1877876 - Crash in [@ js::jit::CacheRegisterAllocator::useRegister]

Status: RESOLVED DUPLICATE of bug 1877684

(Core :: JavaScript Engine: JIT, defect)

Description

[BugBot [:suhaib / :marco/ :calixte]]

Crash report: https://crash-stats.mozilla.org/report/index/b1aba3a3-a2ca-465a-9d8a-6f8ee0240129

MOZ_CRASH Reason: MOZ_CRASH(Unexpected Value)

Top 7 frames of crashing thread:

0  xul.dll  js::jit::CacheRegisterAllocator::useRegister  js/src/jit/CacheIRCompiler.cpp:360
1  xul.dll  js::jit::CacheIRCompiler::emitGuardBooleanToInt32  js/src/jit/CacheIRCompiler.cpp:1779
2  xul.dll  js::jit::CacheIRCompiler::emitGuardBooleanToInt32  js/src/jit/CacheIRCompiler.h:868
2  xul.dll  js::jit::IonCacheIRCompiler::compile  js/src/jit/IonCacheIRCompiler.cpp:600
3  xul.dll  js::jit::IonIC::attachCacheIRStub  js/src/jit/IonCacheIRCompiler.cpp:1983
4  xul.dll  js::jit::IonSetPropertyIC::update  js/src/jit/IonIC.cpp:253
5  ?  @0x000003d5d5ac5778  

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2024-01-29
• Process type: Content
• Is startup crash: No
• Has user comments: No
• Is null crash: Yes - 3 out of 4 crashes happened on null or near null memory address

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::JavaScript Engine: JIT' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[Iain Ireland [:iain]]

I think this is a duplicate of bug 1877684. The timeline and the crash signatures line up.