 6

[Worcester12345]

(In reply to Jon Coppeard (:jonco) (PTO until 4th Jan) from comment #5)
... there's nothing we can do here.