Crash in js::gc::TenuringTracer::onObjectEdge(JSObject**, char const*)

Similar reports
An owning problem doesn't exist yet.
Component
firefox
Last affected version
0:149.0.2-1.fc42
Executable
/usr/lib64/firefox/firefox
Error name
SIGSEGV 11
First occurrence
2026-09-10
Last occurrence
2026-09-10
Unique reports
1
Quality
-66

Statistics

Operating system Unique / Total count
Fedora 42 1 / 1
Operating system Count
Fedora 42 1
Architecture Count
x86_64 1
Related packages Count
firefox 1
 0:149.0.2-1.fc42 1

Packages names with count less than the total count of reports are most probably not the cause of the problem.

History

Daily:

Weekly:

Monthly:

No reports in the last 20 days.

History

Daily:

Weekly:

Monthly:

No reports in the last 20 days.


Backtrace

Frame # Function Binary Source or offset Line
1
js::gc::TenuringTracer::onObjectEdge(JSObject**, char const*)
/usr/lib64/firefox/libxul.so 0x31bac58
Build id: 235b9a103625e93a98beeb768fe6c8e2a64f0e2a
-
2
js::gc::TenuringTracer::promoteGetterSetter(js::GetterSetter*)
/usr/lib64/firefox/libxul.so 0x31ba878
Build id: 235b9a103625e93a98beeb768fe6c8e2a64f0e2a
-
3
js::gc::TenuringTracer::traverse(JS::Value*)
/usr/lib64/firefox/libxul.so 0x31b9bb9
Build id: 235b9a103625e93a98beeb768fe6c8e2a64f0e2a
-
4
js::Nursery::doCollection(js::gc::AutoGCSession&, JS::GCOptions, JS::GCReason) [clone .isra.0]
/usr/lib64/firefox/libxul.so 0x31b75ff
Build id: 235b9a103625e93a98beeb768fe6c8e2a64f0e2a
-
5
js::Nursery::collect(JS::GCOptions, JS::GCReason)
/usr/lib64/firefox/libxul.so 0x3742213
Build id: 235b9a103625e93a98beeb768fe6c8e2a64f0e2a
-
6
js::gc::GCRuntime::collectNursery(JS::GCOptions, JS::GCReason, js::gcstats::PhaseKind)
/usr/lib64/firefox/libxul.so 0x3741f11
Build id: 235b9a103625e93a98beeb768fe6c8e2a64f0e2a
-
7
js::gc::GCRuntime::minorGC(JS::GCReason, js::gcstats::PhaseKind)
/usr/lib64/firefox/libxul.so 0x3741dae
Build id: 235b9a103625e93a98beeb768fe6c8e2a64f0e2a
-
8
void* js::gc::CellAllocator::RetryNurseryAlloc<(js::AllowGC)1>(JSContext*, JS::TraceKind, js::gc::AllocKind, unsigned long, js::gc::AllocSite*)
/usr/lib64/firefox/libxul.so 0x3741b35
Build id: 235b9a103625e93a98beeb768fe6c8e2a64f0e2a
-
9
js::ProxyObject::New(JSContext*, js::BaseProxyHandler const*, JS::Handle<JS::Value>, js::TaggedProto, JSClass const*)
/usr/lib64/firefox/libxul.so 0x3094499
Build id: 235b9a103625e93a98beeb768fe6c8e2a64f0e2a
-
10
js::Wrapper::New(JSContext*, JSObject*, js::Wrapper const*, js::WrapperOptions const&) [clone .constprop.0]
/usr/lib64/firefox/libxul.so 0x38594e9
Build id: 235b9a103625e93a98beeb768fe6c8e2a64f0e2a
-
11
xpc::WrapperFactory::Rewrap(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>)
/usr/lib64/firefox/libxul.so 0x385d516
Build id: 235b9a103625e93a98beeb768fe6c8e2a64f0e2a
-
12
JS::Compartment::getOrCreateWrapper(JSContext*, JS::Handle<JSObject*>, JS::MutableHandle<JSObject*>)
/usr/lib64/firefox/libxul.so 0x385d2e4
Build id: 235b9a103625e93a98beeb768fe6c8e2a64f0e2a
-
13
JS_WrapValue(JSContext*, JS::MutableHandle<JS::Value>)
/usr/lib64/firefox/libxul.so 0x30965eb
Build id: 235b9a103625e93a98beeb768fe6c8e2a64f0e2a
-
14
nsDOMMutationObserver::HandleMutationsInternal(mozilla::AutoSlowOperation&) [clone .cold]
/usr/lib64/firefox/libxul.so 0x3541dc
Build id: 235b9a103625e93a98beeb768fe6c8e2a64f0e2a
-
15
mozilla::RunMicroTask(JSContext*, JS::MutableHandle<mozilla::MustConsumeMicroTask>) [clone .lto_priv.0]
/usr/lib64/firefox/libxul.so 0x31f444a
Build id: 235b9a103625e93a98beeb768fe6c8e2a64f0e2a
-
16
mozilla::CycleCollectedJSContext::PerformMicroTaskCheckPoint(bool)
/usr/lib64/firefox/libxul.so 0x31f2276
Build id: 235b9a103625e93a98beeb768fe6c8e2a64f0e2a
-
17
_ZN7mozilla6detail21VariantImplementationIhLm0EJ13uninitialized8opAppend8opDetach27opAppendChildrenToNewParent14opFosterParent18opAppendToDocument15opAddAttributes19nsHtml5DocumentMode19opCreateHTMLElement18opCreateSVGElement21opCreateMathMLElement16opSetFormElement12opAppendText18opFosterParentText15opAppendComment25opAppendCommentToDocument25opAppendDoctypeToDocument32opGetDocumentFragmentForTemplate32opSetDocumentFragmentForTemplate23opGetShadowRootFromHost17opGetFosterParent14opMarkAsBroken38opRunScriptThatMayDocumentWriteOrBlock41opRunScriptThatCannotDocumentWriteOrBlock24opPreventScriptExecution20opDoneAddingChildren21opDoneCreatingElement21opUpdateCharsetSource17opCharsetSwitchTo18opUpdateStyleSheet24opProcessOfflineManifest23opMarkMalformedIfScript13opStreamEnded20opSetStyleLineNumber39opSetScriptLineAndColumnNumberAndFreeze9opSvgLoad27opMaybeComplainAboutCharset28opMaybeComplainAboutDeepTree10opAddClass19opAddViewSourceHref19opAddViewSourceBase14opAddErrorType17opAddLineNumberId13opStartLayout20opEnableEncodingMenu21opMicrotaskCheckpoint18opShallowCloneIntoEE5matchIZN20nsHtml5TreeOperation7PerformEP21nsHtml5TreeOpExecutorPP10nsIContentPbS1L_E20TreeOperationMatcherRNS_7VariantIJS2_S3_S4_S5_S6_S7_S8_S9_SA_SB_SC_SD_SE_SF_SG_SH_SI_SJ_SK_SL_SM_SN_SO_SP_SQ_SR_SS_ST_SU_SV_SW_SX_SY_SZ_S10_S11_S12_S13_S14_S15_S16_S17_S18_S19_S1A_S1B_S1C_EEEEEDcOT_OT0_.lto_priv.0
/usr/lib64/firefox/libxul.so 0x3c154dc
Build id: 235b9a103625e93a98beeb768fe6c8e2a64f0e2a
-
18
nsHtml5TreeOpExecutor::RunFlushLoop()
/usr/lib64/firefox/libxul.so 0x3c145cf
Build id: 235b9a103625e93a98beeb768fe6c8e2a64f0e2a
-
19
nsHtml5ExecutorReflusher::Run()
/usr/lib64/firefox/libxul.so 0xdb4e06
Build id: 235b9a103625e93a98beeb768fe6c8e2a64f0e2a
-
20
mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)
/usr/lib64/firefox/libxul.so 0x31f833c
Build id: 235b9a103625e93a98beeb768fe6c8e2a64f0e2a
-
21
mozilla::TaskController::ProcessPendingMTTask(bool)
/usr/lib64/firefox/libxul.so 0x31f7c0b
Build id: 235b9a103625e93a98beeb768fe6c8e2a64f0e2a
-
22
nsThread::ProcessNextEvent(bool, bool*)
/usr/lib64/firefox/libxul.so 0x2fabf48
Build id: 235b9a103625e93a98beeb768fe6c8e2a64f0e2a
-
23
mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)
/usr/lib64/firefox/libxul.so 0x32af6b2
Build id: 235b9a103625e93a98beeb768fe6c8e2a64f0e2a
-
24
MessageLoop::Run()
/usr/lib64/firefox/libxul.so 0x35ff973
Build id: 235b9a103625e93a98beeb768fe6c8e2a64f0e2a
-
25
nsBaseAppShell::Run()
/usr/lib64/firefox/libxul.so 0x38b377d
Build id: 235b9a103625e93a98beeb768fe6c8e2a64f0e2a
-
26
nsAppShell::Run()
/usr/lib64/firefox/libxul.so 0x38b26c4
Build id: 235b9a103625e93a98beeb768fe6c8e2a64f0e2a
-
27
mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)
/usr/lib64/firefox/libxul.so 0xc9ce78
Build id: 235b9a103625e93a98beeb768fe6c8e2a64f0e2a
-
28
MessageLoop::Run()
/usr/lib64/firefox/libxul.so 0x35ff973
Build id: 235b9a103625e93a98beeb768fe6c8e2a64f0e2a
-
29
XRE_InitChildProcess(int, char**, XREChildData const*)
/usr/lib64/firefox/libxul.so 0x2abc430
Build id: 235b9a103625e93a98beeb768fe6c8e2a64f0e2a
-
30
main
/usr/lib64/firefox/firefox 0x3ea83
Build id: c21c20fc9227979b4cb34d193d02f18e3c53591f
-
31
__libc_start_call_main
/lib64/libc.so.6 0x3575
Build id: 92b5376d35bb29c098175948cf3e7cbcae3aeae1
-
32
__libc_start_main@@GLIBC_2.34
/lib64/libc.so.6 0x3628
Build id: 92b5376d35bb29c098175948cf3e7cbcae3aeae1
-
33
_start
/usr/lib64/firefox/firefox 0x3c275
Build id: c21c20fc9227979b4cb34d193d02f18e3c53591f
-