1902880 - Crash in [@ JS::shadow::Zone::gcState]

Status: NEW

(Core :: JavaScript: GC, defect, P2)

Description

[BugBot [:suhaib / :marco/ :calixte]]

Crash report: https://crash-stats.mozilla.org/report/index/e56089e5-65ef-4c6b-9405-57e240240615

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0  xul.dll  JS::shadow::Zone::gcState const  js/public/shadow/Zone.h:75
0  xul.dll  JS::shadow::Zone::isGCPreparing const  js/public/shadow/Zone.h:87
0  xul.dll  js::gc::UnmarkGrayTracer::onChild  js/src/gc/Marking.cpp:2751
1  xul.dll  JS::MapGCThingTyped  js/public/TraceKind.h:253
1  xul.dll  js::TraceManuallyBarrieredGCCellPtr  js/src/gc/Marking.cpp:662
1  xul.dll  js::PrivateScriptData::trace  js/src/vm/JSScript.cpp:2339
1  xul.dll  js::BaseScript::traceChildren  js/src/gc/TraceMethods-inl.h:43
1  xul.dll  JS::TraceChildren::<lambda_5>::operator const  js/src/gc/Tracer.cpp:62
1  xul.dll  JS::MapGCThingTyped  js/public/TraceKind.h:253
1  xul.dll  JS::ApplyGCThingTyped  js/public/TraceKind.h:268

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2024-06-11
• Process type: Parent
• Is startup crash: No
• Has user comments: No
• Is null crash: Yes - 1 out of 2 crashes happened on null or near null memory address

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::JavaScript: GC' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.