1874794 - Crash in [@ js::ImmutableScriptData::endOffset]

Status: NEW

(Core :: JavaScript Engine, defect, P3)

Description

[BugBot [:suhaib / :marco]]

Crash report: https://crash-stats.mozilla.org/report/index/6f2a681b-ed90-4a16-baaf-2bba50240115

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0  xul.dll  js::ImmutableScriptData::endOffset const  js/src/vm/SharedStencil.h:500
0  xul.dll  js::ImmutableScriptData::immutableData const  js/src/vm/SharedStencil.h:576
0  xul.dll  js::SharedImmutableScriptData::Hasher::match  js/src/vm/SharedStencil.h:782
0  xul.dll  mozilla::detail::HashTable<js::SharedImmutableScriptData*const, mozilla::HashSet<js::SharedImmutableScriptData*, js::SharedImmutableScriptData::Hasher, js::SystemAllocPolicy>::SetHashPolicy, js::SystemAllocPolicy>::match  mfbt/HashTable.h:1750
0  xul.dll  mozilla::detail::HashTable<js::SharedImmutableScriptData*const, mozilla::HashSet<js::SharedImmutableScriptData*, js::SharedImmutableScriptData::Hasher, js::SystemAllocPolicy>::SetHashPolicy, js::SystemAllocPolicy>::lookup const  mfbt/HashTable.h:1780
0  xul.dll  mozilla::detail::HashTable<js::SharedImmutableScriptData*const, mozilla::HashSet<js::SharedImmutableScriptData*, js::SharedImmutableScriptData::Hasher, js::SystemAllocPolicy>::SetHashPolicy, js::SystemAllocPolicy>::lookupForAdd  mfbt/HashTable.h:2124
0  xul.dll  mozilla::HashSet<js::SharedImmutableScriptData*, js::SharedImmutableScriptData::Hasher, js::SystemAllocPolicy>::lookupForAdd  mfbt/HashTable.h:617
0  xul.dll  js::SharedImmutableScriptData::shareScriptData  js/src/vm/JSScript.cpp:2217
0  xul.dll  js::frontend::SharedDataContainer::addAndShare  js/src/frontend/Stencil.cpp:3200
0  xul.dll  js::frontend::BytecodeEmitter::intoScriptStencil  js/src/frontend/BytecodeEmitter.cpp:12924

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2023-11-11
• Process type: Content
• Is startup crash: No
• Has user comments: No
• Is null crash: Yes - 2 out of 3 crashes happened on null or near null memory address

Comment 1

[Matthew Gaudet (he/him) [:mgaudet]]

Arai: Anything look actionable here?

Comment 2

[Tooru Fujisawa [:arai]]

I don't find anything suspicious.