1459481 - Crash in js::OnlyJSJitFrameIter::OnlyJSJitFrameIter

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine: JIT, defect, P3)

Description

[[:philipp]]

This bug was filed from the Socorro interface and is
report bp-0a4c450a-6321-4e7b-8696-2c7c10180506.
=============================================================

Top 3 frames of crashing thread:

0 libxul.so js::OnlyJSJitFrameIter::OnlyJSJitFrameIter js/src/vm/Stack.cpp:638
1 libxul.so js::jit::GetPcScript js/src/jit/JitFrames.cpp:1333
2 libxul.so js::LiveSavedFrameCache::~LiveSavedFrameCache mfbt/Variant.h:672

=============================================================

this crash signature is showing up primarily on fennec since firefox 57 - i'm tentatively marking it as blocking bug 1384683.

Comment 1

[Nicolas B. Pierron [:nbp | PTO until 11/11]]

I do not understand how we could get crashes on the OnlyJSJitFrameIter constructors except if these were stack overflows.

Comment 2

[Hideki Saito]

I'm seeing 100% reproducible case of this issue with any articles on this site:

https://www.bengo4.com/c_1009/n_9103/

Android 9 Firefox 64.0.2

Comment 3

[Hideki Saito]

Just rule out about:config and extensions interfering, I've tried this under new profile accessing the URL above, immediately after Firefox install.

Still 100% issue and here's the crash report.

https://crash-stats.mozilla.com/report/index/a44b5e6c-8faa-448c-87c6-d71320190113

Comment 4

[Ryan VanderMeulen [:RyanVM]]

(In reply to Hideki Saito from comment #2)

I'm seeing 100% reproducible case of this issue with any articles on this
site:

https://www.bengo4.com/c_1009/n_9103/

I attempted to reproduce this on my Pixel 3 and was unable to with both 64.0.2 and current Nightly :(. I tried clicking around various links on the site to no avail.

Comment 5

[Hideki Saito]

It's Pixel 2 XL here. Anything I can try to help pinpoint the issue?

Comment 6

[Hideki Saito]

At least I'm not seeing this on beta and nightly. Will monitor the release.

Comment 7

[Hideki Saito]

I'm totally puzzled by this one. Just updated to 65.0 RC, still happening.

https://crash-stats.mozilla.com/report/index/86fc1fc8-4859-422b-b8bd-5b92f0190122

Doesn't happen on beta.

Only possible difference is that beta (installed from play ) is targeted to arm-unknown-linux-androideabi, while 64.0 installed from play store is aarch64-unknown-linux-android. I could only side load aarch64-unknown-linux-android and arm one fails to install, however.

Nightly is aarch64-unknown-linux-android but does not cause this crash...

Comment 8

[Hideki Saito]

I think I've pinpointed this one to aarch64-unknown-linux-android on both 64.0 and 65.0 RC1 -- uninstalling Firefox for Android and installing arm-unknown-linux-androideabi version (I used https://ftp.mozilla.org/pub/mobile/candidates/65.0-candidates/build1/android-api-16/multi/fennec-65.0.multi.android-arm.apk) fixed the problem.

Previously I could not load arm-unknown-linux-androideabi version as I had aarch64-unknown-linux-android in other profile (for testing in relatively pristine environment.

Removing aarch64-unknown-linux-android from other profile, and reinstalling it on my main profile didn't resolve the issue, so it sounds like to me some incompatibilities with aarch64-unknown-linux-android binary on Pixel 2 XL (which seems to be the one installed when it is loaded from Play Store for 64.0. Beta version I downloaded through Play Store, as I stated earlier was arm-unknown-linux-androideabi.

Comment 9

[Julien Cristau [:jcristau]]

re comment 7 and comment 8, there is no aarch64 build on the play store for anything but nightly (66.0a1) at this point.

Comment 10

[Hideki Saito]

(In reply to Julien Cristau [:jcristau] from comment #9)

re comment 7 and comment 8, there is no aarch64 build on the play store for anything but nightly (66.0a1) at this point.

Umm, wonder if some sort of caching took place... In any case this may be red herring...

Comment 11

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.