1765469 - Crash in [@ OOM | large | js::AutoEnterOOMUnsafeRegion::crash | js::AutoEnterOOMUnsafeRegion::crash | js::TenuringTracer::collectToObjectFixedPoint]

Status: RESOLVED DUPLICATE of bug 1472062

(Core :: JavaScript: GC, defect)

Description

[Worcester12345]

Maybe Fission related. (DOMFissionEnabled=1)

Crash report: https://crash-stats.mozilla.org/report/index/fa98950e-2949-4cec-ad68-0dc890220309

MOZ_CRASH Reason: [unhandlable oom] Failed to allocate new chunk during GC

Top 10 frames of crashing thread:

0 xul.dll js::AutoEnterOOMUnsafeRegion::crash js/src/vm/JSContext.cpp:1234
1 xul.dll js::AutoEnterOOMUnsafeRegion::crash js/src/vm/JSContext.cpp:1250
2 xul.dll js::TenuringTracer::collectToObjectFixedPoint js/src/gc/Tenuring.cpp:857
3 xul.dll js::Nursery::collect js/src/gc/Nursery.cpp:1108
4 xul.dll js::gc::GCRuntime::collectNursery js/src/gc/GC.cpp:4092
5 xul.dll js::gc::GCRuntime::minorGC js/src/gc/GC.cpp:4058
6 xul.dll mozilla::CycleCollectedJSContext::IsIdleGCTaskNeeded::IdleTimeGCTaskRunnable::Run xpcom/base/CycleCollectedJSContext.cpp:507
7 xul.dll mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal xpcom/threads/TaskController.cpp:771
8 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1195
9 xul.dll mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:85

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::JavaScript: GC' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The bug has a crash signature, thus the bug will be considered confirmed.

Comment 3

[Jon Coppeard (:jonco)]

OOM collecting the nursery.