1867165 - Crash in [@ JSClass::hasTrace]

Status: NEW

(Core :: JavaScript: GC, defect, P3)

Description

[BugBot [:suhaib / :marco/ :calixte]]

Crash report: https://crash-stats.mozilla.org/report/index/8df1db5a-8c0b-48d0-8157-9a8970231123

Reason: SIGSEGV / SI_KERNEL

Top 10 frames of crashing thread:

0  libxul.so  JSClass::hasTrace const  js/public/Class.h:640
0  libxul.so  CallTraceHook  js/src/gc/Marking.cpp:1270
0  libxul.so  js::GCMarker::processMarkStackTop<  js/src/gc/Marking.cpp:1577
0  libxul.so  js::GCMarker::markOneColor<  js/src/gc/Marking.cpp:1371
1  libxul.so  js::GCMarker::doMarking<  js/src/gc/Marking.cpp:1339
1  libxul.so  js::GCMarker::markUntilBudgetExhausted  js/src/gc/Marking.cpp:1330
2  libxul.so  js::gc::GCRuntime::markUntilBudgetExhausted  js/src/gc/GC.cpp:3033
3  libxul.so  js::gc::GCRuntime::incrementalSlice  js/src/gc/GC.cpp:3657
4  libxul.so  js::gc::GCRuntime::gcCycle  js/src/gc/GC.cpp:4221
5  libxul.so  js::gc::GCRuntime::collect  js/src/gc/GC.cpp:4412

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2023-09-28
• Process type: Multiple distinct types
• Is startup crash: No
• Has user comments: No
• Is null crash: Yes - 2 out of 11 crashes happened on null or near null memory address