1915056 - Crash in [@ mozilla::Vector<T>::reserve | js::jit::x86_shared::AssemblerBuffer::ensureSpace]

Status: NEW

(Core :: JavaScript Engine: JIT, defect, P5)

Description

[BugBot [:suhaib / :marco]]

Crash report: https://crash-stats.mozilla.org/report/index/270d7cd2-b5cd-4eaa-9f51-213300240826

Reason: EXCEPTION_ILLEGAL_INSTRUCTION

Top 10 frames of crashing thread:

0  xul.dll  mozilla::Vector<unsigned char, 256, js::jit::x86_shared::AssemblerBufferAllocPolicy>::reserve  js/src/jit/x86-shared/AssemblerBuffer-x86-shared.h:139
0  xul.dll  js::jit::x86_shared::AssemblerBuffer::ensureSpace  js/src/jit/x86-shared/AssemblerBuffer-x86-shared.h:139
0  xul.dll  js::jit::X86Encoding::BaseAssembler::X86InstructionFormatter::oneByteOp  js/src/jit/x86-shared/BaseAssembler-x86-shared.h:5547
0  xul.dll  js::jit::X86Encoding::BaseAssembler::call_m  js/src/jit/x86-shared/BaseAssembler-x86-shared.h:2652
0  xul.dll  js::jit::AssemblerX86Shared::call  js/src/jit/x86-shared/Assembler-x86-shared.h:1132
0  xul.dll  js::jit::MacroAssembler::call  js/src/jit/x86-shared/MacroAssembler-x86-shared.cpp:697
0  xul.dll  js::jit::EmitCallIC  js/src/jit/x64/SharedICHelpers-x64.h:33
0  xul.dll  js::jit::BaselineCodeGen<js::jit::BaselineCompilerHandler>::emitNextIC  js/src/jit/BaselineCodeGen.cpp:653
0  xul.dll  js::jit::BaselineCodeGen<js::jit::BaselineCompilerHandler>::emit_GetProp  js/src/jit/BaselineCodeGen.cpp:3404
1  xul.dll  js::jit::BaselineCompiler::emitBody  js/src/jit/BaselineCodeGen.cpp:6674

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2024-08-20
• Process type: Multiple distinct types
• Is startup crash: No
• Has user comments: No
• Is null crash: Yes - 1 out of 2 crashes happened on null or near null memory address

Comment 1

[BugBot [:suhaib / :marco]]

The Bugbug bot thinks this bug should belong to the 'Core::JavaScript Engine: JIT' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[Nicolas B. Pierron [:nbp] {away}]

Well we are supposed to handle OOMs in case of JIT compilation, so I do not understand what might be going wrong here …