1353621 - Crash in js::GCMarker::eagerlyMarkChildren

Status: RESOLVED INCOMPLETE

(Core :: JavaScript: GC, defect, P5)

Description

[Randell Jesup [:jesup] (needinfo me)]

This bug was filed from the Socorro interface and is 
report bp-2b585805-ea05-42b2-a990-86a892170403.
=============================================================

a small number of clear UAF crashes here.  15000 crashes in the last week with this signature, most with random addresses. Appears to go back to FF40 or earlier, but didn't check the call-stacks.

Sec-high, but given risk of UAFs in GC perhaps critical is worth considering.

See also a fairly hot intermittent, bug 1337578 (with about a dozen others duped to it), which from a short look at a few logs appears to be all 0x0 or 0xfffffff8 or so.

Andrew or Steve, can you look into this or revector to the right person?  thanks

Comment 1

[Randell Jesup [:jesup] (needinfo me)]

Forgot to actually NI....
Andrew or Steve, can you look into this or revector to the right person?  thanks

Comment 2

[Andrew McCreight [:mccr8]]

sfink and jonco work on the GC.

Comment 3

[Andrew McCreight [:mccr8]]

Jon has a patch for a 54 regression in this signature in bug 1337578.

Comment 4

[Frederik Braun [:freddy]]

Seems this was killed with bug 1337578, no?

Comment 5

[Jon Coppeard (:jonco)]

(In reply to Frederik Braun [:freddyb] from comment #4)
That fix only affected 54 onwards so the intermittent test failures should be gone but I expect these crashes are still happening.

Comment 6

[Stephanie Ouillon [:arroway] (needinfo me)]

Jon, what's the next step to get this bug fixed? Can you look into it?

Comment 7

[Jon Coppeard (:jonco)]

This is a pretty wide signature that will catch any marking crashes due to heap corruption or bad RAM.  Without STR it's hard to make any improvement here.

Comment 8

[Wennie]

Hi Jon:

I have assigned these security bugs to you to reassign them to appropriate developers in your team to investigate and fix them.

Thanks!

Wennie

Comment 9

[Ted Campbell [:tcampbell]]

Stalled. This is a broad GC signature that could be caused by a variety of bad hardware or real bugs and has not been actionable.

Comment 10

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

We are reviewing and closing unactionable stalled bugs.

Comment 11

[BugBot (nomail) [:suhaib / :marco/ :calixte]]

Since the bug is closed, the stalled keyword is now meaningless.
For more information, please visit BugBot documentation.