1694055 - Crash in [@ IPCError-browser | ShutDownKill | js::frontend::ScopeContext::init]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P3)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

17 crashes for 17 installations with 87.0a1 (all on Windows), oldest reported build ID is 20210208214800.

DelazifyCanonicalScriptedFunctionImpl got modified by bug 1690530 in that Nightly.

Crash report: https://crash-stats.mozilla.org/report/index/9c6db9b2-75b4-4bc7-8c67-0ca850210211

Reason: EXCEPTION_BREAKPOINT

Top 10 frames of crashing thread:

0 xul.dll js::frontend::ScopeContext::init js/src/frontend/Stencil.cpp:77
1 xul.dll js::frontend::CompileLazyFunctionToStencil js/src/frontend/BytecodeCompiler.cpp:1086
2 xul.dll DelazifyCanonicalScriptedFunctionImpl<mozilla::Utf8Unit> js/src/vm/JSFunction.cpp:1550
3 xul.dll static JSFunction::delazifyLazilyInterpretedFunction js/src/vm/JSFunction.cpp:1624
4 xul.dll static JSFunction::delazifyLazilyInterpretedFunction js/src/vm/JSFunction.cpp:1625
5 xul.dll js::InternalCallOrConstruct js/src/vm/Interpreter.cpp:537
6 xul.dll js::NativeGetProperty js/src/vm/NativeObject.cpp:2316
7 xul.dll Interpret js/src/vm/Interpreter.cpp:2933
8 xul.dll js::InternalCallOrConstruct js/src/vm/Interpreter.cpp:551
9 xul.dll js::jit::DoCallFallback js/src/jit/BaselineIC.cpp:1841

Comment 1

[Tooru Fujisawa [:arai]]

most crash reports are inside the range that bug 1690277 patch has been in tree
(it's landed, and then backed out after central merge),
and the crash happens inside the code that bug 1690277 patch added.

20210216094005 (1 report): not affected
20210211092822 (5 reports): has bug 1690277 patch
20210210215051 (5 reports): has bug 1690277 patch
20210210094937 (5 reports): has bug 1690277 patch
20210208214800 (1 report): not affected

So, only 2 reports are crash in the code that's still in tree.

Comment 2

[Steven DeTar [:sdetar]]

Removing priority so that we re-triage

Comment 3

[Matthew Gaudet (he/him) [:mgaudet]]

(It seems possible this is already fixed; Arai, I'll let you make the call on if you want to close this)

Comment 4

[Tooru Fujisawa [:arai]]

Yes, this is fixed by backout of bug 1690277.

Comment 5

[Tooru Fujisawa [:arai]]

the regressing patch is landed to 87, and also backout is landed to 87