Crash in js::ShapeZone::fixupPropMapShapeTableAfterMovingGC()

Similar reports
Problem #524745
Component
firefox
Last affected version
0:107.0-4.fc35
Executable
/usr/lib64/firefox/firefox
Error name
SIGSEGV 11
First occurrence
2022-11-26
Last occurrence
2024-08-08
Unique reports
7
Quality
-58

Graphs

Statistics

Operating system Unique / Total count
Fedora 35 3 / 3
Fedora 36 3 / 3
Fedora 37 9 / 9
Fedora 38 7 / 12
Operating system Count
Fedora 38 12
Fedora 37 9
Fedora 35 3
Fedora 36 3
Architecture Count
x86_64 27
Related packages Count
firefox 4
 0:107.0-4.fc35 3
 0:106.0.1-1.fc37 1
liberation-sans-fonts 1
 1:2.1.5-3.fc37 1
dejavu-sans-fonts 1
 0:2.37-17.fc35 1

Packages names with count less than the total count of reports are most probably not the cause of the problem.

History

Daily:

Weekly:

Monthly:

No reports in the last 20 days.

No reports in the last 20 weeks.

History

Daily:

Weekly:

Monthly:

No reports in the last 20 days.

No reports in the last 20 weeks.


Backtrace

Frame # Function Binary Source or offset Line
1
js::ShapeZone::fixupPropMapShapeTableAfterMovingGC()
/usr/lib64/firefox/libxul.so 0x4e841c4
Build id: e3fd7d596da413016c46ad51ee54da08fe2075bd 		-
2
js::gc::GCRuntime::updateZonePointersToRelocatedCells(JS::Zone*)
/usr/lib64/firefox/libxul.so 0x514d55b
Build id: e3fd7d596da413016c46ad51ee54da08fe2075bd 		-
3
js::gc::GCRuntime::compactPhase(JS::GCReason, js::SliceBudget&, js::gc::AutoGCSession&)
/usr/lib64/firefox/libxul.so 0x514e305
Build id: e3fd7d596da413016c46ad51ee54da08fe2075bd 		-
4
js::gc::GCRuntime::incrementalSlice(js::SliceBudget&, JS::GCReason, bool)
/usr/lib64/firefox/libxul.so 0x514e94e
Build id: e3fd7d596da413016c46ad51ee54da08fe2075bd 		-
5
js::gc::GCRuntime::gcCycle(bool, js::SliceBudget const&, JS::GCReason)
/usr/lib64/firefox/libxul.so 0x514ee0b
Build id: e3fd7d596da413016c46ad51ee54da08fe2075bd 		-
6
js::gc::GCRuntime::collect(bool, js::SliceBudget const&, JS::GCReason)
/usr/lib64/firefox/libxul.so 0x514f03f
Build id: e3fd7d596da413016c46ad51ee54da08fe2075bd 		-
7
GarbageCollectImpl(JS::GCReason, nsJSContext::IsShrinking, js::SliceBudget const&)
/usr/lib64/firefox/libxul.so 0x1c0b04d
Build id: e3fd7d596da413016c46ad51ee54da08fe2075bd 		-
8
nsJSContext::RunIncrementalGCSlice(JS::GCReason, nsJSContext::IsShrinking, js::SliceBudget&)
/usr/lib64/firefox/libxul.so 0x1c131eb
Build id: e3fd7d596da413016c46ad51ee54da08fe2075bd 		-
9
mozilla::CCGCScheduler::GCRunnerFiredDoGC(mozilla::TimeStamp, mozilla::GCRunnerStep const&)
/usr/lib64/firefox/libxul.so 0x1a81012
Build id: e3fd7d596da413016c46ad51ee54da08fe2075bd 		-
10
mozilla::CCGCScheduler::GCRunnerFired(mozilla::TimeStamp)
/usr/lib64/firefox/libxul.so 0x1a87558
Build id: e3fd7d596da413016c46ad51ee54da08fe2075bd 		-
11
mozilla::IdleTaskRunner::Run() [clone .part.0]
/usr/lib64/firefox/libxul.so 0xc6b27c
Build id: e3fd7d596da413016c46ad51ee54da08fe2075bd 		-
12
mozilla::IdleTaskRunnerTask::Run()
/usr/lib64/firefox/libxul.so 0xc6b372
Build id: e3fd7d596da413016c46ad51ee54da08fe2075bd 		-
13
mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)
/usr/lib64/firefox/libxul.so 0xc965cd
Build id: e3fd7d596da413016c46ad51ee54da08fe2075bd 		-
14
mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)
/usr/lib64/firefox/libxul.so 0xc96bab
Build id: e3fd7d596da413016c46ad51ee54da08fe2075bd 		-
15
mozilla::TaskController::ProcessPendingMTTask(bool)
/usr/lib64/firefox/libxul.so 0xc96ce3
Build id: e3fd7d596da413016c46ad51ee54da08fe2075bd 		-
16
mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::{lambda()#1}>::Run()
/usr/lib64/firefox/libxul.so 0xc96d56
Build id: e3fd7d596da413016c46ad51ee54da08fe2075bd 		-
17
nsThread::ProcessNextEvent(bool, bool*)
/usr/lib64/firefox/libxul.so 0xc973f9
Build id: e3fd7d596da413016c46ad51ee54da08fe2075bd 		-
18
NS_ProcessNextEvent(nsIThread*, bool)
/usr/lib64/firefox/libxul.so 0xc837af
Build id: e3fd7d596da413016c46ad51ee54da08fe2075bd 		-
19
mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)
/usr/lib64/firefox/libxul.so 0x1315f5a
Build id: e3fd7d596da413016c46ad51ee54da08fe2075bd 		-
20
MessageLoop::Run()
/usr/lib64/firefox/libxul.so 0x12d3a02
Build id: e3fd7d596da413016c46ad51ee54da08fe2075bd 		-
21
nsBaseAppShell::Run()
/usr/lib64/firefox/libxul.so 0x37836ec
Build id: e3fd7d596da413016c46ad51ee54da08fe2075bd 		-
22
XRE_RunAppShell()
/usr/lib64/firefox/libxul.so 0x4c09f86
Build id: e3fd7d596da413016c46ad51ee54da08fe2075bd 		-
23
MessageLoop::Run()
/usr/lib64/firefox/libxul.so 0x12d3a02
Build id: e3fd7d596da413016c46ad51ee54da08fe2075bd 		-
24
XRE_InitChildProcess(int, char**, XREChildData const*)
/usr/lib64/firefox/libxul.so 0x4c0a42a
Build id: e3fd7d596da413016c46ad51ee54da08fe2075bd 		-
25
content_process_main(mozilla::Bootstrap*, int, char**)
/usr/lib64/firefox/firefox 0x1065a
Build id: 4e24af652ea2d5563f68436f317bf94d1e33f8dd 		-
26
main
/usr/lib64/firefox/firefox 0xfd2b
Build id: 4e24af652ea2d5563f68436f317bf94d1e33f8dd 		-
27
__libc_start_call_main
/lib64/libc.so.6 0x27510
Build id: 765237b0355c030ff41d969eedcb87bfccb43595 		-
28
__libc_start_main@@GLIBC_2.34
/lib64/libc.so.6 0x275c9
Build id: 765237b0355c030ff41d969eedcb87bfccb43595 		-
29
_start
/usr/lib64/firefox/firefox 0x10095
Build id: 4e24af652ea2d5563f68436f317bf94d1e33f8dd 		-