
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [c:\Users\mozillaadmin\AppData\Local\CrashDumps\js-64-dm-windows-62f79d676e0e.exe.3256.dmp]
User Mini Dump File: Only registers, stack and portions of memory are available

Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path.           *
* Use .symfix to have the debugger choose a symbol path.                   *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
Windows 7 Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: SingleUserTS
Machine Name:
Debug session time: Fri Sep 23 17:52:12.000 2016 (UTC - 7:00)
System Uptime: not available
Process Uptime: 0 days 0:00:02.000
.........................................
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(cb8.7f8): Access violation - code c0000005 (first/second chance not available)
*** WARNING: Unable to verify checksum for js-64-dm-windows-62f79d676e0e.exe
js_64_dm_windows_62f79d676e0e!JSObject::allocKindForTenure+0x13:
00000001`3f869ff3 4c8b01          mov     r8,qword ptr [rcx] ds:2b2b2b2b`2b2b2b2b=????????????????
0:000> cdb: Reading initial command '$<c:\Users\mozillaadmin\funfuzz\util\cdbCmds.txt'
0:000> .echo Toggle for 32-bit/64-bit modes
Toggle for 32-bit/64-bit modes
0:000> .echo See http://people.mozilla.org/~aklotz/windbgcheatsheet.html
See http://people.mozilla.org/~aklotz/windbgcheatsheet.html
0:000> !wow64exts.sw
The current thread doesn't have an x86 context.
0:000> .echo Display lines in stack trace
Display lines in stack trace
0:000> .lines
Line number information will be loaded
0:000> .echo .ecxr switches to the exception context frame
.ecxr switches to the exception context frame
0:000> .ecxr
rax=000000013fcfeef0 rbx=0000000008d00420 rcx=2b2b2b2b2b2b2b2b
rdx=000000000681b940 rsi=000000000034c7b0 rdi=0000000008d00420
rip=000000013f869ff3 rsp=000000000034c4b0 rbp=fffe000000000000
 r8=000000000034c5b0  r9=000000000001fffc r10=000000000000061d
r11=000000000685a000 r12=000000013fd23a98 r13=fffa7fffffffffff
r14=000000000034d550 r15=0000000000000003
iopl=0         nv up ei pl nz na pe nc
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010200
js_64_dm_windows_62f79d676e0e!JSObject::allocKindForTenure+0x13:
00000001`3f869ff3 4c8b01          mov     r8,qword ptr [rcx] ds:2b2b2b2b`2b2b2b2b=????????????????
0:000> .echo Inspect program counter, equivalent of gdb's "x/i $pc"
Inspect program counter, equivalent of gdb's "x/i $pc"
0:000> u
js_64_dm_windows_62f79d676e0e!JSObject::allocKindForTenure+0x13 [c:\users\mozillaadmin\trees\mozilla-central\js\src\jsobj.cpp @ 3675]:
00000001`3f869ff3 4c8b01          mov     r8,qword ptr [rcx]
00000001`3f869ff6 4c3bc0          cmp     r8,rax
00000001`3f869ff9 7575            jne     js_64_dm_windows_62f79d676e0e!JSObject::allocKindForTenure+0x90 (00000001`3f86a070)
00000001`3f869ffb 4c8b4208        mov     r8,qword ptr [rdx+8]
00000001`3f869fff 488b4210        mov     rax,qword ptr [rdx+10h]
00000001`3f86a003 498d14c0        lea     rdx,[r8+rax*8]
00000001`3f86a007 4c3bc2          cmp     r8,rdx
00000001`3f86a00a 741f            je      js_64_dm_windows_62f79d676e0e!JSObject::allocKindForTenure+0x4b (00000001`3f86a02b)
0:000> .echo Inspect eip (32-bit) register, equivalent of gdb's "x/b $eax"
Inspect eip (32-bit) register, equivalent of gdb's "x/b $eax"
0:000> db @@c++(@eip) L4
00000000`3f869ff3  ?? ?? ?? ??                                      ????
0:000> .echo Inspect rip (64-bit) register, equivalent of gdb's "x/b $rax"
Inspect rip (64-bit) register, equivalent of gdb's "x/b $rax"
0:000> db @@c++(@rip) L8
00000001`3f869ff3  4c 8b 01 4c 3b c0 75 75                          L..L;.uu
0:000> .echo To switch frames: .frame /r /c <frame number>
To switch frames: .frame /r /c <frame number>
0:000> .echo Then inspect locals using: dv <locals in this frame>
Then inspect locals using: dv <locals in this frame>
0:000> .echo Running !analyze
Running !analyze
0:000> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntdll.dll -
***** OS symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ntdll!_PEB                                    ***
***                                                                   ***
*************************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!IMAGE_NT_HEADERS32                         ***
***                                                                   ***
*************************************************************************
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for kernel32.dll -
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ucrtbase.dll -

FAULTING_IP:
js_64_dm_windows_62f79d676e0e!JSObject::allocKindForTenure+13 [c:\users\mozillaadmin\trees\mozilla-central\js\src\jsobj.cpp @ 3675]
00000001`3f869ff3 4c8b01          mov     r8,qword ptr [rcx]

EXCEPTION_RECORD:  ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 000000013f869ff3 (js_64_dm_windows_62f79d676e0e!JSObject::allocKindForTenure+0x0000000000000013)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

PROCESS_NAME:  js-64-dm-windows-62f79d676e0e.exe

ADDITIONAL_DEBUG_TEXT:
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.

FAULTING_MODULE: 0000000077c90000 ntdll

DEBUG_FLR_IMAGE_TIMESTAMP:  57e305a4

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS:  ffffffffffffffff

FOLLOWUP_IP:
js_64_dm_windows_62f79d676e0e!JSObject::allocKindForTenure+13 [c:\users\mozillaadmin\trees\mozilla-central\js\src\jsobj.cpp @ 3675]
00000001`3f869ff3 4c8b01          mov     r8,qword ptr [rcx]

MOD_LIST: <ANALYSIS/>

FAULTING_THREAD:  00000000000007f8

BUGCHECK_STR:  APPLICATION_FAULT_INVALID_POINTER_READ_WRONG_SYMBOLS_FILL_PATTERN_2b2b2b2b

PRIMARY_PROBLEM_CLASS:  INVALID_POINTER_READ_FILL_PATTERN_2b2b2b2b

DEFAULT_BUCKET_ID:  INVALID_POINTER_READ_FILL_PATTERN_2b2b2b2b

LAST_CONTROL_TRANSFER:  from 000000013f93a984 to 000000013f869ff3

STACK_TEXT:
00000000`0034c4b0 00000001`3f93a984 : 00000000`0034c730 00000000`090bb400 00000000`0681b000 00000001`3f8254b9 : js_64_dm_windows_62f79d676e0e!JSObject::allocKindForTenure+0x13 [c:\users\mozillaadmin\trees\mozilla-central\js\src\jsobj.cpp @ 3675]
00000000`0034c4e0 00000001`3f92fe3c : 00000000`0034dd0a 00007fff`ffffffff fffe0000`00000000 00000000`00000000 : js_64_dm_windows_62f79d676e0e!js::TenuringTracer::moveToTenured+0x24 [c:\users\mozillaadmin\trees\mozilla-central\js\src\gc\marking.cpp @ 2396]
00000000`0034c520 00000001`3f93348f : 00000000`08e73103 00000000`0034c7b0 00000000`00000000 00000000`00000003 : js_64_dm_windows_62f79d676e0e!js::DispatchTyped<js::TenuringTraversalFunctor<JS::Value>,js::TenuringTracer * __ptr64 const>+0xac [c:\users\mozillaadmin\shell-cache\js-64-dm-windows-62f79d676e0e\objdir-js\dist\include\js\value.h @ 1916]
00000000`0034c550 00000001`3fb90421 : 00000000`0034c7b0 00000000`08e771a8 00000000`00000003 00000000`091ff448 : js_64_dm_windows_62f79d676e0e!js::TraceRootRange<JS::Value>+0xbf [c:\users\mozillaadmin\trees\mozilla-central\js\src\gc\marking.cpp @ 520]
00000000`0034c5b0 00000001`3f8c9da7 : 00000000`0917a2cd 00000000`0034c7b0 00000001`3f600000 00000000`00000000 : js_64_dm_windows_62f79d676e0e!js::jit::BaselineFrame::trace+0x2a1 [c:\users\mozillaadmin\trees\mozilla-central\js\src\jit\baselineframe.cpp @ 86]
00000000`0034c5f0 00000001`3f8c9f0d : 00000000`0034c7b0 00000000`0681b940 00000000`06824b00 00000000`0681b200 : js_64_dm_windows_62f79d676e0e!js::jit::MarkJitActivation+0xd7 [c:\users\mozillaadmin\trees\mozilla-central\js\src\jit\jitframes.cpp @ 1429]
00000000`0034c650 00000001`3f93f20e : 00000000`06824b00 00000000`06824b00 00000000`00000000 00000000`00000000 : js_64_dm_windows_62f79d676e0e!js::jit::MarkJitActivations+0x4d [c:\users\mozillaadmin\trees\mozilla-central\js\src\jit\jitframes.cpp @ 1455]
00000000`0034c690 00000001`3f9376c4 : 00000000`06824b00 00000000`0681b940 00000000`06824b00 00000000`06824b00 : js_64_dm_windows_62f79d676e0e!js::gc::GCRuntime::traceRuntimeCommon+0x5e [c:\users\mozillaadmin\trees\mozilla-central\js\src\gc\rootmarking.cpp @ 353]
00000000`0034c760 00000001`3f936e7d : 00000000`0034cc18 01d215fd`e1c035f9 00000000`06882080 00000000`00000000 : js_64_dm_windows_62f79d676e0e!js::Nursery::doCollection+0x454 [c:\users\mozillaadmin\trees\mozilla-central\js\src\gc\nursery.cpp @ 693]
00000000`0034c900 00000001`3f6762d6 : 00000000`0681b8f8 00000000`0034cae9 00000000`00000007 00000000`06882080 : js_64_dm_windows_62f79d676e0e!js::Nursery::collect+0x13d [c:\users\mozillaadmin\trees\mozilla-central\js\src\gc\nursery.cpp @ 581]
00000000`0034caa0 00000001`3f7ed102 : 00000000`0681b000 00000000`0681b8f8 00000000`0681b000 00000000`0681b8f8 : js_64_dm_windows_62f79d676e0e!js::gc::GCRuntime::minorGC+0xa6 [c:\users\mozillaadmin\trees\mozilla-central\js\src\jsgc.cpp @ 6521]
00000000`0034cb50 00000001`3f7e9447 : 00000000`0681b000 00000000`00000001 00000000`0684bb78 00000000`3a9da8e8 : js_64_dm_windows_62f79d676e0e!js::gc::GCRuntime::gcIfNeededPerAllocation+0x42 [c:\users\mozillaadmin\trees\mozilla-central\js\src\gc\allocator.cpp @ 230]
00000000`0034cb80 00000001`3f64c0c6 : 00000000`00000000 00000001`3fcb4058 00000000`00000000 00000000`00000001 : js_64_dm_windows_62f79d676e0e!js::Allocate<JSObject,1>+0x67 [c:\users\mozillaadmin\trees\mozilla-central\js\src\gc\allocator.cpp @ 47]
00000000`0034cbd0 00000001`3f86378f : 00000000`06884000 00000000`00000000 00000000`00000001 00000000`0034cca0 : js_64_dm_windows_62f79d676e0e!JSObject::create+0x96 [c:\users\mozillaadmin\trees\mozilla-central\js\src\jsobjinlines.h @ 378]
00000000`0034cc60 00000001`3f863e75 : 00000000`0681b000 00000000`0034cd38 00000001`3fcb4058 00000000`00000000 : js_64_dm_windows_62f79d676e0e!NewObject+0x16f [c:\users\mozillaadmin\trees\mozilla-central\js\src\jsobj.cpp @ 668]
00000000`0034cce0 00000001`3f891a5b : 00000000`0681b000 00000000`00000000 00000000`0034cdf0 00000000`0034cde8 : js_64_dm_windows_62f79d676e0e!js::NewObjectWithGivenTaggedProto+0x1a5 [c:\users\mozillaadmin\trees\mozilla-central\js\src\jsobj.cpp @ 727]
00000000`0034cd70 00000001`3f6e26b4 : fff90000`00000000 00000000`00000000 00000000`0034cf20 00000001`3fe0de70 : js_64_dm_windows_62f79d676e0e!js::ProxyObject::New+0x1db [c:\users\mozillaadmin\trees\mozilla-central\js\src\vm\proxyobject.cpp @ 60]
00000000`0034cea0 00000001`3f649d65 : 00000000`08e8d688 00000000`0034cf18 00000000`0034d501 00000000`0681b000 : js_64_dm_windows_62f79d676e0e!js::NewProxyObject+0x24 [c:\users\mozillaadmin\trees\mozilla-central\js\src\proxy\proxy.cpp @ 775]
00000000`0034cee0 00000001`3f713807 : 00000000`0034d030 00000000`0034d070 00000000`0681b000 fffe0000`00000000 : js_64_dm_windows_62f79d676e0e!js::TransparentObjectWrapper+0x95 [c:\users\mozillaadmin\trees\mozilla-central\js\src\proxy\wrapper.cpp @ 394]
00000000`0034cf70 00000001`3f6265f4 : 00000000`0034d0f8 00000000`0034d120 00000000`0034d0d8 00000001`3fc8d4f0 : js_64_dm_windows_62f79d676e0e!JSCompartment::wrap+0x457 [c:\users\mozillaadmin\trees\mozilla-central\js\src\jscompartment.cpp @ 445]
00000000`0034d0a0 00000001`3f6e41c2 : 00000000`0681b000 00000001`3fa6c5ca 00000000`0034d500 00000000`0681b000 : js_64_dm_windows_62f79d676e0e!JSCompartment::wrap+0x214 [c:\users\mozillaadmin\trees\mozilla-central\js\src\jscompartmentinlines.h @ 119]
00000000`0034d150 00000001`3f6e43a0 : 00000000`0681b000 00000001`3fe0de50 00000000`0034d250 00000000`00000000 : js_64_dm_windows_62f79d676e0e!js::CrossCompartmentWrapper::call+0x182 [c:\users\mozillaadmin\trees\mozilla-central\js\src\proxy\crosscompartmentwrapper.cpp @ 337]
00000000`0034d1b0 00000001`3f6e7dfd : 00000000`0681b000 00000000`0034d250 00000000`0034d370 00000000`00000002 : js_64_dm_windows_62f79d676e0e!js::Proxy::call+0xf0 [c:\users\mozillaadmin\trees\mozilla-central\js\src\proxy\proxy.cpp @ 402]
00000000`0034d210 00000001`3f8a5a1f : 00000000`0034ed50 00000000`08e90a88 00000000`0034d568 00000000`06884040 : js_64_dm_windows_62f79d676e0e!js::proxy_Call+0x7d [c:\users\mozillaadmin\trees\mozilla-central\js\src\proxy\proxy.cpp @ 690]
00000000`0034d270 00000001`3fb69cc0 : 00000000`00000001 00000000`00000001 00000000`0034d410 00000000`0917a2cd : js_64_dm_windows_62f79d676e0e!js::InternalCallOrConstruct+0x10f [c:\users\mozillaadmin\trees\mozilla-central\js\src\vm\interpreter.cpp @ 446]
00000000`0034d310 00000249`c09e1b33 : 00000000`091ff410 00000000`00003800 00002c77`00000055 00000000`00000001 : js_64_dm_windows_62f79d676e0e!js::jit::DoCallFallback+0x360 [c:\users\mozillaadmin\trees\mozilla-central\js\src\jit\baselineic.cpp @ 5998]
00000000`0034d470 00000000`091ff410 : 00000000`00003800 00002c77`00000055 00000000`00000001 00000000`0034d500 : 0x249`c09e1b33
00000000`0034d478 00000000`00003800 : 00002c77`00000055 00000000`00000001 00000000`0034d500 00000000`0034d4b8 : 0x91ff410
00000000`0034d480 00002c77`00000055 : 00000000`00000001 00000000`0034d500 00000000`0034d4b8 00000000`091f9300 : 0x3800
00000000`0034d488 00000000`00000001 : 00000000`0034d500 00000000`0034d4b8 00000000`091f9300 00000000`0034d4b8 : 0x2c77`00000055
00000000`0034d490 00000000`0034d500 : 00000000`0034d4b8 00000000`091f9300 00000000`0034d4b8 00000000`091ff398 : 0x1
00000000`0034d498 00000000`0034d4b8 : 00000000`091f9300 00000000`0034d4b8 00000000`091ff398 fff90000`00000000 : 0x34d500
00000000`0034d4a0 00000000`091f9300 : 00000000`0034d4b8 00000000`091ff398 fff90000`00000000 00000001`3fe1c5b0 : 0x34d4b8
00000000`0034d4a8 00000000`0034d4b8 : 00000000`091ff398 fff90000`00000000 00000001`3fe1c5b0 00000000`08e61520 : 0x91f9300
00000000`0034d4b0 00000000`091ff398 : fff90000`00000000 00000001`3fe1c5b0 00000000`08e61520 00000249`c09ea773 : 0x34d4b8
00000000`0034d4b8 fff90000`00000000 : 00000001`3fe1c5b0 00000000`08e61520 00000249`c09ea773 00000000`00004822 : 0x91ff398
00000000`0034d4c0 00000001`3fe1c5b0 : 00000000`08e61520 00000249`c09ea773 00000000`00004822 00000000`0034d568 : 0xfff90000`00000000
00000000`0034d4c8 00000000`08e61520 : 00000249`c09ea773 00000000`00004822 00000000`0034d568 00000000`091ff410 : js_64_dm_windows_62f79d676e0e!js::jit::DoCallFallbackInfo
00000000`0034d4d0 00000249`c09ea773 : 00000000`00004822 00000000`0034d568 00000000`091ff410 00000000`00000001 : 0x8e61520
00000000`0034d4d8 00000000`00004822 : 00000000`0034d568 00000000`091ff410 00000000`00000001 00000000`0034d500 : 0x249`c09ea773
00000000`0034d4e0 00000000`0034d568 : 00000000`091ff410 00000000`00000001 00000000`0034d500 fffe0000`08d00480 : 0x4822
00000000`0034d4e8 00000000`091ff410 : 00000000`00000001 00000000`0034d500 fffe0000`08d00480 fffe0000`08ea21c0 : 0x34d568
00000000`0034d4f0 00000000`00000001 : 00000000`0034d500 fffe0000`08d00480 fffe0000`08ea21c0 fffa8000`08e8d688 : 0x91ff410
00000000`0034d4f8 00000000`0034d500 : fffe0000`08d00480 fffe0000`08ea21c0 fffa8000`08e8d688 00000000`0034d598 : 0x1
00000000`0034d500 fffe0000`08d00480 : fffe0000`08ea21c0 fffa8000`08e8d688 00000000`0034d598 00000000`091ff410 : 0x34d500
00000000`0034d508 fffe0000`08ea21c0 : fffa8000`08e8d688 00000000`0034d598 00000000`091ff410 00000249`c09edf7d : 0xfffe0000`08d00480
00000000`0034d510 fffa8000`08e8d688 : 00000000`0034d598 00000000`091ff410 00000249`c09edf7d 00000000`00006821 : 0xfffe0000`08ea21c0
00000000`0034d518 00000000`0034d598 : 00000000`091ff410 00000249`c09edf7d 00000000`00006821 fffa8000`08e8d688 : 0xfffa8000`08e8d688
00000000`0034d520 00000000`091ff410 : 00000249`c09edf7d 00000000`00006821 fffa8000`08e8d688 fffe0000`08e74260 : 0x34d598
00000000`0034d528 00000249`c09edf7d : 00000000`00006821 fffa8000`08e8d688 fffe0000`08e74260 fffe0000`08e74280 : 0x91ff410
00000000`0034d530 00000000`00006821 : fffa8000`08e8d688 fffe0000`08e74260 fffe0000`08e74280 fffe0000`08d00420 : 0x249`c09edf7d
00000000`0034d538 fffa8000`08e8d688 : fffe0000`08e74260 fffe0000`08e74280 fffe0000`08d00420 fffa0000`0000000e : 0x6821
00000000`0034d540 fffe0000`08e74260 : fffe0000`08e74280 fffe0000`08d00420 fffa0000`0000000e fff90000`00000000 : 0xfffa8000`08e8d688
00000000`0034d548 fffe0000`08e74280 : fffe0000`08d00420 fffa0000`0000000e fff90000`00000000 00000000`00000000 : 0xfffe0000`08e74260
00000000`0034d550 fffe0000`08d00420 : fffa0000`0000000e fff90000`00000000 00000000`00000000 fff90000`00000000 : 0xfffe0000`08e74280
00000000`0034d558 fffa0000`0000000e : fff90000`00000000 00000000`00000000 fff90000`00000000 00000000`00000068 : 0xfffe0000`08d00420
00000000`0034d560 fff90000`00000000 : 00000000`00000000 fff90000`00000000 00000000`00000068 00000000`08e72040 : 0xfffa0000`0000000e
00000000`0034d568 00000000`00000000 : fff90000`00000000 00000000`00000068 00000000`08e72040 00000000`00000000 : 0xfff90000`00000000


STACK_COMMAND:  ~0s; .ecxr ; kb

FAULTING_SOURCE_CODE:
  3671:
  3672: js::gc::AllocKind
  3673: JSObject::allocKindForTenure(const js::Nursery& nursery) const
  3674: {
> 3675:     if (is<ArrayObject>()) {
  3676:         const ArrayObject& aobj = as<ArrayObject>();
  3677:         MOZ_ASSERT(aobj.numFixedSlots() == 0);
  3678:
  3679:         /* Use minimal size object if we are just going to copy the pointer. */
  3680:         if (!nursery.isInside(aobj.getElementsHeader()))


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  js_64_dm_windows!JSObject::allocKindForTenure+13

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: js_64_dm_windows_62f79d676e0e

IMAGE_NAME:  js-64-dm-windows-62f79d676e0e.exe

BUCKET_ID:  WRONG_SYMBOLS

FAILURE_BUCKET_ID:  INVALID_POINTER_READ_FILL_PATTERN_2b2b2b2b_c0000005_js-64-dm-windows-62f79d676e0e.exe!JSObject::allocKindForTenure

Followup: MachineOwner
---------

0:000> .echo Backtrace of faulting thread, limited to 50 frames
Backtrace of faulting thread, limited to 50 frames
0:000> ~#kn 50
 # Child-SP          RetAddr           Call Site
00 00000000`0034c4b0 00000001`3f93a984 js_64_dm_windows_62f79d676e0e!JSObject::allocKindForTenure+0x13 [c:\users\mozillaadmin\trees\mozilla-central\js\src\jsobj.cpp @ 3675]
01 00000000`0034c4e0 00000001`3f92fe3c js_64_dm_windows_62f79d676e0e!js::TenuringTracer::moveToTenured+0x24 [c:\users\mozillaadmin\trees\mozilla-central\js\src\gc\marking.cpp @ 2396]
02 00000000`0034c520 00000001`3f93348f js_64_dm_windows_62f79d676e0e!js::DispatchTyped<js::TenuringTraversalFunctor<JS::Value>,js::TenuringTracer * __ptr64 const>+0xac [c:\users\mozillaadmin\shell-cache\js-64-dm-windows-62f79d676e0e\objdir-js\dist\include\js\value.h @ 1916]
03 00000000`0034c550 00000001`3fb90421 js_64_dm_windows_62f79d676e0e!js::TraceRootRange<JS::Value>+0xbf [c:\users\mozillaadmin\trees\mozilla-central\js\src\gc\marking.cpp @ 520]
04 00000000`0034c5b0 00000001`3f8c9da7 js_64_dm_windows_62f79d676e0e!js::jit::BaselineFrame::trace+0x2a1 [c:\users\mozillaadmin\trees\mozilla-central\js\src\jit\baselineframe.cpp @ 86]
05 00000000`0034c5f0 00000001`3f8c9f0d js_64_dm_windows_62f79d676e0e!js::jit::MarkJitActivation+0xd7 [c:\users\mozillaadmin\trees\mozilla-central\js\src\jit\jitframes.cpp @ 1429]
06 00000000`0034c650 00000001`3f93f20e js_64_dm_windows_62f79d676e0e!js::jit::MarkJitActivations+0x4d [c:\users\mozillaadmin\trees\mozilla-central\js\src\jit\jitframes.cpp @ 1455]
07 00000000`0034c690 00000001`3f9376c4 js_64_dm_windows_62f79d676e0e!js::gc::GCRuntime::traceRuntimeCommon+0x5e [c:\users\mozillaadmin\trees\mozilla-central\js\src\gc\rootmarking.cpp @ 353]
08 00000000`0034c760 00000001`3f936e7d js_64_dm_windows_62f79d676e0e!js::Nursery::doCollection+0x454 [c:\users\mozillaadmin\trees\mozilla-central\js\src\gc\nursery.cpp @ 693]
09 00000000`0034c900 00000001`3f6762d6 js_64_dm_windows_62f79d676e0e!js::Nursery::collect+0x13d [c:\users\mozillaadmin\trees\mozilla-central\js\src\gc\nursery.cpp @ 581]
0a 00000000`0034caa0 00000001`3f7ed102 js_64_dm_windows_62f79d676e0e!js::gc::GCRuntime::minorGC+0xa6 [c:\users\mozillaadmin\trees\mozilla-central\js\src\jsgc.cpp @ 6521]
0b 00000000`0034cb50 00000001`3f7e9447 js_64_dm_windows_62f79d676e0e!js::gc::GCRuntime::gcIfNeededPerAllocation+0x42 [c:\users\mozillaadmin\trees\mozilla-central\js\src\gc\allocator.cpp @ 230]
0c 00000000`0034cb80 00000001`3f64c0c6 js_64_dm_windows_62f79d676e0e!js::Allocate<JSObject,1>+0x67 [c:\users\mozillaadmin\trees\mozilla-central\js\src\gc\allocator.cpp @ 47]
0d 00000000`0034cbd0 00000001`3f86378f js_64_dm_windows_62f79d676e0e!JSObject::create+0x96 [c:\users\mozillaadmin\trees\mozilla-central\js\src\jsobjinlines.h @ 378]
0e 00000000`0034cc60 00000001`3f863e75 js_64_dm_windows_62f79d676e0e!NewObject+0x16f [c:\users\mozillaadmin\trees\mozilla-central\js\src\jsobj.cpp @ 668]
0f 00000000`0034cce0 00000001`3f891a5b js_64_dm_windows_62f79d676e0e!js::NewObjectWithGivenTaggedProto+0x1a5 [c:\users\mozillaadmin\trees\mozilla-central\js\src\jsobj.cpp @ 727]
10 00000000`0034cd70 00000001`3f6e26b4 js_64_dm_windows_62f79d676e0e!js::ProxyObject::New+0x1db [c:\users\mozillaadmin\trees\mozilla-central\js\src\vm\proxyobject.cpp @ 60]
11 00000000`0034cea0 00000001`3f649d65 js_64_dm_windows_62f79d676e0e!js::NewProxyObject+0x24 [c:\users\mozillaadmin\trees\mozilla-central\js\src\proxy\proxy.cpp @ 775]
12 00000000`0034cee0 00000001`3f713807 js_64_dm_windows_62f79d676e0e!js::TransparentObjectWrapper+0x95 [c:\users\mozillaadmin\trees\mozilla-central\js\src\proxy\wrapper.cpp @ 394]
13 00000000`0034cf70 00000001`3f6265f4 js_64_dm_windows_62f79d676e0e!JSCompartment::wrap+0x457 [c:\users\mozillaadmin\trees\mozilla-central\js\src\jscompartment.cpp @ 445]
14 00000000`0034d0a0 00000001`3f6e41c2 js_64_dm_windows_62f79d676e0e!JSCompartment::wrap+0x214 [c:\users\mozillaadmin\trees\mozilla-central\js\src\jscompartmentinlines.h @ 119]
15 00000000`0034d150 00000001`3f6e43a0 js_64_dm_windows_62f79d676e0e!js::CrossCompartmentWrapper::call+0x182 [c:\users\mozillaadmin\trees\mozilla-central\js\src\proxy\crosscompartmentwrapper.cpp @ 337]
16 00000000`0034d1b0 00000001`3f6e7dfd js_64_dm_windows_62f79d676e0e!js::Proxy::call+0xf0 [c:\users\mozillaadmin\trees\mozilla-central\js\src\proxy\proxy.cpp @ 402]
17 00000000`0034d210 00000001`3f8a5a1f js_64_dm_windows_62f79d676e0e!js::proxy_Call+0x7d [c:\users\mozillaadmin\trees\mozilla-central\js\src\proxy\proxy.cpp @ 690]
18 00000000`0034d270 00000001`3fb69cc0 js_64_dm_windows_62f79d676e0e!js::InternalCallOrConstruct+0x10f [c:\users\mozillaadmin\trees\mozilla-central\js\src\vm\interpreter.cpp @ 446]
19 00000000`0034d310 00000249`c09e1b33 js_64_dm_windows_62f79d676e0e!js::jit::DoCallFallback+0x360 [c:\users\mozillaadmin\trees\mozilla-central\js\src\jit\baselineic.cpp @ 5998]
1a 00000000`0034d470 00000000`091ff410 0x249`c09e1b33
1b 00000000`0034d478 00000000`00003800 0x91ff410
1c 00000000`0034d480 00002c77`00000055 0x3800
1d 00000000`0034d488 00000000`00000001 0x2c77`00000055
1e 00000000`0034d490 00000000`0034d500 0x1
1f 00000000`0034d498 00000000`0034d4b8 0x34d500
20 00000000`0034d4a0 00000000`091f9300 0x34d4b8
21 00000000`0034d4a8 00000000`0034d4b8 0x91f9300
22 00000000`0034d4b0 00000000`091ff398 0x34d4b8
23 00000000`0034d4b8 fff90000`00000000 0x91ff398
24 00000000`0034d4c0 00000001`3fe1c5b0 0xfff90000`00000000
25 00000000`0034d4c8 00000000`08e61520 js_64_dm_windows_62f79d676e0e!js::jit::DoCallFallbackInfo
26 00000000`0034d4d0 00000249`c09ea773 0x8e61520
27 00000000`0034d4d8 00000000`00004822 0x249`c09ea773
28 00000000`0034d4e0 00000000`0034d568 0x4822
29 00000000`0034d4e8 00000000`091ff410 0x34d568
2a 00000000`0034d4f0 00000000`00000001 0x91ff410
2b 00000000`0034d4f8 00000000`0034d500 0x1
2c 00000000`0034d500 fffe0000`08d00480 0x34d500
2d 00000000`0034d508 fffe0000`08ea21c0 0xfffe0000`08d00480
2e 00000000`0034d510 fffa8000`08e8d688 0xfffe0000`08ea21c0
2f 00000000`0034d518 00000000`0034d598 0xfffa8000`08e8d688
30 00000000`0034d520 00000000`091ff410 0x34d598
31 00000000`0034d528 00000249`c09edf7d 0x91ff410
32 00000000`0034d530 00000000`00006821 0x249`c09edf7d
33 00000000`0034d538 fffa8000`08e8d688 0x6821
34 00000000`0034d540 fffe0000`08e74260 0xfffa8000`08e8d688
35 00000000`0034d548 fffe0000`08e74280 0xfffe0000`08e74260
36 00000000`0034d550 fffe0000`08d00420 0xfffe0000`08e74280
37 00000000`0034d558 fffa0000`0000000e 0xfffe0000`08d00420
38 00000000`0034d560 fff90000`00000000 0xfffa0000`0000000e
39 00000000`0034d568 00000000`00000000 0xfff90000`00000000
0:000> .echo Backtrace, limited to 50 frames (should execute after .ecxr)
Backtrace, limited to 50 frames (should execute after .ecxr)
0:000> kb 50
RetAddr           : Args to Child                                                           : Call Site
00000001`3f93a984 : 00000000`0034c730 00000000`090bb400 00000000`0681b000 00000001`3f8254b9 : js_64_dm_windows_62f79d676e0e!JSObject::allocKindForTenure+0x13 [c:\users\mozillaadmin\trees\mozilla-central\js\src\jsobj.cpp @ 3675]
00000001`3f92fe3c : 00000000`0034dd0a 00007fff`ffffffff fffe0000`00000000 00000000`00000000 : js_64_dm_windows_62f79d676e0e!js::TenuringTracer::moveToTenured+0x24 [c:\users\mozillaadmin\trees\mozilla-central\js\src\gc\marking.cpp @ 2396]
00000001`3f93348f : 00000000`08e73103 00000000`0034c7b0 00000000`00000000 00000000`00000003 : js_64_dm_windows_62f79d676e0e!js::DispatchTyped<js::TenuringTraversalFunctor<JS::Value>,js::TenuringTracer * __ptr64 const>+0xac [c:\users\mozillaadmin\shell-cache\js-64-dm-windows-62f79d676e0e\objdir-js\dist\include\js\value.h @ 1916]
00000001`3fb90421 : 00000000`0034c7b0 00000000`08e771a8 00000000`00000003 00000000`091ff448 : js_64_dm_windows_62f79d676e0e!js::TraceRootRange<JS::Value>+0xbf [c:\users\mozillaadmin\trees\mozilla-central\js\src\gc\marking.cpp @ 520]
00000001`3f8c9da7 : 00000000`0917a2cd 00000000`0034c7b0 00000001`3f600000 00000000`00000000 : js_64_dm_windows_62f79d676e0e!js::jit::BaselineFrame::trace+0x2a1 [c:\users\mozillaadmin\trees\mozilla-central\js\src\jit\baselineframe.cpp @ 86]
00000001`3f8c9f0d : 00000000`0034c7b0 00000000`0681b940 00000000`06824b00 00000000`0681b200 : js_64_dm_windows_62f79d676e0e!js::jit::MarkJitActivation+0xd7 [c:\users\mozillaadmin\trees\mozilla-central\js\src\jit\jitframes.cpp @ 1429]
00000001`3f93f20e : 00000000`06824b00 00000000`06824b00 00000000`00000000 00000000`00000000 : js_64_dm_windows_62f79d676e0e!js::jit::MarkJitActivations+0x4d [c:\users\mozillaadmin\trees\mozilla-central\js\src\jit\jitframes.cpp @ 1455]
00000001`3f9376c4 : 00000000`06824b00 00000000`0681b940 00000000`06824b00 00000000`06824b00 : js_64_dm_windows_62f79d676e0e!js::gc::GCRuntime::traceRuntimeCommon+0x5e [c:\users\mozillaadmin\trees\mozilla-central\js\src\gc\rootmarking.cpp @ 353]
00000001`3f936e7d : 00000000`0034cc18 01d215fd`e1c035f9 00000000`06882080 00000000`00000000 : js_64_dm_windows_62f79d676e0e!js::Nursery::doCollection+0x454 [c:\users\mozillaadmin\trees\mozilla-central\js\src\gc\nursery.cpp @ 693]
00000001`3f6762d6 : 00000000`0681b8f8 00000000`0034cae9 00000000`00000007 00000000`06882080 : js_64_dm_windows_62f79d676e0e!js::Nursery::collect+0x13d [c:\users\mozillaadmin\trees\mozilla-central\js\src\gc\nursery.cpp @ 581]
00000001`3f7ed102 : 00000000`0681b000 00000000`0681b8f8 00000000`0681b000 00000000`0681b8f8 : js_64_dm_windows_62f79d676e0e!js::gc::GCRuntime::minorGC+0xa6 [c:\users\mozillaadmin\trees\mozilla-central\js\src\jsgc.cpp @ 6521]
00000001`3f7e9447 : 00000000`0681b000 00000000`00000001 00000000`0684bb78 00000000`3a9da8e8 : js_64_dm_windows_62f79d676e0e!js::gc::GCRuntime::gcIfNeededPerAllocation+0x42 [c:\users\mozillaadmin\trees\mozilla-central\js\src\gc\allocator.cpp @ 230]
00000001`3f64c0c6 : 00000000`00000000 00000001`3fcb4058 00000000`00000000 00000000`00000001 : js_64_dm_windows_62f79d676e0e!js::Allocate<JSObject,1>+0x67 [c:\users\mozillaadmin\trees\mozilla-central\js\src\gc\allocator.cpp @ 47]
00000001`3f86378f : 00000000`06884000 00000000`00000000 00000000`00000001 00000000`0034cca0 : js_64_dm_windows_62f79d676e0e!JSObject::create+0x96 [c:\users\mozillaadmin\trees\mozilla-central\js\src\jsobjinlines.h @ 378]
00000001`3f863e75 : 00000000`0681b000 00000000`0034cd38 00000001`3fcb4058 00000000`00000000 : js_64_dm_windows_62f79d676e0e!NewObject+0x16f [c:\users\mozillaadmin\trees\mozilla-central\js\src\jsobj.cpp @ 668]
00000001`3f891a5b : 00000000`0681b000 00000000`00000000 00000000`0034cdf0 00000000`0034cde8 : js_64_dm_windows_62f79d676e0e!js::NewObjectWithGivenTaggedProto+0x1a5 [c:\users\mozillaadmin\trees\mozilla-central\js\src\jsobj.cpp @ 727]
00000001`3f6e26b4 : fff90000`00000000 00000000`00000000 00000000`0034cf20 00000001`3fe0de70 : js_64_dm_windows_62f79d676e0e!js::ProxyObject::New+0x1db [c:\users\mozillaadmin\trees\mozilla-central\js\src\vm\proxyobject.cpp @ 60]
00000001`3f649d65 : 00000000`08e8d688 00000000`0034cf18 00000000`0034d501 00000000`0681b000 : js_64_dm_windows_62f79d676e0e!js::NewProxyObject+0x24 [c:\users\mozillaadmin\trees\mozilla-central\js\src\proxy\proxy.cpp @ 775]
00000001`3f713807 : 00000000`0034d030 00000000`0034d070 00000000`0681b000 fffe0000`00000000 : js_64_dm_windows_62f79d676e0e!js::TransparentObjectWrapper+0x95 [c:\users\mozillaadmin\trees\mozilla-central\js\src\proxy\wrapper.cpp @ 394]
00000001`3f6265f4 : 00000000`0034d0f8 00000000`0034d120 00000000`0034d0d8 00000001`3fc8d4f0 : js_64_dm_windows_62f79d676e0e!JSCompartment::wrap+0x457 [c:\users\mozillaadmin\trees\mozilla-central\js\src\jscompartment.cpp @ 445]
00000001`3f6e41c2 : 00000000`0681b000 00000001`3fa6c5ca 00000000`0034d500 00000000`0681b000 : js_64_dm_windows_62f79d676e0e!JSCompartment::wrap+0x214 [c:\users\mozillaadmin\trees\mozilla-central\js\src\jscompartmentinlines.h @ 119]
00000001`3f6e43a0 : 00000000`0681b000 00000001`3fe0de50 00000000`0034d250 00000000`00000000 : js_64_dm_windows_62f79d676e0e!js::CrossCompartmentWrapper::call+0x182 [c:\users\mozillaadmin\trees\mozilla-central\js\src\proxy\crosscompartmentwrapper.cpp @ 337]
00000001`3f6e7dfd : 00000000`0681b000 00000000`0034d250 00000000`0034d370 00000000`00000002 : js_64_dm_windows_62f79d676e0e!js::Proxy::call+0xf0 [c:\users\mozillaadmin\trees\mozilla-central\js\src\proxy\proxy.cpp @ 402]
00000001`3f8a5a1f : 00000000`0034ed50 00000000`08e90a88 00000000`0034d568 00000000`06884040 : js_64_dm_windows_62f79d676e0e!js::proxy_Call+0x7d [c:\users\mozillaadmin\trees\mozilla-central\js\src\proxy\proxy.cpp @ 690]
00000001`3fb69cc0 : 00000000`00000001 00000000`00000001 00000000`0034d410 00000000`0917a2cd : js_64_dm_windows_62f79d676e0e!js::InternalCallOrConstruct+0x10f [c:\users\mozillaadmin\trees\mozilla-central\js\src\vm\interpreter.cpp @ 446]
00000249`c09e1b33 : 00000000`091ff410 00000000`00003800 00002c77`00000055 00000000`00000001 : js_64_dm_windows_62f79d676e0e!js::jit::DoCallFallback+0x360 [c:\users\mozillaadmin\trees\mozilla-central\js\src\jit\baselineic.cpp @ 5998]
00000000`091ff410 : 00000000`00003800 00002c77`00000055 00000000`00000001 00000000`0034d500 : 0x249`c09e1b33
00000000`00003800 : 00002c77`00000055 00000000`00000001 00000000`0034d500 00000000`0034d4b8 : 0x91ff410
00002c77`00000055 : 00000000`00000001 00000000`0034d500 00000000`0034d4b8 00000000`091f9300 : 0x3800
00000000`00000001 : 00000000`0034d500 00000000`0034d4b8 00000000`091f9300 00000000`0034d4b8 : 0x2c77`00000055
00000000`0034d500 : 00000000`0034d4b8 00000000`091f9300 00000000`0034d4b8 00000000`091ff398 : 0x1
00000000`0034d4b8 : 00000000`091f9300 00000000`0034d4b8 00000000`091ff398 fff90000`00000000 : 0x34d500
00000000`091f9300 : 00000000`0034d4b8 00000000`091ff398 fff90000`00000000 00000001`3fe1c5b0 : 0x34d4b8
00000000`0034d4b8 : 00000000`091ff398 fff90000`00000000 00000001`3fe1c5b0 00000000`08e61520 : 0x91f9300
00000000`091ff398 : fff90000`00000000 00000001`3fe1c5b0 00000000`08e61520 00000249`c09ea773 : 0x34d4b8
fff90000`00000000 : 00000001`3fe1c5b0 00000000`08e61520 00000249`c09ea773 00000000`00004822 : 0x91ff398
00000001`3fe1c5b0 : 00000000`08e61520 00000249`c09ea773 00000000`00004822 00000000`0034d568 : 0xfff90000`00000000
00000000`08e61520 : 00000249`c09ea773 00000000`00004822 00000000`0034d568 00000000`091ff410 : js_64_dm_windows_62f79d676e0e!js::jit::DoCallFallbackInfo
00000249`c09ea773 : 00000000`00004822 00000000`0034d568 00000000`091ff410 00000000`00000001 : 0x8e61520
00000000`00004822 : 00000000`0034d568 00000000`091ff410 00000000`00000001 00000000`0034d500 : 0x249`c09ea773
00000000`0034d568 : 00000000`091ff410 00000000`00000001 00000000`0034d500 fffe0000`08d00480 : 0x4822
00000000`091ff410 : 00000000`00000001 00000000`0034d500 fffe0000`08d00480 fffe0000`08ea21c0 : 0x34d568
00000000`00000001 : 00000000`0034d500 fffe0000`08d00480 fffe0000`08ea21c0 fffa8000`08e8d688 : 0x91ff410
00000000`0034d500 : fffe0000`08d00480 fffe0000`08ea21c0 fffa8000`08e8d688 00000000`0034d598 : 0x1
fffe0000`08d00480 : fffe0000`08ea21c0 fffa8000`08e8d688 00000000`0034d598 00000000`091ff410 : 0x34d500
fffe0000`08ea21c0 : fffa8000`08e8d688 00000000`0034d598 00000000`091ff410 00000249`c09edf7d : 0xfffe0000`08d00480
fffa8000`08e8d688 : 00000000`0034d598 00000000`091ff410 00000249`c09edf7d 00000000`00006821 : 0xfffe0000`08ea21c0
00000000`0034d598 : 00000000`091ff410 00000249`c09edf7d 00000000`00006821 fffa8000`08e8d688 : 0xfffa8000`08e8d688
00000000`091ff410 : 00000249`c09edf7d 00000000`00006821 fffa8000`08e8d688 fffe0000`08e74260 : 0x34d598
00000249`c09edf7d : 00000000`00006821 fffa8000`08e8d688 fffe0000`08e74260 fffe0000`08e74280 : 0x91ff410
00000000`00006821 : fffa8000`08e8d688 fffe0000`08e74260 fffe0000`08e74280 fffe0000`08d00420 : 0x249`c09edf7d
fffa8000`08e8d688 : fffe0000`08e74260 fffe0000`08e74280 fffe0000`08d00420 fffa0000`0000000e : 0x6821
fffe0000`08e74260 : fffe0000`08e74280 fffe0000`08d00420 fffa0000`0000000e fff90000`00000000 : 0xfffa8000`08e8d688
fffe0000`08e74280 : fffe0000`08d00420 fffa0000`0000000e fff90000`00000000 00000000`00000000 : 0xfffe0000`08e74260
fffe0000`08d00420 : fffa0000`0000000e fff90000`00000000 00000000`00000000 fff90000`00000000 : 0xfffe0000`08e74280
fffa0000`0000000e : fff90000`00000000 00000000`00000000 fff90000`00000000 00000000`00000068 : 0xfffe0000`08d00420
fff90000`00000000 : 00000000`00000000 fff90000`00000000 00000000`00000068 00000000`08e72040 : 0xfffa0000`0000000e
00000000`00000000 : fff90000`00000000 00000000`00000068 00000000`08e72040 00000000`00000000 : 0xfff90000`00000000
0:000> q
quit:
