1895814 - Crash in [@ js::gc::AllocSite::incPromotedCount]

Status: RESOLVED DUPLICATE of bug 1639157

(Core :: JavaScript: GC, defect)

Description

[BugBot [:suhaib / :marco/ :calixte]]

Crash report: https://crash-stats.mozilla.org/report/index/22c5e4a8-485f-4b81-b8c7-559bc0240418

Reason: EXCEPTION_ACCESS_VIOLATION_WRITE

Top 10 frames of crashing thread:

0  xul.dll  js::gc::AllocSite::incPromotedCount  js/src/gc/Pretenuring.h:194
0  xul.dll  js::gc::TenuringTracer::alloc  js/src/gc/Tenuring.cpp:691
0  xul.dll  js::gc::TenuringTracer::allocString  js/src/gc/Tenuring.cpp:737
0  xul.dll  js::gc::TenuringTracer::promoteString  js/src/gc/Tenuring.cpp:1000
0  xul.dll  js::gc::TenuringTracer::onNonForwardedNurseryString  js/src/gc/Tenuring.cpp:130
0  xul.dll  js::gc::TenuringTracer::traverse  js/src/gc/Tenuring.cpp:218
0  xul.dll  js::gc::TenuringTracer::traceSlots  js/src/gc/Tenuring.cpp:658
0  xul.dll  js::gc::TenuringTracer::traceObjectSlots::<lambda_0>::operator const  js/src/gc/Tenuring.cpp:646
0  xul.dll  js::NativeObject::forEachSlotRangeUnchecked  js/src/vm/NativeObject.h:800
0  xul.dll  js::NativeObject::forEachSlotRange  js/src/vm/NativeObject.h:813

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2024-03-21
• Process type: Multiple distinct types
• Is startup crash: No
• Has user comments: No
• Is null crash: No

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::JavaScript: GC' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[Nicolas B. Pierron [:nbp]]

This signature appears as new because the function got renamed from incTenuredCount to incPromotedCount.