1413033 - Crash in js::ZoneGroup::enter called from AutoJSAPI::InitInternal()

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P2)

Description

[Randell Jesup [:jesup] (needinfo me)]

+++ This bug was initially created as a clone of Bug #1394223 +++


A second bug with this signature, called from dom::AutoJSAPI::InitInternal() via emplace()

Crashes are a mix of wildptrs and UAFs, and include EXEC crashes on wildptr's -> sec-critical

Comment 1

[Randell Jesup [:jesup] (needinfo me)]

https://crash-stats.mozilla.com/signature/?proto_signature=~InitInternal&signature=js%3A%3AZoneGroup%3A%3Aenter&date=%3E%3D2017-07-30T11%3A18%3A30.000Z&date=%3C2017-10-30T11%3A18%3A30.000Z&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=platform&_columns=reason&_columns=address&_columns=install_time&_sort=-date&page=1

Crashes start with 55.0.1, though only one crash there.  A bunch in 57, and one in 58.

Comment 2

[Liz Henry (:lizzard) (relman/hg->git project)]

Too late for 56, may be too late for 57 as we are heading into the RC build on Monday.

Comment 3

[Daniel Veditz [:dveditz]]

P1 is probably not right for a low volume crash; clearing for re-triage.

Comment 4

[Jason Orendorff [:jorendorff]]

Kannan?

Comment 5

[Frederik Braun [:freddy]]

Kannan, any updates on this bug? The needinfo has been pending for quite some time.

Comment 6

[Frederik Braun [:freddy]]

This bug has been left without any proper developer attention for almost half a year.
Steven, can you help assign this to someone with more bandwidth to fix it?

Comment 7

[Jan de Mooij [:jandem]]

Bug 1449135 removed ZoneGroup::enter so this signature is gone.