1879982 - Crash in [@ JS::Zone::shouldMarkInZone]

Status: NEW

(Core :: JavaScript: GC, defect, P5)

Description

[BugBot [:suhaib / :marco/ :calixte]]

Crash report: https://crash-stats.mozilla.org/report/index/d2e4826e-38d3-4fc2-a2a8-e3f970240212

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0  xul.dll  JS::Zone::shouldMarkInZone const  js/src/gc/Zone.h:437
0  xul.dll  ShouldMark  js/src/gc/Marking.cpp:898
0  xul.dll  js::gc::MarkingTracerT<2>::onEdge  js/src/gc/Marking.cpp:924
0  xul.dll  js::GenericTracerImpl<js::gc::MarkingTracerT<2> >::onStringEdge  js/public/TracingAPI.h:219
0  xul.dll  js::gc::TraceEdgeInternal  js/src/gc/Tracer.h:109
0  xul.dll  js::TraceManuallyBarrieredEdge  js/src/gc/Tracer.h:252
0  xul.dll  js::TraceManuallyBarrieredGCCellPtr::<lambda_2>::operator const  js/src/gc/Marking.cpp:651
0  xul.dll  JS::MapGCThingTyped  js/public/TraceKind.h:253
0  xul.dll  js::TraceManuallyBarrieredGCCellPtr  js/src/gc/Marking.cpp:649
0  xul.dll  js::PrivateScriptData::trace  js/src/vm/JSScript.cpp:2339

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2024-01-02
• Process type: Multiple distinct types
• Is startup crash: No
• Has user comments: No
• Is null crash: Yes - 1 out of 4 crashes happened on null or near null memory address

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::JavaScript: GC' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.