2000341 - Crash in [@ js::frontend::ParserAtom::isUsedByStencil]

Status: NEW

(Core :: JavaScript Engine, defect, P5)

Description

[BugBot [:suhaib / :marco]]

Crash report: https://crash-stats.mozilla.org/report/index/3bfddf53-3703-4b93-ae60-b2a3b0251018

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0  xul.dll  js::frontend::ParserAtom::isUsedByStencil const  js/src/frontend/ParserAtom.h:463
0  xul.dll  js::frontend::InstantiateMarkedAtoms  js/src/frontend/ParserAtom.cpp:1168
0  xul.dll  InstantiateAtoms  js/src/frontend/Stencil.cpp:2170
0  xul.dll  js::frontend::CompilationStencil::instantiateStencilAfterPreparation  js/src/frontend/Stencil.cpp:2794
1  xul.dll  js::frontend::CompilationStencil::instantiateStencils  js/src/frontend/Stencil.cpp:2757
2  xul.dll  js::frontend::InitialStencilAndDelazifications::instantiateStencils  js/src/frontend/Stencil.cpp:4083
2  xul.dll  InstantiateStencilsImpl<js::frontend::InitialStencilAndDelazifications>  js/src/frontend/BytecodeCompiler.cpp:486
3  xul.dll  js::frontend::InstantiateStencils  js/src/frontend/BytecodeCompiler.cpp:512
3  xul.dll  JS::InstantiateGlobalStencil  js/src/frontend/Stencil.cpp:6166
4  xul.dll  mozilla::dom::InstantiateStencil  dom/script/ScriptLoader.cpp:2994

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2025-10-01
• Process type: Content
• Is startup crash: No
• Has user comments: No
• Is null crash: No

Comment 1

[Nicolas B. Pierron [:nbp] {away}]

The bit-flip probability is high with this bug.
Checking crashing addresses of similar bugs makes me concludes the same …