1915055 - Crash in [@ js::gc::Arena::getAllocKind]

Status: NEW

(Core :: JavaScript: GC, defect, P3)

Description

[BugBot [:suhaib / :marco/ :calixte]]

Crash report: https://crash-stats.mozilla.org/report/index/768c5c44-57c5-4746-890c-9af820240811

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0  xul.dll  js::gc::Arena::getAllocKind const  js/src/gc/Heap.h:281
0  xul.dll  js::gc::TenuredCell::getAllocKind const  js/src/gc/Cell.h:475
0  xul.dll  js::gc::TenuredCell::getTraceKind const  js/src/gc/Cell.h:478
0  xul.dll  js::GCMarker::markAndTraversePrivateGCThing<2>  js/src/gc/Marking.cpp:1173
1  xul.dll  js::GCMarker::processMarkStackTop  js/src/gc/Marking.cpp:1594
1  xul.dll  js::GCMarker::markCurrentColorInParallel  js/src/gc/Marking.cpp:1347
2  xul.dll  js::gc::ParallelMarkTask::tryMarking  js/src/gc/ParallelMarking.cpp:185
2  xul.dll  js::gc::ParallelMarkTask::run  js/src/gc/ParallelMarking.cpp:162
3  xul.dll  js::GCParallelTask::runTask  js/src/gc/GCParallelTask.cpp:218
4  xul.dll  js::GCParallelTask::runFromMainThread  js/src/gc/GCParallelTask.cpp:174

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2024-06-18
• Process type: Content
• Is startup crash: No
• Has user comments: No
• Is null crash: Yes - 1 out of 14 crashes happened on null or near null memory address

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::JavaScript: GC' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The bug is linked to a topcrash signature, which matches the following criterion:

• Top 10 content process crashes on beta

:sdetar, could you consider increasing the severity of this top-crash bug?

For more information, please visit BugBot documentation.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Based on the topcrash criteria, the crash signature linked to this bug is not a topcrash signature anymore.

For more information, please visit BugBot documentation.