1866657 - Crash in [@ std::fill]

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect, P3)

Description

[BugBot [:suhaib / :marco]]

Crash report: https://crash-stats.mozilla.org/report/index/f71538be-2dd6-4311-8069-9cd1e0231124

Reason: EXCEPTION_ACCESS_VIOLATION_WRITE

Top 10 frames of crashing thread:

0  xul.dll  std::fill  /builds/worker/fetches/vs/VC/Tools/MSVC/14.29.30133/include/xutility:4484
0  xul.dll  std::_Hash_vec<v8::internal::ZoneAllocator<std::_List_unchecked_iterator<std::_List_val<std::_List_simple_types<std::pair<const int, v8::internal::  /builds/worker/fetches/vs/VC/Tools/MSVC/14.29.30133/include/xhash:297
1  xul.dll  std::_Hash<std::_Umap_traits<int, v8::internal::  /builds/worker/fetches/vs/VC/Tools/MSVC/14.29.30133/include/xhash:365
1  xul.dll  std::unordered_map<int, v8::internal::  /builds/worker/fetches/vs/VC/Tools/MSVC/14.29.30133/include/unordered_map:137
1  xul.dll  v8::internal::ZoneUnorderedMap<int, v8::internal::  js/src/irregexp/util/ZoneShim.h:397
1  xul.dll  v8::internal::  js/src/irregexp/imported/regexp-bytecode-peephole.cc:280
2  xul.dll  v8::internal::Zone::New  js/src/irregexp/util/ZoneShim.h:34
2  xul.dll  v8::internal::  js/src/irregexp/imported/regexp-bytecode-peephole.cc:477
2  xul.dll  v8::internal::RegExpBytecodePeepholeOptimization::OptimizeBytecode  js/src/irregexp/imported/regexp-bytecode-peephole.cc:1012
3  xul.dll  v8::internal::RegExpBytecodeGenerator::GetCode  js/src/irregexp/imported/regexp-bytecode-generator.cc:382

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2023-11-11
• Process type: Content
• Is startup crash: No
• Has user comments: No
• Is null crash: Yes - 1 out of 3 crashes happened on null or near null memory address
• Is use after free crash: Yes - 1 out of 3 crashes happened on or near an allocator poison value

Comment 1

[Suhaib Mujahid [:suhaib]]

All crashes seem to come from the same user, even though it is 3 different installations.

Comment 2

[Andrew McCreight [:mccr8]]

I only see 17 crashes in the last 6 months, and only one of them is on a poison value. Given that they are coming from the same machine, let's just unhide this.

Comment 3

[BugBot [:suhaib / :marco]]

Closing because no crashes reported for 12 weeks.