Crash in js::gc::AllocateCellInGC(JS::Zone*, js::gc::AllocKind)

Similar reports
Problem #285782
Component
firefox
Last affected version
0:95.0.2-2.fc35
Executable
/usr/lib64/firefox/firefox
Error name
SIGSEGV 11
First occurrence
2022-01-07
Last occurrence
2022-01-07
Unique reports
1
Quality
-28

Statistics

Operating system Unique / Total count
Fedora 35 1 / 1
Operating system Count
Fedora 35 1
Architecture Count
x86_64 1
Related packages Count
firefox 1
 0:95.0.2-2.fc35 1
google-noto-sans-cjk-ttc-fonts 1
 0:20201206-3.fc35 1

Packages names with count less than the total count of reports are most probably not the cause of the problem.

History

Daily:

Weekly:

Monthly:

No reports in the last 20 days.

No reports in the last 20 weeks.

No reports in the last 20 months.

History

Daily:

Weekly:

Monthly:

No reports in the last 20 days.

No reports in the last 20 weeks.

No reports in the last 20 months.


Backtrace

Frame # Function Binary Source or offset Line
1
js::gc::AllocateCellInGC(JS::Zone*, js::gc::AllocKind)
/usr/lib64/firefox/libxul.so 0x2ce0686
Build id: 91ee847e58990e1737ef635c229283b6e388fffb 		-
2
js::TenuringTracer::moveToTenuredSlow(JSObject*)
/usr/lib64/firefox/libxul.so 0x2ceb7d1
Build id: 91ee847e58990e1737ef635c229283b6e388fffb 		-
3
js::TenuringTracer::traverse(JS::Value*)
/usr/lib64/firefox/libxul.so 0x2ceb40a
Build id: 91ee847e58990e1737ef635c229283b6e388fffb 		-
4
js::gc::ArenaCellSet::trace(js::TenuringTracer&)
/usr/lib64/firefox/libxul.so 0x3d695b1
Build id: 91ee847e58990e1737ef635c229283b6e388fffb 		-
5
js::gc::StoreBuffer::WholeCellBuffer::trace(js::TenuringTracer&)
/usr/lib64/firefox/libxul.so 0x3d65c73
Build id: 91ee847e58990e1737ef635c229283b6e388fffb 		-
6
js::Nursery::traceRoots(js::gc::AutoGCSession&, js::TenuringTracer&)
/usr/lib64/firefox/libxul.so 0x3d5325d
Build id: 91ee847e58990e1737ef635c229283b6e388fffb 		-
7
js::Nursery::doCollection(JS::GCReason)
/usr/lib64/firefox/libxul.so 0x3d52e9c
Build id: 91ee847e58990e1737ef635c229283b6e388fffb 		-
8
js::Nursery::collect(JS::GCOptions, JS::GCReason)
/usr/lib64/firefox/libxul.so 0x3d529d4
Build id: 91ee847e58990e1737ef635c229283b6e388fffb 		-
9
js::gc::GCRuntime::collectNursery(JS::GCOptions, JS::GCReason, js::gcstats::PhaseKind)
/usr/lib64/firefox/libxul.so 0x3d4484a
Build id: 91ee847e58990e1737ef635c229283b6e388fffb 		-
10
js::gc::GCRuntime::minorGC(JS::GCReason, js::gcstats::PhaseKind)
/usr/lib64/firefox/libxul.so 0x3d446ab
Build id: 91ee847e58990e1737ef635c229283b6e388fffb 		-
11
JSObject* js::AllocateObject<(js::AllowGC)1>(JSContext*, js::gc::AllocKind, unsigned long, js::gc::InitialHeap, JSClass const*, js::gc::AllocSite*)
/usr/lib64/firefox/libxul.so 0x3d41634
Build id: 91ee847e58990e1737ef635c229283b6e388fffb 		-
12
js::CloneFunctionReuseScript(JSContext*, JS::Handle<JSFunction*>, JS::Handle<JSObject*>, JS::Handle<JSObject*>)
/usr/lib64/firefox/libxul.so 0x2c96e28
Build id: 91ee847e58990e1737ef635c229283b6e388fffb 		-
13
js::Lambda(JSContext*, JS::Handle<JSFunction*>, JS::Handle<JSObject*>)
/usr/lib64/firefox/libxul.so 0x2c76bf4
Build id: 91ee847e58990e1737ef635c229283b6e388fffb 		-
14
anonymous function
/home/faf/unknown filename 0x2b21cf20436e -