1473684 - Crash in mozilla::dom::binding_detail::GenericMethod<T>

Status: NEW

(Core :: DOM: Core & HTML, defect, P3)

Description

[[:philipp]]

This bug was filed from the Socorro interface and is
report bp-f7d46687-d0b2-4754-a583-556f10180705.
=============================================================

Top 10 frames of crashing thread:

0  @0xbf0bfd52 
1 xul.dll mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions> dom/bindings/BindingUtils.cpp:3285
2 xul.dll js::InternalCallOrConstruct js/src/vm/Interpreter.cpp:471
3 xul.dll static bool InternalCall js/src/vm/Interpreter.cpp:520
4 xul.dll static bool Interpret js/src/vm/Interpreter.cpp:3122
5 xul.dll js::RunScript js/src/vm/Interpreter.cpp:421
6 xul.dll js::InternalCallOrConstruct js/src/vm/Interpreter.cpp:493
7 xul.dll js::Call js/src/vm/Interpreter.cpp:539
8 xul.dll js::jit::InterpretResume js/src/jit/VMFunctions.cpp:943
9 xul.dll js::jit::ICMonitoredFallbackStub::addMonitorStubForValue js/src/jit/SharedIC.cpp:477

=============================================================

this is a low volume crash signature starting to show up across platforms in firefox 61.

Comment 1

[Ryan VanderMeulen [:RyanVM]]

Hi Boris, any idea what changes might have landed during the 61 cycle that could have caused this crash to appear?

Comment 2

[Boris Zbarsky [:bzbarsky]]

Well, bug 1451516 is an obvious option.  At least in terms of the stack looking different before then, because mozilla::dom::binding_detail::GenericMethod didn't exist.  What did exist was mozilla::dom::GenericBindingMethod and various genericMethod bits.

The crash is on line 3260 in the crashes are I see (on beta) which is the indirect call to the "method" we extract from the jitinfo.  So the best explanation is memory corruption there, I suspect. There are similar crashes under GenericMethod and genericMethod in 60, I think.

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

(crashes should be p1, but this doesn't look too actionable)

Comment 4

[Daniel Bodea [:danibodea]]

Can you provide some sort of reproduction steps that I could test?

Comment 5

[[:philipp]]

i don't know of any reproducible scenario unfortunately.

Comment 6

[Kris Maglione [:kmag]]

This is a low volume crash, and the reports mostly look like unrelated memory corruption. There is a possible exception for startup crashes while dispatching appstartup observer notifications, but those look like they come from a few corrupted installs.