1649486 - Crash in [@ js::detail::OrderedHashTable<T>::~OrderedHashTable]

Status: RESOLVED WORKSFORME

(Core :: JavaScript: GC, defect, P5)

Description

[Alex Chronopoulos [:achronop]]

This bug is for crash report bp-ff81c1fc-a04c-4b05-a631-da0500200628.

Top 10 frames of crashing thread:

0 XUL js::detail::OrderedHashTable<js::OrderedHashMap<js::HashableValue, js::HeapPtr<JS::Value>, js::HashableValue::Hasher, js::ZoneAllocPolicy>::Entry, js::OrderedHashMap<js::HashableValue, js::HeapPtr<JS::Value>, js::HashableValue::Hasher, js::ZoneAllocPolicy>::MapOps, js::ZoneAllocPolicy>::~OrderedHashTable js/src/ds/OrderedHashTable.h:147
1 XUL js::MapObject::finalize js/src/builtin/MapObject.cpp:655
2 XUL js::Nursery::sweepMapAndSetObjects js/src/gc/Nursery.cpp:1721
3 XUL js::Nursery::doCollection js/src/gc/Nursery.cpp:1359
4 XUL js::Nursery::collect js/src/gc/Nursery.cpp:1005
5 XUL js::gc::GCRuntime::collectNursery js/src/gc/GC.cpp:7575
6 XUL js::gc::GCRuntime::minorGC js/src/gc/GC.cpp:7549
7 XUL mozilla::CycleCollectedJSContext::IsIdleGCTaskNeeded xpcom/base/CycleCollectedJSContext.cpp:501
8 XUL nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1234
9 XUL mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:87

Maybe a JS person can come up with an explanation about those crashes.

Comment 1

[Jon Coppeard (:jonco) (PTO until 5th Jan)]

They look like heap corruption / bad memory crashes.

Comment 2

[Andrew McCreight [:mccr8]]

It looked like a lot of these crashes are during nursery collections, which I feel like is usual for GC crashes. But I could be wrong.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.