1842861 - Crash in [@ js::ObjectSlots::isSharedEmptySlots]

Status: RESOLVED DUPLICATE of bug 787879

(Core :: JavaScript Engine, defect)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Crash new in Firefox 115, 115 crashes from 115 installations of Firefox 115 or 115.0.1 so far in the database.

Crash report: https://crash-stats.mozilla.org/report/index/8aec8804-b638-48f9-a4fa-6030f0230711

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0  xul.dll  js::ObjectSlots::isSharedEmptySlots const  js/src/vm/NativeObject.h:496
0  xul.dll  js::NativeObject::hasDynamicSlots const  js/src/vm/NativeObject.h:977
0  xul.dll  JSObject::finalize  js/src/vm/JSObject-inl.h:107
0  xul.dll  js::gc::Arena::finalize  js/src/gc/Sweeping.cpp:132
0  xul.dll  FinalizeTypedArenas  js/src/gc/Sweeping.cpp:204
0  xul.dll  FinalizeArenas  js/src/gc/Sweeping.cpp:235
1  xul.dll  js::gc::GCRuntime::backgroundFinalize  js/src/gc/Sweeping.cpp:274
2  xul.dll  js::gc::GCRuntime::sweepBackgroundThings  js/src/gc/Sweeping.cpp:352
2  xul.dll  js::gc::GCRuntime::sweepFromBackgroundThread  js/src/gc/Sweeping.cpp:429
2  xul.dll  js::gc::BackgroundSweepTask::run  js/src/gc/Sweeping.cpp:420

Comment 1

[Jon Coppeard (:jonco)]

This is a signature change from this:

https://crash-stats.mozilla.org/signature/?signature=js%3A%3AObjectSlots%3A%3Acapacity&date=%3E%3D2023-07-05T07%3A51%3A00.000Z&date=%3C2023-07-12T07%3A51%3A00.000Z&_sort=-date#aggregations

This is one of the signatures in bug 787879.