Crash in unsigned long js::gc::Arena::finalize<js::jit::JitCode, (js::gc::FinalizeKind)1>(JS::GCContext*, js::gc::AllocKind, unsigned long) [clone .constprop.0]

Similar reports
Problem #739580
Component
firefox
Last affected version
0:143.0.4-1.fc41
Executable
/usr/lib64/firefox/firefox
Error name
SIGSEGV 11
First occurrence
2025-11-13
Last occurrence
2026-01-04
Unique reports
2
Quality
-56

Statistics

Operating system Unique / Total count
Fedora 41 2 / 4
Operating system Count
Fedora 41 4
Architecture Count
x86_64 4
Related packages Count
firefox 4
 0:143.0.4-1.fc41 4

Packages names with count less than the total count of reports are most probably not the cause of the problem.

History

Daily:

Weekly:

Monthly:

History

Daily:

Weekly:

Monthly:


Backtrace

Frame # Function Binary Source or offset Line
1
unsigned long js::gc::Arena::finalize<js::jit::JitCode, (js::gc::FinalizeKind)1>(JS::GCContext*, js::gc::AllocKind, unsigned long) [clone .constprop.0]
/usr/lib64/firefox/libxul.so 0x32571ab
Build id: bc4a2a0c53e2b2c8bbfbea69915033cccc39b1f0 		-
2
bool FinalizeArenas<(js::gc::ReleaseEmpty)0>(JS::GCContext*, js::gc::ArenaList&, js::gc::SortedArenaList&, js::gc::AllocKind, JS::SliceBudget&) [clone .lto_priv.0]
/usr/lib64/firefox/libxul.so 0x325687b
Build id: bc4a2a0c53e2b2c8bbfbea69915033cccc39b1f0 		-
3
js::gc::GCRuntime::finalizeAllocKind(JS::GCContext*, JS::SliceBudget&)
/usr/lib64/firefox/libxul.so 0x3890a6c
Build id: bc4a2a0c53e2b2c8bbfbea69915033cccc39b1f0 		-
4
sweepaction::SweepActionForEach<ContainerIter<mozilla::EnumSet<js::gc::AllocKind, unsigned long> >, mozilla::EnumSet<js::gc::AllocKind, unsigned long> >::run(js::gc::SweepAction::Args&)
/usr/lib64/firefox/libxul.so 0x3890858
Build id: bc4a2a0c53e2b2c8bbfbea69915033cccc39b1f0 		-
5
sweepaction::SweepActionSequence::run(js::gc::SweepAction::Args&)
/usr/lib64/firefox/libxul.so 0x3884954
Build id: bc4a2a0c53e2b2c8bbfbea69915033cccc39b1f0 		-
6
sweepaction::SweepActionForEach<js::gc::SweepGroupZonesIter, JSRuntime*>::run(js::gc::SweepAction::Args&)
/usr/lib64/firefox/libxul.so 0x389066a
Build id: bc4a2a0c53e2b2c8bbfbea69915033cccc39b1f0 		-
7
sweepaction::SweepActionSequence::run(js::gc::SweepAction::Args&)
/usr/lib64/firefox/libxul.so 0x3884954
Build id: bc4a2a0c53e2b2c8bbfbea69915033cccc39b1f0 		-
8
sweepaction::SweepActionForEach<js::gc::SweepGroupsIter, JSRuntime*>::run(js::gc::SweepAction::Args&)
/usr/lib64/firefox/libxul.so 0x38847fc
Build id: bc4a2a0c53e2b2c8bbfbea69915033cccc39b1f0 		-
9
js::gc::GCRuntime::incrementalSlice(JS::SliceBudget&, JS::GCReason, bool)
/usr/lib64/firefox/libxul.so 0x323f116
Build id: bc4a2a0c53e2b2c8bbfbea69915033cccc39b1f0 		-
10
js::gc::GCRuntime::gcCycle(bool, JS::SliceBudget const&, JS::GCReason)
/usr/lib64/firefox/libxul.so 0x323e4a9
Build id: bc4a2a0c53e2b2c8bbfbea69915033cccc39b1f0 		-
11
js::gc::GCRuntime::collect(bool, JS::SliceBudget const&, JS::GCReason)
/usr/lib64/firefox/libxul.so 0x38794d7
Build id: bc4a2a0c53e2b2c8bbfbea69915033cccc39b1f0 		-
12
GarbageCollectImpl(JS::GCReason, nsJSContext::IsShrinking, JS::SliceBudget const&) [clone .lto_priv.0]
/usr/lib64/firefox/libxul.so 0x39c4ee1
Build id: bc4a2a0c53e2b2c8bbfbea69915033cccc39b1f0 		-
13
std::_Function_handler<bool (mozilla::TimeStamp), mozilla::CCGCScheduler::EnsureGCRunner(mozilla::BaseTimeDuration<mozilla::TimeDurationValueCalculator>)::{lambda(mozilla::TimeStamp)#1}>::_M_invoke(std::_Any_data const&, mozilla::TimeStamp&&) [clone .lto_priv.0]
/usr/lib64/firefox/libxul.so 0x3566035
Build id: bc4a2a0c53e2b2c8bbfbea69915033cccc39b1f0 		-
14
mozilla::IdleTaskRunnerTask::Run()
/usr/lib64/firefox/libxul.so 0x3564f41
Build id: bc4a2a0c53e2b2c8bbfbea69915033cccc39b1f0 		-
15
mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)
/usr/lib64/firefox/libxul.so 0x2f39775
Build id: bc4a2a0c53e2b2c8bbfbea69915033cccc39b1f0 		-
16
mozilla::TaskController::ProcessPendingMTTask(bool)
/usr/lib64/firefox/libxul.so 0x2f38b78
Build id: bc4a2a0c53e2b2c8bbfbea69915033cccc39b1f0 		-
17
nsThread::ProcessNextEvent(bool, bool*)
/usr/lib64/firefox/libxul.so 0x2cf4bc8
Build id: bc4a2a0c53e2b2c8bbfbea69915033cccc39b1f0 		-
18
mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)
/usr/lib64/firefox/libxul.so 0x2ff56a2
Build id: bc4a2a0c53e2b2c8bbfbea69915033cccc39b1f0 		-
19
MessageLoop::Run()
/usr/lib64/firefox/libxul.so 0x3340eec
Build id: bc4a2a0c53e2b2c8bbfbea69915033cccc39b1f0 		-
20
nsBaseAppShell::Run()
/usr/lib64/firefox/libxul.so 0x35f04ed
Build id: bc4a2a0c53e2b2c8bbfbea69915033cccc39b1f0 		-
21
nsAppShell::Run()
/usr/lib64/firefox/libxul.so 0x35ef961
Build id: bc4a2a0c53e2b2c8bbfbea69915033cccc39b1f0 		-
22
mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)
/usr/lib64/firefox/libxul.so 0xb79eb7
Build id: bc4a2a0c53e2b2c8bbfbea69915033cccc39b1f0 		-
23
MessageLoop::Run()
/usr/lib64/firefox/libxul.so 0x3340eec
Build id: bc4a2a0c53e2b2c8bbfbea69915033cccc39b1f0 		-
24
XRE_InitChildProcess(int, char**, XREChildData const*)
/usr/lib64/firefox/libxul.so 0x24622f4
Build id: bc4a2a0c53e2b2c8bbfbea69915033cccc39b1f0 		-
25
main
/usr/lib64/firefox/firefox 0x40029
Build id: bf1cbdde12ca8627bd6829fb8574cdf4cb119194 		-
26
__libc_start_call_main
/lib64/libc.so.6 0x3448
Build id: dae6ae6929d69dca842288f5300af5a33d1bdcd7 		-
27
__libc_start_main@@GLIBC_2.34
/lib64/libc.so.6 0x350b
Build id: dae6ae6929d69dca842288f5300af5a33d1bdcd7 		-
28
_start
/usr/lib64/firefox/firefox 0x3d6e5
Build id: bf1cbdde12ca8627bd6829fb8574cdf4cb119194 		-