1685227 - Crash in [@ IPCError-browser | ShutDownKill | js::CallObject::createTemplateObject]

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect, P5)

Description

[alex_mayorga]

Crash report: https://crash-stats.mozilla.org/report/index/97b81489-c2d2-4354-a726-46dea0201216

Reason: EXCEPTION_BREAKPOINT

Top 5 frames of crashing thread:

0  @0x280fe8572d4 
1 xul.dll static js::CallObject::createTemplateObject js/src/vm/EnvironmentObject.cpp:168
2 xul.dll static js::CallObject::create js/src/vm/EnvironmentObject.cpp:219
3  @0x2325caac174 
4 xul.dll trunc 

A few more reports over at https://crash-stats.mozilla.org/signature/?product=Firefox&signature=IPCError-browser%20%7C%20ShutDownKill%20%7C%20js%3A%3ACallObject%3A%3AcreateTemplateObject&date=%3E%3D2020-12-06T03%3A22%3A00.000Z&date=%3C2021-01-06T03%3A22%3A00.000Z

Comment 1

[Andrew McCreight [:mccr8]]

I don't know if this is actionable.

Comment 2

[Iain Ireland [:iain]]

Took a look at the minidumps. In three of the five cases we crash at the same instruction, which I think I have identified as this line in CreateEnvironmentObject. Specifically, we crash trying to read the number of fixed slots out of the shape's immutable flags. I think this implies that the shape pointer itself is invalid, and this is the first time we try to access it.

The shape comes from here. It looks to me like everything is rooted and traced properly, so ... random bitflips, maybe? Looking at the stack dump, though, the shape pointer is not obviously bogus.

I don't see anything immediately actionable here.

Comment 3

[BugBot [:suhaib / :marco]]

Closing because no crashes reported for 12 weeks.