1903678 - Crash in [@ mozilla::CycleCollectedJSRuntime::TraverseNativeRoots]

Status: NEW

(Core :: Cycle Collector, defect)

Description

[BugBot [:suhaib / :marco/ :calixte]]

Crash report: https://crash-stats.mozilla.org/report/index/e575c319-a1ff-42e5-9a72-00c570240619

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0  xul.dll  mozilla::CycleCollectedJSRuntime::TraverseNativeRoots  xpcom/base/CycleCollectedJSRuntime.cpp:976
0  xul.dll  mozilla::CycleCollectedJSRuntime::TraverseRoots  xpcom/base/CycleCollectedJSRuntime.cpp:1507
0  xul.dll  nsCycleCollector::BeginCollection  xpcom/base/nsCycleCollector.cpp:3707
0  xul.dll  nsCycleCollector::Collect  xpcom/base/nsCycleCollector.cpp:3503
1  xul.dll  nsCycleCollector_collectSlice  xpcom/base/nsCycleCollector.cpp:4030
2  xul.dll  nsJSContext::RunCycleCollectorSlice  dom/base/nsJSEnvironment.cpp:1476
2  xul.dll  mozilla::CCGCScheduler::CCRunnerFired  dom/base/nsJSEnvironment.cpp:1641
3  xul.dll  std::invoke  /builds/worker/fetches/vs/VC/Tools/MSVC/14.39.33519/include/type_traits:1739
3  xul.dll  std::_Func_impl_no_alloc<bool   /builds/worker/fetches/vs/VC/Tools/MSVC/14.39.33519/include/functional:907
4  xul.dll  std::_Func_class<bool, mozilla::TimeStamp>::operator const  /builds/worker/fetches/vs/VC/Tools/MSVC/14.39.33519/include/functional:951

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2024-05-04
• Process type: Multiple distinct types
• Is startup crash: No
• Has user comments: No
• Is null crash: Yes - 2 out of 8 crashes happened on null or near null memory address

Comment 1

[Dan Mehic]

Seems like this belongs to cycle collector component.