1954243 - Startup crash in [@ js::HashPropertyKey]

Status: NEW

(Core :: JavaScript Engine, defect, P3)

Description

[BugBot [:suhaib / :marco]]

Crash report: https://crash-stats.mozilla.org/report/index/ec8abfb8-7d2c-4492-8146-ef2ef0240914

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0  xul.dll  js::HashPropertyKey  js/src/vm/PropertyKey.h:24
0  xul.dll  js::ShapeForAddHasher::hash  js/src/vm/Shape.cpp:1154
0  xul.dll  mozilla::FallibleHashMethods<js::ShapeForAddHasher>::maybeGetHash  mfbt/HashTable.h:904
0  xul.dll  mozilla::MaybeGetHash  mfbt/HashTable.h:920
0  xul.dll  mozilla::detail::HashTable<js::SharedShape*const, mozilla::HashSet<js::SharedShape*, js::ShapeForAddHasher, js::SystemAllocPolicy>::SetHashPolicy, js::SystemAllocPolicy>::readonlyThreadsafeLookup const  mfbt/HashTable.h:2094
0  xul.dll  mozilla::detail::HashTable<js::SharedShape*const, mozilla::HashSet<js::SharedShape*, js::ShapeForAddHasher, js::SystemAllocPolicy>::SetHashPolicy, js::SystemAllocPolicy>::lookup const  mfbt/HashTable.h:2104
0  xul.dll  mozilla::HashSet<js::SharedShape*, js::ShapeForAddHasher, js::SystemAllocPolicy>::lookup const  mfbt/HashTable.h:533
0  xul.dll  LookupShapeForAdd  js/src/vm/Shape.cpp:276
0  xul.dll  js::NativeObject::addProperty  js/src/vm/Shape.cpp:327
1  xul.dll  js::AddDataPropertyToPlainObject  js/src/vm/NativeObject-inl.h:902

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2025-01-05
• Process type: Multiple distinct types
• Is startup crash: Yes - 1 out of 66 crashes happened during startup
• Has user comments: No
• Is null crash: Yes - 45 out of 66 crashes happened on null or near null memory address

Comment 1

[BugBot [:suhaib / :marco]]

The Bugbug bot thinks this bug should belong to the 'Core::JavaScript Engine' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.