Crash in js::GCMarker::eagerlyMarkChildren(JSRope*)

Similar reports
Problem #824633
Component
firefox
Last affected version
0:93.0-2.fc35
Executable
/usr/lib64/firefox/firefox
Error name
SIGSEGV 11
First occurrence
2026-09-11
Last occurrence
2026-09-11
Unique reports
2
Quality
-16

Statistics

Operating system Unique / Total count
Fedora 35 2 / 2
Operating system Count
Fedora 35 2
Architecture Count
x86_64 2
Related packages Count
firefox 2
 0:93.0-2.fc35 2

Packages names with count less than the total count of reports are most probably not the cause of the problem.

History

Daily:

Weekly:

Monthly:

History

Daily:

Weekly:

Monthly:


Backtrace

Frame # Function Binary Source or offset Line
1
js::GCMarker::eagerlyMarkChildren(JSRope*)
/usr/lib64/firefox/libxul.so 0x3cbaec3
Build id: 6f3836f493101f0d5869c9524d84a5529e0c758a 		-
2
auto JS::MapGCThingTyped<js::GCMarker::traceBarrieredCell(JS::GCCellPtr)::{lambda(auto:1)#1}&>(JS::GCCellPtr, js::GCMarker::traceBarrieredCell(JS::GCCellPtr)::{lambda(auto:1)#1}&)
/usr/lib64/firefox/libxul.so 0x3cb9684
Build id: 6f3836f493101f0d5869c9524d84a5529e0c758a 		-
3
js::GCMarker::traceBarrieredCells(js::SliceBudget&)
/usr/lib64/firefox/libxul.so 0x3cb94f7
Build id: 6f3836f493101f0d5869c9524d84a5529e0c758a 		-
4
js::gc::BarrierTracer::handleBufferFull(JS::GCCellPtr)
/usr/lib64/firefox/libxul.so 0x2908c63
Build id: 6f3836f493101f0d5869c9524d84a5529e0c758a 		-
5
JSLinearString* JSRope::flattenInternal<(JSRope::UsingBarrier)1, char16_t>(JSRope*)
/usr/lib64/firefox/libxul.so 0x3bbe00c
Build id: 6f3836f493101f0d5869c9524d84a5529e0c758a 		-
6
JSRope::flatten(JSContext*)
/usr/lib64/firefox/libxul.so 0x2c58416
Build id: 6f3836f493101f0d5869c9524d84a5529e0c758a 		-
7
js::jit::CharCodeAt(JSContext*, JS::Handle<JSString*>, int, unsigned int*)
/usr/lib64/firefox/libxul.so 0x3d07f3c
Build id: 6f3836f493101f0d5869c9524d84a5529e0c758a 		-
8
anonymous function
/usr/lib64/firefox/libxul.so 0x1f79253462b8 -