1470949 - Crash in static class js::NativeObject* CallTraceHook<T>

Status: RESOLVED DUPLICATE of bug 719114

(Core :: JavaScript: GC, defect)

Description

[Marcia Knous [:marcia]]

This bug was filed from the Socorro interface and is
report bp-68ebbc7e-3473-4556-8e68-98e9a0180625.
=============================================================

Seen while looking at 61 RC crash stats - it appears as if the crash is growing in the RC: https://bit.ly/2tqiyzc. Most of the crashes are EXCEPTION_ACCESS_VIOLATION_READ either EXCEPTION_ILLEGAL_INSTRUCTION.

Top 10 frames of crashing thread:

0 xul.dll static class js::NativeObject* CallTraceHook<TraverseObjectFunctor, js::GCMarker*, JSObject*&> js/src/gc/Marking.cpp:1572
1 xul.dll js::GCMarker::processMarkStackTop js/src/gc/Marking.cpp:1833
2 xul.dll js::GCMarker::drainMarkStack js/src/gc/Marking.cpp:1651
3 xul.dll js::gc::GCRuntime::drainMarkStack js/src/gc/GC.cpp:5903
4 xul.dll js::gc::GCRuntime::incrementalCollectSlice js/src/gc/GC.cpp:7116
5 xul.dll js::gc::GCRuntime::gcCycle js/src/gc/GC.cpp:7478
6 xul.dll js::gc::GCRuntime::collect js/src/gc/GC.cpp:7621
7 xul.dll js::gc::GCRuntime::gcSlice js/src/gc/GC.cpp:7710
8 xul.dll nsJSContext::GarbageCollectNow dom/base/nsJSEnvironment.cpp:1208
9 xul.dll InterSliceGCRunnerFired dom/base/nsJSEnvironment.cpp:1817

=============================================================

Comment 1

[Ryan VanderMeulen [:RyanVM]]

Hey Jon, does this stack tell you anything interesting?

Comment 2

[Jon Coppeard (:jonco)]

This looks like heap corruption.  We're crashing when we access either the group of a JSObject or the class pointer stored in the group (I can't tell because of inlining).  We're getting invalid pointers that are zero of close to zero.  May be UAF although seeing the poison value is rare.  No smoking gun.

Comment 3

[Liz Henry (:lizzard) (relman/hg->git project)]

May be security sensitive, hiding the bug. 
We'd like to keep an eye on the crashes as 61 rolls out.

Comment 4

[Andrew McCreight [:mccr8]]

This could just be a variant of bug 719114 (processMarkStackTop) where CallTraceHook didn't get inlined for whatever reason.