1651708 - Crash in [@ JS::WeakCache<T>::sweep]

Status: NEW

(Core :: JavaScript: GC, defect, P5)

Description

[Sean Feng [:sefeng]]

This bug is for crash report bp-9f2544c2-4fe0-4a28-b7e9-d0bb10200708.

Top 10 frames of crashing thread:

0 xul.dll JS::WeakCache<JS::GCHashSet<js::ObjectGroupRealm::NewEntry, js::MovableCellHasher<ObjectGroupRealm::NewEntry>, js::SystemAllocPolicy> >::sweep js/public/GCHashTable.h:626
1 xul.dll IncrementalSweepWeakCache js/src/gc/GC.cpp:5728
2 xul.dll js::gc::ParallelWorker<js::gc::WeakCacheToSweep, js::gc::WeakCacheSweepIterator>::run js/src/gc/ParallelWork.h:55
3 xul.dll js::GCParallelTask::runTask js/src/gc/GCParallelTask.cpp:146
4 xul.dll js::gc::GCRuntime::joinTask js/src/gc/GC.cpp:5102
5 xul.dll js::gc::AutoRunParallelWork<ArenaListSegment, ArenasToUpdate>::~AutoRunParallelWork js/src/gc/ParallelWork.h:119
6 xul.dll js::gc::GCRuntime::sweepWeakCaches js/src/gc/GC.cpp:5791
7 xul.dll sweepaction::SweepActionSequence::run js/src/gc/GC.cpp:6003
8 xul.dll sweepaction::SweepActionForEach<js::gc::SweepGroupsIter, JSRuntime*>::run js/src/gc/GC.cpp:6038
9 xul.dll js::gc::GCRuntime::performSweepActions js/src/gc/GC.cpp:6170

Jon, can you please take a look to see if it's valid?

Comment 1

[Gabriele Svelto [:gsvelto] (PTO)]

The crash reasons and addresses for this signature are all over the place. Considering that this code scans large amounts of memory my guess is that this is mostly users with bad RAM. This is reinforced by the fact that none of the recent crashes come from machines with memory error correction (check the MemoryErrorCorrection annotation which can be shown in the reports tab by adding a column for memory error correction, you'll see that the reports show either None or are empty).

Comment 2

[Jon Coppeard (:jonco)]

Looks like bad hardware. Not actionable right now.