Open Bug 1823738 Opened 2 years ago Updated 2 years ago

Crash [@ ArenaCollection::GetById] on ARM devices

Categories

(Core :: JavaScript Engine, defect, P5)

Product:
Core
Component:
JavaScript Engine
Platform:
ARM
Unspecified
Type:
defect

Tracking

()

People

(Reporter: calu, Unassigned)

References

(Blocks 2 open bugs)

Details

(Keywords: crash)

Crash Data

Severity: -- → S3
Type: task → defect
Hardware: Unspecified → ARM
Keywords: crash

So far, all these crashes seem to be from the same install, so dropping priority and severity.

Severity: S3 → S4
Crash Signature: ArenaCollection::GetById
Priority: -- → P5
Crash Signature: ArenaCollection::GetById → [@ ArenaCollection::GetById]

This is a crash in the memory allocator on startup.

Component: JavaScript Engine → Memory Allocator

The component has been changed since the backlog priority was decided, so we're resetting it.
For more information, please visit auto_nag documentation.

Priority: P5 → --

The allocator is crashing because it's been given a wrong arena id, which would come from the JS engine.

Component: Memory Allocator → JavaScript: WebAssembly

Every crash seems to be from an allocation in FutexThread::initialize() called by the AtomicsObject intialization. This looks like a general JS issue.

Component: JavaScript: WebAssembly → JavaScript Engine
Blocks: sm-runtime
Priority: -- → P5
You need to log in before you can comment on or make changes to this bug.