1584799 - Crash in [@ js::jit::CodeGenerator::link]

Status: NEW

(Core :: JavaScript Engine: JIT, defect, P3)

Description

[Julian Seward [:jseward]]

This bug is for crash report bp-36f50a91-490b-4470-8935-406ea0190926.

I think this happened in two separate installations of the Windows nightly 20190926094200. I noticed both cases are for
CPU Info family 6 model 58 stepping 9
CPU Count 8

Top 5 frames of crashing thread:

0 xul.dll js::jit::CodeGenerator::link js/src/jit/CodeGenerator.cpp:10866
1 xul.dll js::jit::LinkIonScript js/src/jit/Ion.cpp:511
2 xul.dll js::jit::LazyLinkTopActivation js/src/jit/Ion.cpp:530
3  @0x13c73f1dfe 
4 xul.dll js::CloneFunctionReuseScript js/src/vm/JSFunction.cpp:2283

Comment 1

[Jan de Mooij [:jandem]]

Sorry, no idea what's going on :/ I don't think there have been any changes to this code recently. The uptime of 0 seconds in that crash report is a bit suspicious too, makes me wonder about their hardware.

Comment 2

[Nicolas B. Pierron [:nbp]]

Looking at the crash addresses, these are crashing with a lot of different addresses poison, which do not seems to have a common allocator.
I doubt this bug could be actionable in its current form.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Since the crash volume is low (less than 5 per week), the severity is downgraded to S3. Feel free to change it back if you think the bug is still critical.

For more information, please visit auto_nag documentation.