1601657 - Crash in [@ js::PreliminaryObjectArray::registerNewObject]

Status: RESOLVED DUPLICATE of bug 1601074

(Core :: JavaScript Engine, defect, P2)

Description

[Marcia Knous [:marcia]]

This bug is for crash report bp-8890788c-0ff1-48c7-b90d-ead8a0191203.

Seen while looking at nightly crash stats, started on macOS running 20191203094830: https://bit.ly/33Y9Ur6. Although there are crashes on other branches, it appears there is a small spike on nightly which started with the 12-3 build. Bugs in that changeset: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=b8f3a97900e5148daed8c0aae87243b8ef4a2c31&tochange=3c08edf74d039af79f9daad8ff5b57ffb64fdab6

One comment "This crash happened while I was trying to load the page with WebReplay enabled"

Only URLS are https://slashdot.org/ and Gmail.

Top 10 frames of crashing thread:

0 XUL js::PreliminaryObjectArray::registerNewObject js/src/vm/TypeInference.cpp:3494
1 XUL js::NewObjectOperation js/src/vm/Interpreter.cpp:5266
2 XUL Interpret js/src/vm/Interpreter.cpp:3801
3 XUL js::RunScript js/src/vm/Interpreter.cpp:424
4 XUL js::ExecuteKernel js/src/vm/Interpreter.cpp:811
5 XUL js::Execute js/src/vm/Interpreter.cpp:844
6 XUL ExecuteScript js/src/vm/CompilationAndEvaluation.cpp:473
7 XUL mozilla::dom::ExecuteCompiledScript dom/script/ScriptLoader.cpp:2622
8 XUL mozilla::dom::ScriptLoader::EvaluateScript dom/script/ScriptLoader.cpp:2846
9 XUL mozilla::dom::ScriptLoader::ProcessRequest dom/script/ScriptLoader.cpp:2321

Comment 1

[Jason Orendorff [:jorendorff]]

Jan, is there anything useful in these crash reports?

7 out of 10 of these crash reports have "record replay" = true.

Comment 2

[Jan de Mooij [:jandem]]

The fuzzers found this too, bug 1601074.