Crash in js::GenericTracerImpl<js::gc::MarkingTracerT<2u> >::onScriptEdge(js::BaseScript**, char const*)

Similar reports
An owning problem doesn't exist yet.
Component
firefox
Last affected version
0:137.0-2.fc40
Executable
/usr/lib64/firefox/firefox
Error name
SIGSEGV 11
First occurrence
2026-09-04
Last occurrence
2026-09-04
Unique reports
1
Quality
-94

Statistics

Operating system Unique / Total count
Fedora 40 1 / 1
Operating system Count
Fedora 40 1
Architecture Count
x86_64 1
Related packages Count
firefox 1
 0:137.0-2.fc40 1

Packages names with count less than the total count of reports are most probably not the cause of the problem.

History

Daily:

Weekly:

Monthly:

No reports in the last 20 days.

History

Daily:

Weekly:

Monthly:

No reports in the last 20 days.


Backtrace

Frame # Function Binary Source or offset Line
1
js::GenericTracerImpl<js::gc::MarkingTracerT<2u> >::onScriptEdge(js::BaseScript**, char const*)
/usr/lib64/firefox/libxul.so 0x3012d7b
Build id: b8c783537a078c39095535b827fa8d1f67443d65 		-
2
void js::jit::TraceCacheIRStub<js::jit::ICCacheIRStub>(JSTracer*, js::jit::ICCacheIRStub*, js::jit::CacheIRStubInfo const*)
/usr/lib64/firefox/libxul.so 0x2d13b8f
Build id: b8c783537a078c39095535b827fa8d1f67443d65 		-
3
js::jit::JitScript::trace(JSTracer*)
/usr/lib64/firefox/libxul.so 0x30253d1
Build id: b8c783537a078c39095535b827fa8d1f67443d65 		-
4
js::gc::ParallelMarkTask::run(js::AutoLockHelperThreadState&)
/usr/lib64/firefox/libxul.so 0x36f9b50
Build id: b8c783537a078c39095535b827fa8d1f67443d65 		-
5
js::GCParallelTask::runTask(JS::GCContext*, js::AutoLockHelperThreadState&)
/usr/lib64/firefox/libxul.so 0x31a1179
Build id: b8c783537a078c39095535b827fa8d1f67443d65 		-
6
js::GCParallelTask::runFromMainThread(js::AutoLockHelperThreadState&)
/usr/lib64/firefox/libxul.so 0x35854b7
Build id: b8c783537a078c39095535b827fa8d1f67443d65 		-
7
js::gc::ParallelMarker::markOneColor(js::gc::MarkColor, JS::SliceBudget const&)
/usr/lib64/firefox/libxul.so 0x36f8938
Build id: b8c783537a078c39095535b827fa8d1f67443d65 		-
8
js::gc::GCRuntime::markUntilBudgetExhausted(JS::SliceBudget&, js::gc::GCRuntime::ParallelMarking, js::gc::ShouldReportMarkTime)
/usr/lib64/firefox/libxul.so 0x358d160
Build id: b8c783537a078c39095535b827fa8d1f67443d65 		-
9
js::gc::GCRuntime::incrementalSlice(JS::SliceBudget&, JS::GCReason, bool)
/usr/lib64/firefox/libxul.so 0x2fb97f2
Build id: b8c783537a078c39095535b827fa8d1f67443d65 		-
10
js::gc::GCRuntime::gcCycle(bool, JS::SliceBudget const&, JS::GCReason)
/usr/lib64/firefox/libxul.so 0x358391c
Build id: b8c783537a078c39095535b827fa8d1f67443d65 		-
11
js::gc::GCRuntime::collect(bool, JS::SliceBudget const&, JS::GCReason)
/usr/lib64/firefox/libxul.so 0x3582e3b
Build id: b8c783537a078c39095535b827fa8d1f67443d65 		-
12
js::gc::GCRuntime::gcIfRequestedImpl(bool) [clone .isra.0]
/usr/lib64/firefox/libxul.so 0x2d571a5
Build id: b8c783537a078c39095535b827fa8d1f67443d65 		-
13
js::NativeObject::generateNewDictionaryShape(JSContext*, JS::Handle<js::NativeObject*>) [clone .cold]
/usr/lib64/firefox/libxul.so 0x1666d7
Build id: b8c783537a078c39095535b827fa8d1f67443d65 		-
14
js::NativeObject::addProperty(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::PropertyKey>, js::PropertyFlags, unsigned int*)
/usr/lib64/firefox/libxul.so 0x2b502ef
Build id: b8c783537a078c39095535b827fa8d1f67443d65 		-
15
js::CopyDataPropertiesNative(JSContext*, JS::Handle<js::PlainObject*>, JS::Handle<js::NativeObject*>, JS::Handle<js::PlainObject*>, bool*)
/usr/lib64/firefox/libxul.so 0x2c5e37d
Build id: b8c783537a078c39095535b827fa8d1f67443d65 		-
16
intrinsic_CopyDataPropertiesOrGetOwnKeys(JSContext*, unsigned int, JS::Value*) [clone .lto_priv.0]
/usr/lib64/firefox/libxul.so 0x317f04e
Build id: b8c783537a078c39095535b827fa8d1f67443d65 		-
17
anonymous function
/usr/lib64/firefox/libxul.so 0x9cb0c03a806 -
18
anonymous function
/usr/lib64/firefox/libxul.so 0x9cb0bf044e6 -
19
EnterJit(JSContext*, js::RunState&, unsigned char*) [clone .lto_priv.0]
/usr/lib64/firefox/libxul.so 0x2c00c2d
Build id: b8c783537a078c39095535b827fa8d1f67443d65 		-
20
js::Interpret(JSContext*, js::RunState&)
/usr/lib64/firefox/libxul.so 0x2b9165a
Build id: b8c783537a078c39095535b827fa8d1f67443d65 		-
21
js::RunScript(JSContext*, js::RunState&)
/usr/lib64/firefox/libxul.so 0x2b9035b
Build id: b8c783537a078c39095535b827fa8d1f67443d65 		-
22
js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)
/usr/lib64/firefox/libxul.so 0x2ba149a
Build id: b8c783537a078c39095535b827fa8d1f67443d65 		-
23
js::jit::InterpretResume(JSContext*, JS::Handle<JSObject*>, JS::Value*, JS::MutableHandle<JS::Value>)
/usr/lib64/firefox/libxul.so 0x2d06451
Build id: b8c783537a078c39095535b827fa8d1f67443d65 		-
24
anonymous function
/usr/lib64/firefox/libxul.so 0x9cb0bf07cef -
25
anonymous function
/usr/lib64/firefox/libxul.so 0x9cb0c057196 -
26
anonymous function
/usr/lib64/firefox/libxul.so 0x9cb0bf044e6 -
27
EnterJit(JSContext*, js::RunState&, unsigned char*) [clone .lto_priv.0]
/usr/lib64/firefox/libxul.so 0x2c00c2d
Build id: b8c783537a078c39095535b827fa8d1f67443d65 		-
28
js::RunScript(JSContext*, js::RunState&)
/usr/lib64/firefox/libxul.so 0x2b90389
Build id: b8c783537a078c39095535b827fa8d1f67443d65 		-
29
js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)
/usr/lib64/firefox/libxul.so 0x2ba149a
Build id: b8c783537a078c39095535b827fa8d1f67443d65 		-
30
AsyncFunctionResume(JSContext*, JS::Handle<js::AsyncFunctionGeneratorObject*>, ResumeKind, JS::Handle<JS::Value>)
/usr/lib64/firefox/libxul.so 0x2cebfc5
Build id: b8c783537a078c39095535b827fa8d1f67443d65 		-
31
PromiseReactionJob(JSContext*, unsigned int, JS::Value*) [clone .lto_priv.0]
/usr/lib64/firefox/libxul.so 0x2ceb81a
Build id: b8c783537a078c39095535b827fa8d1f67443d65 		-
32
js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)
/usr/lib64/firefox/libxul.so 0x2ba134a
Build id: b8c783537a078c39095535b827fa8d1f67443d65 		-
33
JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)
/usr/lib64/firefox/libxul.so 0x2ce2fbc
Build id: b8c783537a078c39095535b827fa8d1f67443d65 		-
34
mozilla::CycleCollectedJSContext::PerformMicroTaskCheckPoint(bool)
/usr/lib64/firefox/libxul.so 0x2ce1725
Build id: b8c783537a078c39095535b827fa8d1f67443d65 		-
35
XPCJSContext::AfterProcessTask(unsigned int)
/usr/lib64/firefox/libxul.so 0x2ce766b
Build id: b8c783537a078c39095535b827fa8d1f67443d65 		-
36
nsThread::ProcessNextEvent(bool, bool*)
/usr/lib64/firefox/libxul.so 0x2a7ca5c
Build id: b8c783537a078c39095535b827fa8d1f67443d65 		-
37
mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)
/usr/lib64/firefox/libxul.so 0x2db3802
Build id: b8c783537a078c39095535b827fa8d1f67443d65 		-
38
MessageLoop::Run()
/usr/lib64/firefox/libxul.so 0x3070eac
Build id: b8c783537a078c39095535b827fa8d1f67443d65 		-
39
nsBaseAppShell::Run()
/usr/lib64/firefox/libxul.so 0x331843d
Build id: b8c783537a078c39095535b827fa8d1f67443d65 		-
40
nsAppShell::Run()
/usr/lib64/firefox/libxul.so 0x33176c0
Build id: b8c783537a078c39095535b827fa8d1f67443d65 		-
41
mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)
/usr/lib64/firefox/libxul.so 0xb04615
Build id: b8c783537a078c39095535b827fa8d1f67443d65 		-
42
MessageLoop::Run()
/usr/lib64/firefox/libxul.so 0x3070eac
Build id: b8c783537a078c39095535b827fa8d1f67443d65 		-
43
XRE_InitChildProcess(int, char**, XREChildData const*)
/usr/lib64/firefox/libxul.so 0x22d46f3
Build id: b8c783537a078c39095535b827fa8d1f67443d65 		-
44
main
/usr/lib64/firefox/firefox 0x49517
Build id: 924cad6dc3d4b5346afaaec7bae8c59c6f301a06 		-
45
__libc_start_call_main
/lib64/libc.so.6 0x2a088
Build id: fc3b3c4da3283cd44c006682a30b9df3242de053 		-
46
__libc_start_main@@GLIBC_2.34
/lib64/libc.so.6 0x2a14b
Build id: fc3b3c4da3283cd44c006682a30b9df3242de053 		-
47
_start
/usr/lib64/firefox/firefox 0x464a5
Build id: 924cad6dc3d4b5346afaaec7bae8c59c6f301a06 		-