1874576 - Crash in [@ js::jit::UsePosition::usePolicy]

Status: NEW

(Core :: JavaScript Engine: JIT, defect, P3)

Description

[BugBot [:suhaib / :marco/ :calixte]]

Crash report: https://crash-stats.mozilla.org/report/index/8623f59a-44e2-4043-a855-f72860240113

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0  xul.dll  js::jit::UsePosition::usePolicy const  js/src/jit/BacktrackingAllocator.h:129
0  xul.dll  js::jit::BacktrackingAllocator::computeRequirement  js/src/jit/BacktrackingAllocator.cpp:3139
0  xul.dll  js::jit::BacktrackingAllocator::processBundle  js/src/jit/BacktrackingAllocator.cpp:3445
0  xul.dll  js::jit::BacktrackingAllocator::go  js/src/jit/BacktrackingAllocator.cpp:4610
1  xul.dll  js::jit::GenerateLIR  js/src/jit/Ion.cpp:1551
2  xul.dll  js::jit::CompileBackEnd  js/src/jit/Ion.cpp:1609
3  xul.dll  js::jit::IonCompileTask::runTask  js/src/jit/IonCompileTask.cpp:52
3  xul.dll  js::jit::IonCompileTask::runHelperThreadTask  js/src/jit/IonCompileTask.cpp:30
4  xul.dll  js::GlobalHelperThreadState::runTaskLocked  js/src/vm/HelperThreads.cpp:1729
4  xul.dll  js::GlobalHelperThreadState::runOneTask  js/src/vm/HelperThreads.cpp:1690

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2023-11-11
• Process type: Multiple distinct types
• Is startup crash: No
• Has user comments: No
• Is null crash: Yes - 1 out of 4 crashes happened on null or near null memory address

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::JavaScript Engine: JIT' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[Matthew Gaudet (he/him) [:mgaudet]]

Julian, Is there anything actionable or interesting here, or likely just bad hardware?

Comment 3

[Julian Seward [:jseward]]

I don't see anything in here that immediately suggests other than just "bad memory". But we should continue watching this.