1889824 - Crash in [@ JSString::isDependent]

Status: RESOLVED FIXED

(Core :: JavaScript: GC, defect)

Description

[BugBot [:suhaib / :marco/ :calixte]]

Crash report: https://crash-stats.mozilla.org/report/index/e1181a7e-94b0-46d0-8f9e-dcfd50240329

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0  xul.dll  JSString::isDependent const  js/src/vm/StringType.h:571
0  xul.dll  JSString::hasBase const  js/src/vm/StringType.h:651
0  xul.dll  PreventDeduplicationOfReachableStrings  js/src/gc/Tenuring.cpp:382
0  xul.dll  TraceWholeCell  js/src/gc/Tenuring.cpp:418
0  xul.dll  js::gc::TenuringTracer::traceBufferedCells  js/src/gc/Tenuring.cpp:446
0  xul.dll  js::gc::ArenaCellSet::trace  js/src/gc/Tenuring.cpp:468
1  xul.dll  js::gc::StoreBuffer::WholeCellBuffer::trace  js/src/gc/Tenuring.cpp:495
1  xul.dll  js::gc::StoreBuffer::traceWholeCells  js/src/gc/StoreBuffer.h:629
1  xul.dll  js::Nursery::traceRoots  js/src/gc/Nursery.cpp:1644
2  xul.dll  js::Nursery::doCollection  js/src/gc/Nursery.cpp:1494

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2024-03-29
• Process type: Content
• Is startup crash: No
• Has user comments: No
• Is null crash: No

By analyzing the backtrace, the regression may have been introduced by a patch [1] to fix Bug 1879918.

[1] https://hg.mozilla.org/mozilla-central/rev?node=2e089790b421

:sfink, since you are the author of the potential regressor, could you please take a look?

Comment 1

[Donal Meehan [:dmeehan]]

Fixed by backout of bug 1879918.