Crash in js::jit::JSJitFrameIter::operator++()

Similar reports
An owning problem doesn't exist yet.
Component
gnome-shell
Last affected version
0:48.8-1.fc42
Executable
/usr/bin/gnome-shell
Error name
SIGSEGV 11
First occurrence
2026-10-02
Last occurrence
2026-10-02
Unique reports
1
Quality
-157

Statistics

Operating system Unique / Total count
Fedora 42 1 / 1
Operating system Count
Fedora 42 1
Architecture Count
x86_64 1
Related packages Count
libdav1d 1
 0:1.5.3-1.fc42 1
librsvg2 1
 0:2.60.0-5.fc42 1
gnome-shell 1
 0:48.8-1.fc42 1

Packages names with count less than the total count of reports are most probably not the cause of the problem.

History

Daily:

Weekly:

Monthly:

No reports in the last 20 days.

History

Daily:

Weekly:

Monthly:

No reports in the last 20 days.


Backtrace

Frame # Function Binary Source or offset Line
1
js::jit::JSJitFrameIter::operator++()
/lib64/libmozjs-128.so.0 0x9d31ec
Build id: 32c1360af0ea23bfa5eb07af694ee19027ff37e2 		-
2
js::FrameIter::settleOnActivation()
/lib64/libmozjs-128.so.0 0x143f88
Build id: 32c1360af0ea23bfa5eb07af694ee19027ff37e2 		-
3
js::FrameIter::FrameIter(JSContext*, js::FrameIter::DebuggerEvalOption)
/lib64/libmozjs-128.so.0 0x1443e9
Build id: 32c1360af0ea23bfa5eb07af694ee19027ff37e2 		-
4
js::DumpBacktrace(JSContext*, js::GenericPrinter&)
/lib64/libmozjs-128.so.0 0x19ba1b
Build id: 32c1360af0ea23bfa5eb07af694ee19027ff37e2 		-
5
js::DumpBacktrace(JSContext*, _IO_FILE*)
/lib64/libmozjs-128.so.0 0x19b9bc
Build id: 32c1360af0ea23bfa5eb07af694ee19027ff37e2 		-
6
gjs_dumpstack
/lib64/libgjs.so.0 0xd6092
Build id: c4374eada8d3c2cecc2465df40fe2d027ca980b2 		-
7
dump_gjs_stack_on_signal_handler
/usr/bin/gnome-shell 0x1e78
Build id: 7c24dd68e1dac62d2a23446f5120d092ff7aa7ed 		-
8
/lib64/libc.so.6 0x1a040
Build id: 17a908195ad4110e58083fc22fd8ac486d01da53 		-
9
anonymous function
/lib64/libmozjs-128.so.0 0x3e6a3f1d0a02 -
10
anonymous function
/lib64/libmozjs-128.so.0 0x3e6a3f1d0f8e -
11
anonymous function
/lib64/libmozjs-128.so.0 0x3e6a3f2d27e4 -
12
anonymous function
/lib64/libmozjs-128.so.0 0x3e6a3f1d0f8e -
13
anonymous function
/lib64/libmozjs-128.so.0 0x3e6a3f2bec3d -
14
anonymous function
/lib64/libmozjs-128.so.0 0x3e6a3f1c04e6 -
15
js::jit::MaybeEnterJit(JSContext*, js::RunState&)
/lib64/libmozjs-128.so.0 0x9d3e36
Build id: 32c1360af0ea23bfa5eb07af694ee19027ff37e2 		-
16
js::Interpret(JSContext*, js::RunState&)
/lib64/libmozjs-128.so.0 0x3acdb
Build id: 32c1360af0ea23bfa5eb07af694ee19027ff37e2 		-
17
js::RunScript(JSContext*, js::RunState&)
/lib64/libmozjs-128.so.0 0x2ac4c
Build id: 32c1360af0ea23bfa5eb07af694ee19027ff37e2 		-
18
js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)
/lib64/libmozjs-128.so.0 0x2b3e0
Build id: 32c1360af0ea23bfa5eb07af694ee19027ff37e2 		-
19
js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason)
/lib64/libmozjs-128.so.0 0x2b9bc
Build id: 32c1360af0ea23bfa5eb07af694ee19027ff37e2 		-
20
JS_CallFunctionValue(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)
/lib64/libmozjs-128.so.0 0x104f26
Build id: 32c1360af0ea23bfa5eb07af694ee19027ff37e2 		-
21
GIWrapperBase<ObjectBase, ObjectPrototype, ObjectInstance>::constructor(JSContext*, unsigned int, JS::Value*)
/lib64/libgjs.so.0 0xa29b7
Build id: c4374eada8d3c2cecc2465df40fe2d027ca980b2 		-
22
InternalConstruct(JSContext*, js::AnyConstructArgs const&, js::CallReason) [clone .llvm.4258977928716040395]
/lib64/libmozjs-128.so.0 0x2bcb7
Build id: 32c1360af0ea23bfa5eb07af694ee19027ff37e2 		-
23
js::Construct(JSContext*, JS::Handle<JS::Value>, js::AnyConstructArgs const&, JS::Handle<JS::Value>, JS::MutableHandle<JSObject*>)
/lib64/libmozjs-128.so.0 0x2bfc0
Build id: 32c1360af0ea23bfa5eb07af694ee19027ff37e2 		-
24
js::SpreadCallOperation(JSContext*, JS::Handle<JSScript*>, unsigned char*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>)
/lib64/libmozjs-128.so.0 0x45b11
Build id: 32c1360af0ea23bfa5eb07af694ee19027ff37e2 		-
25
js::Interpret(JSContext*, js::RunState&)
/lib64/libmozjs-128.so.0 0x3a8e2
Build id: 32c1360af0ea23bfa5eb07af694ee19027ff37e2 		-
26
js::RunScript(JSContext*, js::RunState&)
/lib64/libmozjs-128.so.0 0x2ac4c
Build id: 32c1360af0ea23bfa5eb07af694ee19027ff37e2 		-
27
js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)
/lib64/libmozjs-128.so.0 0x2b3e0
Build id: 32c1360af0ea23bfa5eb07af694ee19027ff37e2 		-
28
js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason)
/lib64/libmozjs-128.so.0 0x2b9bc
Build id: 32c1360af0ea23bfa5eb07af694ee19027ff37e2 		-
29
js::jit::InvokeFunction(JSContext*, JS::Handle<JSObject*>, bool, bool, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>)
/lib64/libmozjs-128.so.0 0x751539
Build id: 32c1360af0ea23bfa5eb07af694ee19027ff37e2 		-
30
js::jit::InvokeFromInterpreterStub(JSContext*, js::jit::InterpreterStubExitFrameLayout*)
/lib64/libmozjs-128.so.0 0x751b8a
Build id: 32c1360af0ea23bfa5eb07af694ee19027ff37e2 		-
31
anonymous function
/lib64/libmozjs-128.so.0 0x3e6a3f1c0e95 -
32
anonymous function
/lib64/libmozjs-128.so.0 0x3e6a3f1d0f8e -
33
anonymous function
/lib64/libmozjs-128.so.0 0x3e6a3f1c9de1 -
34
anonymous function
/lib64/libmozjs-128.so.0 0x3e6a3f1c04e6 -
35
js::jit::EnterBaselineInterpreterAtBranch(JSContext*, js::InterpreterFrame*, unsigned char*)
/lib64/libmozjs-128.so.0 0x709761
Build id: 32c1360af0ea23bfa5eb07af694ee19027ff37e2 		-
36
js::Interpret(JSContext*, js::RunState&)
/lib64/libmozjs-128.so.0 0x2e8c9
Build id: 32c1360af0ea23bfa5eb07af694ee19027ff37e2 		-
37
js::RunScript(JSContext*, js::RunState&)
/lib64/libmozjs-128.so.0 0x2ac4c
Build id: 32c1360af0ea23bfa5eb07af694ee19027ff37e2 		-
38
js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)
/lib64/libmozjs-128.so.0 0x2b3e0
Build id: 32c1360af0ea23bfa5eb07af694ee19027ff37e2 		-
39
js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICFallbackStub*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>)
/lib64/libmozjs-128.so.0 0x6fdf97
Build id: 32c1360af0ea23bfa5eb07af694ee19027ff37e2 		-
40
anonymous function
/lib64/libmozjs-128.so.0 0x3e6a3f1c2834 -
41
anonymous function
/lib64/libmozjs-128.so.0 0x3e6a3f1c7be6 -
42
anonymous function
/lib64/libmozjs-128.so.0 0x3e6a3f1c9de1 -
43
anonymous function
/lib64/libmozjs-128.so.0 0x3e6a3f1c04e6 -
44
js::jit::MaybeEnterJit(JSContext*, js::RunState&)
/lib64/libmozjs-128.so.0 0x9d3e36
Build id: 32c1360af0ea23bfa5eb07af694ee19027ff37e2 		-
45
js::RunScript(JSContext*, js::RunState&)
/lib64/libmozjs-128.so.0 0x2ac20
Build id: 32c1360af0ea23bfa5eb07af694ee19027ff37e2 		-
46
js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)
/lib64/libmozjs-128.so.0 0x2b3e0
Build id: 32c1360af0ea23bfa5eb07af694ee19027ff37e2 		-
47
js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason)
/lib64/libmozjs-128.so.0 0x2b9bc
Build id: 32c1360af0ea23bfa5eb07af694ee19027ff37e2 		-
48
js::jit::InvokeFunction(JSContext*, JS::Handle<JSObject*>, bool, bool, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>)
/lib64/libmozjs-128.so.0 0x751539
Build id: 32c1360af0ea23bfa5eb07af694ee19027ff37e2 		-
49
js::jit::InvokeFromInterpreterStub(JSContext*, js::jit::InterpreterStubExitFrameLayout*)
/lib64/libmozjs-128.so.0 0x751b8a
Build id: 32c1360af0ea23bfa5eb07af694ee19027ff37e2 		-
50
anonymous function
/lib64/libmozjs-128.so.0 0x3e6a3f1c0e95 -
51
anonymous function
/lib64/libmozjs-128.so.0 0x3e6a3f1d0f8e -
52
anonymous function
/lib64/libmozjs-128.so.0 0x3e6a3f1c9de1 -
53
anonymous function
/lib64/libmozjs-128.so.0 0x3e6a3f2dc934 -
54
anonymous function
/lib64/libmozjs-128.so.0 0x3e6a3f1c04e6 -
55
js::jit::MaybeEnterJit(JSContext*, js::RunState&)
/lib64/libmozjs-128.so.0 0x9d3e36
Build id: 32c1360af0ea23bfa5eb07af694ee19027ff37e2 		-
56
js::RunScript(JSContext*, js::RunState&)
/lib64/libmozjs-128.so.0 0x2ac20
Build id: 32c1360af0ea23bfa5eb07af694ee19027ff37e2 		-
57
js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)
/lib64/libmozjs-128.so.0 0x2b3e0
Build id: 32c1360af0ea23bfa5eb07af694ee19027ff37e2 		-
58
js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason)
/lib64/libmozjs-128.so.0 0x2b9bc
Build id: 32c1360af0ea23bfa5eb07af694ee19027ff37e2 		-
59
js::CallSelfHostedFunction(JSContext*, JS::Handle<js::PropertyName*>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>)
/lib64/libmozjs-128.so.0 0x2529fd
Build id: 32c1360af0ea23bfa5eb07af694ee19027ff37e2 		-
60
AsyncFunctionResume(JSContext*, JS::Handle<js::AsyncFunctionGeneratorObject*>, ResumeKind, JS::Handle<JS::Value>) [clone .llvm.12949623784299436571]
/lib64/libmozjs-128.so.0 0xe4a56
Build id: 32c1360af0ea23bfa5eb07af694ee19027ff37e2 		-
61
PromiseReactionJob(JSContext*, unsigned int, JS::Value*)
/lib64/libmozjs-128.so.0 0x1fd767
Build id: 32c1360af0ea23bfa5eb07af694ee19027ff37e2 		-
62
js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)
/lib64/libmozjs-128.so.0 0x2b10e
Build id: 32c1360af0ea23bfa5eb07af694ee19027ff37e2 		-
63
js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason)
/lib64/libmozjs-128.so.0 0x2b9bc
Build id: 32c1360af0ea23bfa5eb07af694ee19027ff37e2 		-
64
JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)
/lib64/libmozjs-128.so.0 0x105c22
Build id: 32c1360af0ea23bfa5eb07af694ee19027ff37e2 		-
65
GjsContextPrivate::run_jobs_fallible() [clone .localalias]
/lib64/libgjs.so.0 0xbe94f
Build id: c4374eada8d3c2cecc2465df40fe2d027ca980b2 		-
66
GjsContextPrivate::runJobs(JSContext*)
/lib64/libgjs.so.0 0xbebec
Build id: c4374eada8d3c2cecc2465df40fe2d027ca980b2 		-
67
js::RunJobs(JSContext*)
/lib64/libmozjs-128.so.0 0x180063
Build id: 32c1360af0ea23bfa5eb07af694ee19027ff37e2 		-
68
Gjs::PromiseJobDispatcher::Source::{lambda(_GSource*, int (*)(void*), void*)#1}::_FUN(_GSource*, int (*)(void*), void*) [clone .lto_priv.0]
/lib64/libgjs.so.0 0xcdc04
Build id: c4374eada8d3c2cecc2465df40fe2d027ca980b2 		-
69
g_main_context_dispatch_unlocked.lto_priv.0
/lib64/libglib-2.0.so.0 0x40863
Build id: 3adead5a77684e5d72b61c7e0db58031a35baf58 		-
70
g_main_context_iterate_unlocked.isra.0
/lib64/libglib-2.0.so.0 0x497a8
Build id: 3adead5a77684e5d72b61c7e0db58031a35baf58 		-
71
g_main_context_iteration
/lib64/libglib-2.0.so.0 0x49953
Build id: 3adead5a77684e5d72b61c7e0db58031a35baf58 		-
72
Gjs::MainLoop::spin(GjsContextPrivate*)
/lib64/libgjs.so.0 0xc61a6
Build id: c4374eada8d3c2cecc2465df40fe2d027ca980b2 		-
73
gjs_context_eval_module
/lib64/libgjs.so.0 0xc1ac6
Build id: c4374eada8d3c2cecc2465df40fe2d027ca980b2 		-
74
gjs_context_eval_module_file
/lib64/libgjs.so.0 0xc1c12
Build id: c4374eada8d3c2cecc2465df40fe2d027ca980b2 		-
75
main
/usr/bin/gnome-shell 0x1331
Build id: 7c24dd68e1dac62d2a23446f5120d092ff7aa7ed 		-
76
__libc_start_call_main
/lib64/libc.so.6 0x3575
Build id: 17a908195ad4110e58083fc22fd8ac486d01da53 		-
77
__libc_start_main@@GLIBC_2.34
/lib64/libc.so.6 0x3628
Build id: 17a908195ad4110e58083fc22fd8ac486d01da53 		-
78
_start
/usr/bin/gnome-shell 0x1775
Build id: 7c24dd68e1dac62d2a23446f5120d092ff7aa7ed 		-