1798860 - Crash in [@ js::jit::NewObjectIRGenerator::tryAttachPlainObject]

Status: RESOLVED WONTFIX

(Core :: JavaScript Engine: JIT, defect, P5)

Description

[Freaked Enough]

Crash report: https://crash-stats.mozilla.org/report/index/8070e2ad-8809-4ba1-ada6-a56dd0221103

Reason: EXCEPTION_ACCESS_VIOLATION_READTop 4 frames of crashing thread:

0  xul.dll  js::jit::NewObjectIRGenerator::tryAttachPlainObject  js/src/jit/CacheIR.cpp:12126
1  xul.dll  js::jit::DoNewObjectFallback  js/src/jit/BaselineIC.cpp:2402
2  ?  @0x000003758a1e7ec0  
3  xul.dll  _tailMerge_d3dcompiler_47.dll  

tab crashed while swyping trough pictures on https://www.willhaben.at/iad/kaufen-und-verkaufen/d/steckkarten-computer-pc-elektronischen-bauelementen-leiterplatte-604134324/

Comment 1

[BugBot [:suhaib / :marco]]

The Bugbug bot thinks this bug should belong to the 'Core::JavaScript Engine: JIT' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[BugBot [:suhaib / :marco]]

The bug has a crash signature, thus the bug will be considered confirmed.

Comment 3

[Iain Ireland [:iain]]

Thanks for the report.

Looking at the crash dump, this crashed on this line of code. Specifically, it crashed trying to read the capacity from the slots header, but the slots pointer in the object is 0. This should never happen; if an object doesn't have any dynamic slots, the slots pointer will point to the statically allocated emptyObjectSlots.

There don't appear to be a lot of crashes with this signature. In the last week, I see this one, and six that all share the same install time and build id That generally implies that somebody's binary is corrupted and is repeatedly crashing. It also looks like those crashes happened on a different line, making it even less likely that this is the same problem.

So it doesn't look like there's a consistent pattern of crashes here. Given that the object was in an impossible state, and that this has only occurred once, the most likely explanation is some sort of hardware failure or cosmic ray flipping a bit. You could consider running a memory test to see if your RAM is flaky, but other than that, it doesn't look like there's anything to be done here (unless we suddenly see an uptick in crashes).

Comment 4

[Freaked Enough]

Attachment: memtest

Thank you for your analysis. Unfortunately, memtesters never come up with any errors, yet I run quite often into EXCEPTION_ACCESS_VIOLATION_READ errors on this device, especially when using Linux. I will accept my fate and assume that the device has an issue.

Comment 5

[Freaked Enough]

I will close my ticket

Comment 6

[BugBot (nomail) [:suhaib / :marco/ :calixte]]

Since the bug is closed, the stalled keyword is now meaningless.
For more information, please visit auto_nag documentation.