1664611 - Crash in [@ js::TraceAtoms]

Status: RESOLVED WORKSFORME

(Core :: JavaScript: GC, defect, P5)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Also observed 4x on 82.0a1 during the last week.

Crash report: https://crash-stats.mozilla.org/report/index/ea9cc7d5-522c-4612-86f4-0baeb0200912

Top 10 frames of crashing thread:

0 xul.dll js::TraceAtoms js/src/vm/JSAtom.cpp:432
1 xul.dll js::gc::GCRuntime::traceRuntimeAtoms js/src/gc/RootMarking.cpp:333
2 xul.dll js::gc::GCRuntime::traceRuntimeForMajorGC js/src/gc/RootMarking.cpp:269
3 xul.dll js::gc::GCRuntime::beginMarkPhase js/src/gc/GC.cpp:4165
4 xul.dll js::gc::GCRuntime::incrementalSlice js/src/gc/GC.cpp:6634
5 xul.dll js::gc::GCRuntime::gcCycle js/src/gc/GC.cpp:7113
6 xul.dll js::gc::GCRuntime::collect js/src/gc/GC.cpp:7347
7 xul.dll js::gc::GCRuntime::startGC js/src/gc/GC.cpp
8 xul.dll static nsJSContext::GarbageCollectNow dom/base/nsJSEnvironment.cpp:1188
9 xul.dll InterSliceGCRunnerFired dom/base/nsJSEnvironment.cpp:1742

Comment 1

[Jon Coppeard (:jonco)]

This is a low volume crash that has been happing for a long time. This assertion is failing in AtomsTable::tracePinnedAtomsInSet:

 	MOZ_DIAGNOSTIC_ASSERT(entry.asPtrUnbarriered())

I can't see anywhere atom entries can have their pointers set to null.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.

Comment 3

[BugBot (nomail) [:suhaib / :marco/ :calixte]]

Since the bug is closed, the stalled keyword is now meaningless.
For more information, please visit BugBot documentation.