1951432 - Crash in [@ std::reverse] via TryEnumerableOwnPropertiesNative on Intel Raptor Lake CPUs

Status: NEW

(Core :: JavaScript Engine, defect, P5)

Description

[BugBot [:suhaib / :marco]]

Crash report: https://crash-stats.mozilla.org/report/index/6ed31fb3-a785-49a5-88e4-b51c40240907

Reason: EXCEPTION_ACCESS_VIOLATION_WRITE

Top 5 frames of crashing thread:

0  xul.dll  std::reverse  /builds/worker/fetches/vs/VC/Tools/MSVC/14.39.33519/include/xutility:6172
0  xul.dll  TryEnumerableOwnPropertiesNative  js/src/builtin/Object.cpp:1818
0  xul.dll  js::obj_keys  js/src/builtin/Object.cpp:2134
0  xul.dll  js::jit::ObjectKeys  js/src/jit/VMFunctions.cpp:1470
1  ?  @0x000002c5d78b643e  

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2024-12-24
• Process type: Content
• Is startup crash: No
• Has user comments: No
• Is null crash: Yes - 2 out of 7 crashes happened on null or near null memory address

Comment 1

[BugBot [:suhaib / :marco]]

The Bugbug bot thinks this bug should belong to the 'Core::JavaScript Engine: JIT' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[Andrew McCreight [:mccr8]]

Most common adapter device ID is "Raptor Lake-S UHD Graphics (0xa788)" so I suspect this is bad hardware.

Comment 3

[Gabriele Svelto [:gsvelto]]

Yes, all crashes are from CPUs with CPU info family 6 model 183 stepping 1, this is our good friend Raptor Lake.