1584814 - Crash in [@ JSRope::flattenInternal<T>]

Status: RESOLVED DUPLICATE of bug 1584820

(Core :: JavaScript Engine, defect)

Description

[Pascal Chevrel:pascalc]

This bug is for crash report bp-1eb601c4-e63f-4cbe-9b53-1e3d60190928.

Top 10 frames of crashing thread:

0 xul.dll class JSFlatString* JSRope::flattenInternal<JSRope::NoBarrier, unsigned char> js/src/vm/StringType.cpp:670
1 xul.dll JSRope::flatten js/src/vm/StringType.cpp:859
2 xul.dll static bool Quote js/src/builtin/JSON.cpp:156
3 xul.dll static bool Str js/src/builtin/JSON.cpp:657
4 xul.dll static bool Str js/src/builtin/JSON.cpp:708
5 xul.dll static bool Str js/src/builtin/JSON.cpp:708
6 xul.dll js::Stringify js/src/builtin/JSON.cpp:879
7 xul.dll static bool json_stringify js/src/builtin/JSON.cpp:1079
8 xul.dll js::InternalCallOrConstruct js/src/vm/Interpreter.cpp:551
9 xul.dll static bool Interpret js/src/vm/Interpreter.cpp:3113

This signature exploded over the week end on Nightly (from a couple of crashes per week to hundreds in yesterday's build), marking as a blocker.

Comment 1

[Ted Campbell [:tcampbell]]

Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=aa8f530a1a35&tochange=d23a0a0ffa93

Comment 2

[Ted Campbell [:tcampbell]]

Iain, might this be related to the XDR atoms work in Bug 1575370? Some sort of missing GC marks perhaps.

Comment 3

[Iain Ireland [:iain]]

I think this might be the same issue as bug 1584820.

Comment 4

[Pascal Chevrel:pascalc]

Crashes stopped after the revert in bug 1584820 so I am duping it to this bug.

Comment 5

[Emma Humphries ☕️🎸🧞‍♀️✨ (she/they) [:emceeaich] (Pacific Time) use needinfo]

This bug has been identified as part of a pilot on determining root causes of blocking and dot release drivers.

It needs a root-cause set for it. Please see the list at https://docs.google.com/document/d/1FFEGsmoU8T0N8R9kk-MXWptOPtXXXRRIe4vQo3_HgMw/.

Add the root cause as a whiteboard tag in the form [rca - <cause> ] and remove the rca-needed keyword.

If you have questions, please contact :tmaity.

Comment 6

[Ted Campbell [:tcampbell]]

Iain, probably makes sense for you to do the RCA here. We can talk it over next week if there are questions.