Crash in js::jit::GetPropIRGenerator::tryAttachTypedArrayElement(JS::Handle<JSObject*>, js::jit::ObjOperandId)

Similar reports
Problem #803584
Component
firefox
Last affected version
0:145.0-2.fc42
Executable
/usr/lib64/firefox/firefox
Error name
SIGSEGV 11
First occurrence
2025-11-17
Last occurrence
2026-07-02
Unique reports
5
Quality
-210

Graphs

Statistics

Operating system Unique / Total count
Fedora 41 9 / 9
Fedora 42 5 / 5
Operating system Count
Fedora 41 9
Fedora 42 5
Architecture Count
x86_64 14
Related packages Count
firefox 14
 0:145.0-2.fc41 9
 0:145.0-2.fc42 5

Packages names with count less than the total count of reports are most probably not the cause of the problem.

History

Daily:

Weekly:

Monthly:

History

Daily:

Weekly:

Monthly:


Backtrace

Frame # Function Binary Source or offset Line
1
js::jit::GetPropIRGenerator::tryAttachTypedArrayElement(JS::Handle<JSObject*>, js::jit::ObjOperandId)
/usr/lib64/firefox/libxul.so 0x5a831a0
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
2
js::jit::GetPropIRGenerator::tryAttachStub()
/usr/lib64/firefox/libxul.so 0x5aae37f
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
3
void js::jit::TryAttachStub<js::jit::GetPropIRGenerator, js::jit::CacheKind, JS::MutableHandle<JS::Value>&, JS::Rooted<JS::Value>&>(char const*, JSContext*, js::jit::BaselineFrame*, js::jit::ICFallbackStub*, js::jit::CacheKind&&, JS::MutableHandle<JS::Value>&, JS::Rooted<JS::Value>&) [clone .part.0]
/usr/lib64/firefox/libxul.so 0x58cc17f
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
4
js::jit::DoGetPropFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICFallbackStub*, JS::MutableHandle<JS::Value>, JS::MutableHandle<JS::Value>)
/usr/lib64/firefox/libxul.so 0x58d22f6
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
5
anonymous function
/usr/lib64/firefox/libxul.so 0xd04848a4b50 -
6
anonymous function
/usr/lib64/firefox/libxul.so 0xd04848abc0f -
7
anonymous function
/usr/lib64/firefox/libxul.so 0xd0484b387f3 -
8
anonymous function
/usr/lib64/firefox/libxul.so 0xd0484b5d753 -
9
anonymous function
/usr/lib64/firefox/libxul.so 0xd0484eabe58 -
10
anonymous function
/usr/lib64/firefox/libxul.so 0xd0484a0bada -
11
anonymous function
/usr/lib64/firefox/libxul.so 0xd0484af7bd0 -
12
anonymous function
/usr/lib64/firefox/libxul.so 0xd0484969b82 -
13
anonymous function
/usr/lib64/firefox/libxul.so 0xd0484a081a1 -
14
anonymous function
/usr/lib64/firefox/libxul.so 0xd0484af455b -
15
anonymous function
/usr/lib64/firefox/libxul.so 0xd0484ca857f -
16
anonymous function
/usr/lib64/firefox/libxul.so 0xd04848db635 -
17
anonymous function
/usr/lib64/firefox/libxul.so 0xd04849f2c11 -
18
anonymous function
/usr/lib64/firefox/libxul.so 0xd0484be8ab3 -
19
anonymous function
/usr/lib64/firefox/libxul.so 0xd0484969b82 -
20
anonymous function
/usr/lib64/firefox/libxul.so 0xd04849dcf83 -
21
anonymous function
/usr/lib64/firefox/libxul.so 0xd04849640f1 -
22
anonymous function
/usr/lib64/firefox/libxul.so 0xd04849db376 -
23
anonymous function
/usr/lib64/firefox/libxul.so 0xd04849640f1 -
24
anonymous function
/usr/lib64/firefox/libxul.so 0xd04849d6d0e -
25
anonymous function
/usr/lib64/firefox/libxul.so 0xd0484eabe58 -
26
anonymous function
/usr/lib64/firefox/libxul.so 0xd04849d55a9 -
27
anonymous function
/usr/lib64/firefox/libxul.so 0xd04848a23dd -
28
EnterJit(JSContext*, js::RunState&, unsigned char*)
/usr/lib64/firefox/libxul.so 0x5b7edc8
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
29
js::Interpret(JSContext*, js::RunState&)
/usr/lib64/firefox/libxul.so 0x5e6d463
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
30
js::RunScript(JSContext*, js::RunState&)
/usr/lib64/firefox/libxul.so 0x5e7b0f3
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
31
js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)
/usr/lib64/firefox/libxul.so 0x5e7b6cd
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
32
js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason)
/usr/lib64/firefox/libxul.so 0x5e7bb25
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
33
js::jit::InvokeFunction(JSContext*, JS::Handle<JSObject*>, bool, bool, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>)
/usr/lib64/firefox/libxul.so 0x59e5e75
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
34
js::jit::InvokeFromInterpreterStub(JSContext*, js::jit::InterpreterStubExitFrameLayout*)
/usr/lib64/firefox/libxul.so 0x59e623f
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
35
anonymous function
/usr/lib64/firefox/libxul.so 0xd04848a2c75 -
36
anonymous function
/usr/lib64/firefox/libxul.so 0xd0484969b82 -
37
anonymous function
/usr/lib64/firefox/libxul.so 0xd04848ac881 -
38
anonymous function
/usr/lib64/firefox/libxul.so 0xd0484a75cf0 -
39
anonymous function
/usr/lib64/firefox/libxul.so 0xd0484a765d1 -
40
anonymous function
/usr/lib64/firefox/libxul.so 0xd04848d68ee -
41
anonymous function
/usr/lib64/firefox/libxul.so 0xd04849621e9 -
42
anonymous function
/usr/lib64/firefox/libxul.so 0xd04848a23dd -
43
EnterJit(JSContext*, js::RunState&, unsigned char*)
/usr/lib64/firefox/libxul.so 0x5b7edc8
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
44
js::RunScript(JSContext*, js::RunState&)
/usr/lib64/firefox/libxul.so 0x5e7b05f
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
45
js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)
/usr/lib64/firefox/libxul.so 0x5e7b6cd
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
46
js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason)
/usr/lib64/firefox/libxul.so 0x5e7bb25
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
47
js::BoundFunctionObject::call(JSContext*, unsigned int, JS::Value*)
/usr/lib64/firefox/libxul.so 0x532c52c
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
48
js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)
/usr/lib64/firefox/libxul.so 0x5e7b437
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
49
js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason)
/usr/lib64/firefox/libxul.so 0x5e7bb25
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
50
JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)
/usr/lib64/firefox/libxul.so 0x5343429
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
51
mozilla::dom::EventListener::HandleEvent(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&)
/usr/lib64/firefox/libxul.so 0x26c73e6
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
52
mozilla::EventListenerManager::HandleEventSingleListener(mozilla::EventListenerManager::Listener*, nsAtom*, mozilla::WidgetEvent*, mozilla::dom::Event*, mozilla::dom::EventTarget*, bool)
/usr/lib64/firefox/libxul.so 0x2dc84f7
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
53
mozilla::EventListenerManager::HandleEventWithListenerArray(mozilla::EventListenerManager::ListenerArray*, nsAtom*, mozilla::EventMessage, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, bool)
/usr/lib64/firefox/libxul.so 0x2dc8a21
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
54
mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool)
/usr/lib64/firefox/libxul.so 0x2dc934b
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
55
mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&)
/usr/lib64/firefox/libxul.so 0x2dc9c10
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
56
mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&)
/usr/lib64/firefox/libxul.so 0x2dca2c8
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
57
mozilla::EventDispatcher::Dispatch(mozilla::dom::EventTarget*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*)
/usr/lib64/firefox/libxul.so 0x2dcc457
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
58
mozilla::AsyncEventDispatcher::RunDOMEventWhenSafe(nsINode&, mozilla::WidgetEvent&, nsEventStatus*)
/usr/lib64/firefox/libxul.so 0x2d7b0f7
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
59
nsContentUtils::DispatchInputEvent(mozilla::dom::Element*, mozilla::EventMessage, mozilla::EditorInputType, mozilla::EditorBase*, mozilla::InputEventOptions&&, nsEventStatus*)
/usr/lib64/firefox/libxul.so 0x198e9a7
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
60
mozilla::EditorBase::DispatchInputEvent()
/usr/lib64/firefox/libxul.so 0x458f168
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
61
mozilla::EditorBase::NotifyEditorObservers(mozilla::EditorBase::NotificationForEditorObservers)
/usr/lib64/firefox/libxul.so 0x458f65d
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
62
mozilla::EditorBase::EndPlaceholderTransaction(mozilla::EditorBase::ScrollSelectionIntoView, char const*) [clone .part.0]
/usr/lib64/firefox/libxul.so 0x458fa0a
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
63
mozilla::EditorBase::OnInputText(nsTSubstring<char16_t> const&)
/usr/lib64/firefox/libxul.so 0x4593244
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
64
mozilla::TextEditor::HandleKeyPressEvent(mozilla::WidgetKeyboardEvent*)
/usr/lib64/firefox/libxul.so 0x46c3ab2
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
65
mozilla::EditorEventListener::KeyPress(mozilla::WidgetKeyboardEvent*)
/usr/lib64/firefox/libxul.so 0x45f8daa
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
66
mozilla::EventListenerManager::HandleEventSingleListener(mozilla::EventListenerManager::Listener*, nsAtom*, mozilla::WidgetEvent*, mozilla::dom::Event*, mozilla::dom::EventTarget*, bool)
/usr/lib64/firefox/libxul.so 0x2dc82e5
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
67
mozilla::EventListenerManager::HandleEventWithListenerArray(mozilla::EventListenerManager::ListenerArray*, nsAtom*, mozilla::EventMessage, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, bool)
/usr/lib64/firefox/libxul.so 0x2dc8a21
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
68
mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool)
/usr/lib64/firefox/libxul.so 0x2dc934b
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
69
mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&)
/usr/lib64/firefox/libxul.so 0x2dc9c10
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
70
mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&)
/usr/lib64/firefox/libxul.so 0x2dca303
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
71
mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&)
/usr/lib64/firefox/libxul.so 0x2dca5e3
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
72
mozilla::EventDispatcher::Dispatch(mozilla::dom::EventTarget*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*)
/usr/lib64/firefox/libxul.so 0x2dcc457
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
73
mozilla::PresShell::EventHandler::DispatchEventToDOM(mozilla::WidgetEvent*, nsEventStatus*, nsPresShellEventCB*)
/usr/lib64/firefox/libxul.so 0x47dae01
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
74
mozilla::PresShell::EventHandler::DispatchEvent(mozilla::EventStateManager*, mozilla::WidgetEvent*, bool, nsEventStatus*, nsIContent*)
/usr/lib64/firefox/libxul.so 0x47db1c3
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
75
mozilla::PresShell::EventHandler::HandleEventWithCurrentEventInfo(mozilla::WidgetEvent*, nsEventStatus*, bool, nsIContent*)
/usr/lib64/firefox/libxul.so 0x47dc44a
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
76
mozilla::PresShell::EventHandler::HandleEventAtFocusedContent(mozilla::WidgetGUIEvent*, nsEventStatus*)
/usr/lib64/firefox/libxul.so 0x47deda6
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
77
mozilla::PresShell::HandleEvent(nsIFrame*, mozilla::WidgetGUIEvent*, bool, nsEventStatus*)
/usr/lib64/firefox/libxul.so 0x47de75a
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
78
nsViewManager::DispatchEvent(mozilla::WidgetGUIEvent*, nsView*, nsEventStatus*)
/usr/lib64/firefox/libxul.so 0x44017cf
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
79
nsView::HandleEvent(mozilla::WidgetGUIEvent*, bool)
/usr/lib64/firefox/libxul.so 0x4401977
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
80
mozilla::widget::PuppetWidget::DispatchEvent(mozilla::WidgetGUIEvent*, nsEventStatus&)
/usr/lib64/firefox/libxul.so 0x44502ac
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
81
mozilla::layers::APZCCallbackHelper::DispatchWidgetEvent(mozilla::WidgetGUIEvent&)
/usr/lib64/firefox/libxul.so 0x12f7d10
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
82
mozilla::dom::BrowserChild::RecvRealKeyEvent(mozilla::WidgetKeyboardEvent const&, nsID const&)
/usr/lib64/firefox/libxul.so 0x3edce01
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
83
mozilla::dom::PBrowserChild::OnMessageReceived(IPC::Message const&)
/usr/lib64/firefox/libxul.so 0x3fbdb1b
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
84
mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&)
/usr/lib64/firefox/libxul.so 0x3fc785c
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
85
mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&)
/usr/lib64/firefox/libxul.so 0xdacdbb
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
86
mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, std::unique_ptr<IPC::Message, std::default_delete<IPC::Message> >)
/usr/lib64/firefox/libxul.so 0xdbbe49
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
87
mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&)
/usr/lib64/firefox/libxul.so 0xdbc7bb
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
88
mozilla::ipc::MessageChannel::MessageTask::Run()
/usr/lib64/firefox/libxul.so 0xdbc978
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
89
mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)
/usr/lib64/firefox/libxul.so 0x55a632
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
90
mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)
/usr/lib64/firefox/libxul.so 0x55ab7b
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
91
mozilla::TaskController::ProcessPendingMTTask(bool)
/usr/lib64/firefox/libxul.so 0x55addd
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
92
mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::{lambda()#1}>::Run()
/usr/lib64/firefox/libxul.so 0x55aee6
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
93
nsThread::ProcessNextEvent(bool, bool*)
/usr/lib64/firefox/libxul.so 0x581f2e
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
94
NS_ProcessNextEvent(nsIThread*, bool)
/usr/lib64/firefox/libxul.so 0x582311
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
95
mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)
/usr/lib64/firefox/libxul.so 0xda1a7a
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
96
MessageLoop::Run()
/usr/lib64/firefox/libxul.so 0xd4f264
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
97
nsBaseAppShell::Run()
/usr/lib64/firefox/libxul.so 0x445604c
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
98
nsAppShell::Run()
/usr/lib64/firefox/libxul.so 0x4552aab
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
99
XRE_RunAppShell()
/usr/lib64/firefox/libxul.so 0x51e0651
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
100
MessageLoop::Run()
/usr/lib64/firefox/libxul.so 0xd4f264
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
101
XRE_InitChildProcess(int, char**, XREChildData const*)
/usr/lib64/firefox/libxul.so 0x51e11c0
Build id: fac3664b2aa08b5a0200090926f9a01f4389febb 		-
102
main
/usr/lib64/firefox/firefox 0x1fc4
Build id: d1859048e144b6d7f6ac0620f6bd80e7f73d3b49 		-
103
__libc_start_call_main
/lib64/libc.so.6 0x3575
Build id: 48c4b9b1efb1df15da8e787f489128bf31893317 		-
104
__libc_start_main@@GLIBC_2.34
/lib64/libc.so.6 0x3628
Build id: 48c4b9b1efb1df15da8e787f489128bf31893317 		-
105
_start
/usr/lib64/firefox/firefox 0x2615
Build id: d1859048e144b6d7f6ac0620f6bd80e7f73d3b49 		-