1643367 - Crash in [@ js::jit::ValueNumberer::visitBlock]

Status: RESOLVED DUPLICATE of bug 1643369

(Core :: JavaScript Engine: JIT, defect, P5)

Description

[Pascal Chevrel:pascalc]

This bug is for crash report bp-9d8bfec9-0a3d-42e1-9090-ef3570200604.

Top 10 frames of crashing thread:

0 xul.dll js::jit::ValueNumberer::visitBlock js/src/jit/ValueNumbering.cpp:1016
1 xul.dll js::jit::ValueNumberer::run js/src/jit/ValueNumbering.cpp:1279
2 xul.dll js::jit::OptimizeMIR js/src/jit/Ion.cpp:1076
3 xul.dll js::jit::CompileBackEnd js/src/jit/Ion.cpp:1438
4 xul.dll js::jit::IonCompileTask::runTask js/src/jit/IonCompileTask.cpp:27
5 xul.dll js::HelperThread::handleIonWorkload js/src/vm/HelperThreads.cpp:2147
6 xul.dll static js::HelperThread::ThreadMain js/src/vm/HelperThreads.cpp:2050
7 xul.dll static js::detail::ThreadTrampoline<void  js/src/threading/Thread.h:206
8 ucrtbase.dll thread_start<unsigned int , 1> 
9 kernel32.dll BaseThreadInitThunk 

This crash is trending up on 77.0.1 which shipped yesterday.

Comment 1

[Nicolas B. Pierron [:nbp]]

Among crashes which have a crash-reason set to EXCEPTION_ACCESS_VIOLATION_READ, 36% have the address -1.
Looking at the location of the error does not hint anything actionable from my point of view.

A few crashes would hint at Bug 1263794, but I not sure this is the case of all crashes detected here, even if it has been in the past.

Based on the low number of crashes, I would suggest to mark it as P5.
If someone find a reproducible test case, feel free to ask us to re-triage this bug.

Comment 2

[Nicolas B. Pierron [:nbp]]

The spike matches Bug 1643369, marking it as a duplicate.