1871175 - Crash in [@ JS::GetClass]

Status: NEW

(Core :: JavaScript: GC, defect, P4)

Description

[BugBot [:suhaib / :marco/ :calixte]]

Crash report: https://crash-stats.mozilla.org/report/index/6e8b2c54-c9a9-4c39-b29e-66d3b0231124

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0  xul.dll  JS::GetClass  js/public/Object.h:47
0  xul.dll  js::gc::FinalizeDeadNurseryObject  js/src/gc/GCAPI.cpp:805
0  xul.dll  mozilla::CycleCollectedJSRuntime::JSObjectsTenured  xpcom/base/CycleCollectedJSRuntime.cpp:1573
0  xul.dll  JSObjectsTenuredCb  xpcom/base/CycleCollectedJSRuntime.cpp:471
1  xul.dll  js::gc::GCRuntime::callObjectsTenuredCallback  js/src/gc/GC.cpp:1453
1  xul.dll  js::Nursery::doCollection  js/src/gc/Nursery.cpp:1439
2  xul.dll  js::Nursery::collect  js/src/gc/Nursery.cpp:1183
2  xul.dll  js::gc::GCRuntime::collectNursery  js/src/gc/GC.cpp:4657
3  xul.dll  js::gc::GCRuntime::minorGC  js/src/gc/GC.cpp:4630
4  xul.dll  mozilla::CCGCScheduler::GCRunnerFired  dom/base/CCGCScheduler.cpp:353

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2023-10-25
• Process type: Content
• Is startup crash: No
• Has user comments: No
• Is null crash: Yes - 1 out of 5 crashes happened on null or near null memory address

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::JavaScript: GC' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:willyelm, could you have a look please?

For more information, please visit BugBot documentation.

Comment 3

[Jon Coppeard (:jonco)]

Not much to go on here. Strange that there seem to be more crashes in ESR builds than in release builds.

Comment 4

[Gabriele Svelto [:gsvelto]]

This signature is full of potential bit-flips. This is most likely all flaky hardware, and the prevalence of ESR crashes strengthens this idea.