Crash in [@ mozilla::detail::MutexImpl::lock | mozilla::ipc::MessageChannel::DispatchMessage]
Categories
(Core :: JavaScript: GC, defect)
Tracking
()
| Tracking | Status | |
|---|---|---|
| firefox-esr78 | --- | unaffected |
| firefox89 | --- | affected |
| firefox90 | --- | affected |
| firefox91 | --- | affected |
People
(Reporter: aryx, Unassigned)
Details
(Keywords: crash)
Crash Data
250 affected installations for each release of the Gecko 88 branch, 50 for 89.0 so far. Older macOS versions are overrepresented, only ~20% are for macOS 11
Crash report: https://crash-stats.mozilla.org/report/index/a93afa2b-bdb7-4db6-bf3a-269880210610
Reason: EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
Top 10 frames of crashing thread:
0 XUL bool js::gc::TraceEdgeInternal<JSString*> js/src/gc/Marking.cpp:763
1 XUL fun_trace js/src/vm/JSFunction.cpp:795
2 XUL js::GCMarker::processMarkStackTop js/src/gc/Marking.cpp:1963
3 XUL js::GCMarker::traceBarrieredCells js/src/gc/Marking.cpp:4201
4 XUL js::GCMarker::markUntilBudgetExhausted js/src/gc/Marking.cpp:1756
5 XUL js::gc::GCRuntime::markUntilBudgetExhausted js/src/gc/GC.cpp:5895
6 XUL js::gc::GCRuntime::incrementalSlice js/src/gc/GC.cpp:7021
7 XUL DOMGCSliceCallback dom/base/nsJSEnvironment.cpp:2018
8 libmozglue.dylib free memory/build/malloc_decls.h:54
9 libmozglue.dylib moz_arena_malloc memory/build/malloc_decls.h:133
|
||
Comment 1•5 years ago
|
||
I don't know why this stack has MutexImpl::Lock in it. Frames 7 to 14 looks like they left over from execution of GCRuntime::gcCycle but are not current. This has happened in a few crashes recently and I assume it's some kind of bug / limitation of how we collect stack traces.
Since this is the case, grouping crashes by the presence of MutexImpl::lock is not that helpful and pulls in lots of unrelated stacks.
The stacks involving GC marking are just our ongoing random crashes, in this base bug 1474623.
Description
•