1963334 - Crash in [@ js::gc::MarkBitmap<T>::markIfUnmarkedThreadSafe]

Status: RESOLVED DUPLICATE of bug 1917738

(Core :: JavaScript: GC, defect)

Description

[Donal Meehan [:dmeehan]]

Crash report: https://crash-stats.mozilla.org/report/index/e9a3b838-afa3-48cb-bfc9-620d70250429

Reason:

EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames:

0  xul.dll  std::_Atomic_storage<unsigned long long, 8>::load(const std::memory_order) const  /builds/worker/fetches/vs/VC/Tools/MSVC/14.39.33519/include/atomic:1121
0  xul.dll  mozilla::detail::IntrinsicMemoryOps<unsigned long long, 0>::load(std::atomic<...  mfbt/Atomics.h:199
0  xul.dll  mozilla::detail::AtomicBaseIncDec<unsigned long long, 0>::operator unsigned l...  mfbt/Atomics.h:344
0  xul.dll  js::gc::MarkBitmap<8, 16384>::markIfUnmarkedThreadSafe(void const*, js::gc::M...  js/src/gc/Heap-inl.h:136
0  xul.dll  js::gc::TenuredCell::markIfUnmarkedThreadSafe(js::gc::MarkColor) const  js/src/gc/Heap-inl.h:250
0  xul.dll  js::GCMarker::mark(js::Shape*)  js/src/gc/Marking.cpp:1229
0  xul.dll  js::GCMarker::markAndTraverse(js::Shape*)  js/src/gc/Marking.cpp:985
0  xul.dll  js::GCMarker::markAndTraverseEdge(JSObject*, js::Shape*)  js/src/gc/Marking.cpp:1169
0  xul.dll  js::GCMarker::processMarkStackTop(JS::SliceBudget&)  js/src/gc/Marking.cpp:1639
0  xul.dll  js::GCMarker::markCurrentColorInParallel(JS::SliceBudget&)  js/src/gc/Marking.cpp:1359

Comment 1

[Donal Meehan [:dmeehan]]

:jonco Bug 1961755 looks like the likely regressor here?

Comment 2

[Jon Coppeard (:jonco)]

This is a signature change for bug 1917738 due to renaming a method in bug 1961755.