1912549 - Crash in [@ js::gc::MarkBitmap::markBit]

Status: NEW

(Core :: JavaScript: GC, defect, P5)

Description

[BugBot [:suhaib / :marco]]

Crash report: https://crash-stats.mozilla.org/report/index/28a4220a-1e71-4219-825a-d81980240712

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0  xul.dll  std::_Atomic_storage<unsigned long long, 8>::load const  /builds/worker/fetches/vs/VC/Tools/MSVC/14.39.33519/include/atomic:1121
0  xul.dll  mozilla::detail::IntrinsicMemoryOps<unsigned long long, 0>::load  mfbt/Atomics.h:199
0  xul.dll  mozilla::detail::AtomicBaseIncDec<unsigned long long, 0>::operator unsigned long long const  mfbt/Atomics.h:344
0  xul.dll  js::gc::MarkBitmap::markBit  js/src/gc/Heap.h:494
0  xul.dll  js::gc::MarkBitmap::isMarkedBlack  js/src/gc/Heap.h:503
0  xul.dll  js::gc::TenuredCell::getColor  js/src/gc/Cell.h:436
0  xul.dll  js::gc::TenuredCell::color const  js/src/gc/Cell.h:427
0  xul.dll  js::gc::detail::GetEffectiveColor  js/src/gc/WeakMap-inl.h:45
0  xul.dll  JS::Zone::enterWeakMarkingMode  js/src/gc/Marking.cpp:2273
0  xul.dll  js::gc::GCRuntime::markWeakReferences<js::gc::SweepGroupZonesIter>  js/src/gc/Sweeping.cpp:527

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2024-06-02
• Process type: Content
• Is startup crash: No
• Has user comments: No
• Is null crash: No

Comment 1

[BugBot [:suhaib / :marco]]

The Bugbug bot thinks this bug should belong to the 'Core::JavaScript: GC' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[Nicolas B. Pierron [:nbp] {away}]

For our case, the JS engine standpoint, these are a low volume and sound unactionable either …

I am seeing among the crash address over the past 6 months that following addresses are showing up:

0x0002040810203fc0, (9 times)
0x00020408101fff40, (2 times)
0x0002040810203f40 (2 times)

Which sounds like some bit pattern that might be used to spread some bits using a multiplication.
Which suggest some memory corruption / pollution of the register or memory content, from one of these locations.

Maybe Paul or Kelsey would find these interesting …

Comment 3

[Paul Adenot (:padenot)]

Good find, but I'm not entirely sure what we can do with that info.

Comment 4

[BugBot [:suhaib / :marco]]

Clear a needinfo that is pending on an inactive user.

Inactive users most likely will not respond; if the missing information is essential and cannot be collected another way, the bug maybe should be closed as INCOMPLETE.

For more information, please visit BugBot documentation.