1930217 - Crash in [@ js::gc::FreeLists::allocate]

Status: NEW

(Core :: JavaScript: GC, defect, P5)

Description

[andrew]

Crash report: https://crash-stats.mozilla.org/report/index/27b96320-b84e-4fcd-8cfb-84fc50241108

Reason:

EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames:

0  xul.dll  js::gc::FreeLists::allocate(js::gc::AllocKind)  js/src/gc/ArenaList-inl.h:346
0  xul.dll  js::gc::ArenaLists::allocateFromFreeList(js::gc::AllocKind)  js/src/gc/ArenaList-inl.h:406
0  xul.dll  js::gc::AllocateTenuredCellInGC(JS::Zone*, js::gc::AllocKind)  js/src/gc/Allocator.cpp:296
0  xul.dll  js::gc::TenuringTracer::allocCell(JS::Zone*, js::gc::AllocKind, js::gc::Alloc...  js/src/gc/Tenuring.cpp:732
0  xul.dll  js::gc::TenuringTracer::alloc(JS::Zone*, js::gc::AllocKind, js::gc::Cell*)  js/src/gc/Tenuring.cpp:693
0  xul.dll  js::gc::TenuringTracer::promoteObjectSlow(JSObject*)  js/src/gc/Tenuring.cpp:755
0  xul.dll  js::gc::TenuringTracer::onNonForwardedNurseryObject(JSObject*)  js/src/gc/Tenuring.cpp:99
0  xul.dll  js::gc::TenuringTracer::traverse(JS::Value*)  js/src/gc/Tenuring.cpp:204
0  xul.dll  js::gc::TenuringTracer::traceSlots(JS::Value*, JS::Value*)  js/src/gc/Tenuring.cpp:658
0  xul.dll  js::gc::TenuringTracer::traceObjectSlots::<lambda_0>::operator()(js::HeapSlot...  js/src/gc/Tenuring.cpp:646

Comment 1

[andrew]

Unsure if this a security issue but feel free to remove the security flag

Comment 2

[Andrew McCreight [:mccr8]]

This crash report has a "Possible bit flips max confidence" of 43% so you might be having hardware issues.