1893775 - Crash in [@ js::gc::MarkingTracerT<T>::onEdge]

Status: NEW

(Core :: JavaScript Engine, defect, P2)

Description

[BugBot [:suhaib / :marco/ :calixte]]

Crash report: https://crash-stats.mozilla.org/report/index/0e78c5df-5b13-4847-9871-053fa0240420

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0  xul.dll  js::gc::MarkingTracerT<2>::onEdge  js/src/gc/Marking.cpp:837
0  xul.dll  js::GenericTracerImpl<js::gc::MarkingTracerT<2> >::onScriptEdge  js/public/TracingAPI.h:219
0  xul.dll  js::gc::TraceEdgeInternal  js/src/gc/Tracer.h:109
0  xul.dll  js::TraceEdge  js/src/gc/Tracer.h:148
0  xul.dll  js::jit::JitScript::trace  js/src/jit/JitScript.cpp:181
1  xul.dll  js::ScriptWarmUpData::trace  js/src/vm/JSScript.cpp:2929
1  xul.dll  js::BaseScript::traceChildren  js/src/gc/TraceMethods-inl.h:40
1  xul.dll  js::GCMarker::processMarkStackTop  js/src/gc/Marking.cpp:1499
1  xul.dll  js::GCMarker::markCurrentColorInParallel  js/src/gc/Marking.cpp:1316
2  xul.dll  js::gc::ParallelMarkTask::tryMarking  js/src/gc/ParallelMarking.cpp:178

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2024-04-20
• Process type: Multiple distinct types
• Is startup crash: No
• Has user comments: No
• Is null crash: No

By analyzing the backtrace, the regression may have been introduced by a patch [1] to fix Bug 1888429.

[1] https://hg.mozilla.org/mozilla-central/rev?node=c82b988fab50

:jonco, since you are the author of the potential regressor, could you please take a look?

Comment 1

[Jon Coppeard (:jonco)]

(In reply to BugBot [:suhaib / :marco/ :calixte] from comment #0)

By analyzing the backtrace, the regression may have been introduced by a patch [1] to fix Bug 1888429.

No, this was backed out.

This looks like an ongoing GC crash.