1909129 - Crash in [@ JSObject::is]

Status: NEW

(Core :: JavaScript: GC, defect, P3)

Description

[BugBot [:suhaib / :marco/ :calixte]]

Crash report: https://crash-stats.mozilla.org/report/index/eb10e8df-92f8-4b1f-bb30-74b980240721

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0  xul.dll  JSObject::is const  js/src/vm/JSFunction.h:915
0  xul.dll  js::gc::TenuringTracer::promoteObject  js/src/gc/Tenuring.cpp:147
0  xul.dll  js::gc::TenuringTracer::traverse  js/src/gc/Tenuring.cpp:242
0  xul.dll  js::gc::TenuringTracer::traceSlots  js/src/gc/Tenuring.cpp:697
0  xul.dll  js::gc::TenuringTracer::traceObjectElements  js/src/gc/Tenuring.cpp:692
0  xul.dll  js::gc::TenuringTracer::traceObject  js/src/gc/Tenuring.cpp:676
1  xul.dll  TraceWholeCell  js/src/gc/Tenuring.cpp:380
1  xul.dll  js::gc::TenuringTracer::traceBufferedCells  js/src/gc/Tenuring.cpp:465
1  xul.dll  js::gc::ArenaCellSet::trace  js/src/gc/Tenuring.cpp:498
2  xul.dll  js::gc::StoreBuffer::WholeCellBuffer::trace  js/src/gc/Tenuring.cpp:530

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2024-05-23
• Process type: Multiple distinct types
• Is startup crash: No
• Has user comments: No
• Is null crash: No

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::JavaScript: GC' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.