1582214 - Crash in [@ js::TenuringTracer::traverse<T>]

Status: NEW

(Core :: JavaScript: GC, defect, P5)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

We got a user on IRC today who has frequent content crashes on random sites

This bug is for crash report bp-a7792914-89f2-4f93-89bd-25dc70190917.

Other reports are
bp-4a175e89-e98d-4cf9-aa4f-8899f0190918
bp-d80c9e5b-c0f3-4c68-9196-b9fb70190917
bp-d2b1a408-f3bc-4396-a00b-f203d0190913

At least js::TenuringTracer::traverse<T> is new in 69 (it existed up to 64 but not for 65-67) and bug 1376646 touched code in that area. Yoshi, can you look if it's from that bug, please?

Top 10 frames of crashing thread:

0 xul.dll js::TenuringTracer::traverse<JSObject> js/src/gc/Marking.cpp:2759
1 xul.dll class mozilla::Maybe<JS::Value> js::MapGCThingTyped<`lambda at z:/task_1566864336/build/src/js/src/gc/Marking.cpp:2780:43'> js/public/Value.h:1311
2 xul.dll js::TenuringTracer::traceObject js/src/gc/Marking.cpp:2965
3 xul.dll js::Nursery::collectToFixedPoint js/src/gc/Marking.cpp:3249
4 xul.dll js::Nursery::doCollection js/src/gc/Nursery.cpp:963
5 xul.dll js::Nursery::collect js/src/gc/Nursery.cpp:839
6 xul.dll js::gc::GCRuntime::minorGC js/src/gc/GC.cpp:8085
7 xul.dll nsresult mozilla::CycleCollectedJSContext::IsIdleGCTaskNeeded::IdleTimeGCTaskRunnable::Run xpcom/base/CycleCollectedJSContext.cpp:523
8 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1225
9 xul.dll NS_ProcessNextEvent xpcom/threads/nsThreadUtils.cpp:486

Comment 1

[Marcia Knous [:marcia]]

Discussed during triage. Marking as fix optional for 69. Some of these signatures are high volume in beta.

Comment 2

[Jon Coppeard (:jonco)]

(In reply to Sebastian Hengst [:aryx] (needinfo on intermittent or backout) from comment #0)
It's interesting that the user is seeing all these different crash signatures. This suggests to me a problem with the user's machine rather than in the code.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

The priority flag is not set for this bug.
:jonco, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 4

[Steven DeTar [:sdetar]]

This not really actionable at this time, so I making it an S3.