1710881 - Crash in [@ js::frontend::GeneralParser<T>::functionStmt]

Status: RESOLVED DUPLICATE of bug 1707979

(Core :: JavaScript Engine, defect)

Description

[Chris Peterson [:cpeterson]]

Parent process crash. Potential Startup Crash, 52 out of 77 crashes happened during startup. Even though some of the crash reports had Fission enabled, this is not a Fission bug because it is seen in 88 Release and ESR 78, where Fission is not available.

This crash is likely related to functionExpr crash bug 1710476 and statementListItem crash bug 1707979.

Crash report: https://crash-stats.mozilla.org/report/index/0a048d7e-3fc3-4910-a1ed-be6160210511

Reason: EXC_BAD_ACCESS / KERN_INVALID_ADDRESS

Top 10 frames of crashing thread:

0 XUL js::frontend::GeneralParser<js::frontend::FullParseHandler, mozilla::Utf8Unit>::functionStmt js/src/frontend/Parser.cpp:3633
1 XUL js::frontend::GeneralParser<js::frontend::FullParseHandler, mozilla::Utf8Unit>::statementListItem js/src/frontend/Parser.cpp:8883
2 XUL js::frontend::GeneralParser<js::frontend::FullParseHandler, mozilla::Utf8Unit>::functionBody js/src/frontend/Parser.cpp:2239
3 XUL js::frontend::Parser<js::frontend::FullParseHandler, mozilla::Utf8Unit>::standaloneLazyFunction js/src/frontend/Parser.cpp:3326
4 XUL js::frontend::CompileLazyFunction js/src/frontend/BytecodeCompiler.cpp:1115
5 XUL JSFunction::delazifyLazilyInterpretedFunction js/src/vm/JSFunction.cpp:1609
6 XUL JSFunction::getOrCreateScript js/src/vm/JSFunction.h:406
7 XUL JSFunction::delazifyLazilyInterpretedFunction js/src/vm/JSFunction.cpp:1597
8 XUL Interpret js/src/vm/Interpreter.cpp:3257
9 XUL js::InternalCallOrConstruct js/src/vm/Interpreter.cpp:552