1527373 - Crash in [@ xpc::JSXrayTraits::getOwnPropertyFromTargetIfSafe]

Status: RESOLVED WORKSFORME

(Core :: XPConnect, defect, P3)

Description

[Marcia Knous [:marcia]]

This bug is for crash report bp-10a3774c-eb58-4fd7-8e3f-b8d8c0190212.

Seen while looking at 66 Fennec beta crash stats - this crash seems new to 66.0b6: https://bit.ly/2E5ZWtP. 20 crashes so far.

Correlations point to Adreno 530: (100.0% in signature vs 08.68% overall) adapter_device_id = Adreno (TM) 530 [100.0% vs 16.81% if adapter_vendor_id = Qualcomm]

Changelog between b5 and b6: https://hg.mozilla.org/releases/mozilla-beta/pushloghtml?fromchange=FENNEC_66_0b5_RELEASE&tochange=a9f6e3381fb3e64a6b872efa52a46afe4dd588e8&full=1

Top 10 frames of crashing thread:

0  @0xc77fc86c 
1 libxul.so xpc::JSXrayTraits::getOwnPropertyFromTargetIfSafe js/xpconnect/wrappers/XrayWrapper.cpp:334
2 libxul.so xpc::JSXrayTraits::getOwnPropertyFromWrapperIfSafe js/xpconnect/wrappers/XrayWrapper.cpp:289
3 libxul.so xpc::XrayWrapper<js::CrossCompartmentWrapper, xpc::JSXrayTraits>::getOwnPropertyDescriptor const js/xpconnect/wrappers/XrayWrapper.cpp:1894
4 libxul.so js::BaseProxyHandler::hasOwn const js/src/proxy/BaseProxyHandler.cpp:86
5 libxul.so js::Proxy::get js/src/proxy/Proxy.cpp:352
6 libxul.so js::GetElementsWithAdder js/src/vm/ObjectOperations-inl.h:114
7 libxul.so js::Proxy::getElements js/src/proxy/Proxy.cpp:661
8 libxul.so js::GetElements js/src/builtin/Array.cpp:457
9 libxul.so js::fun_apply js/src/vm/JSFunction.cpp:1212

Comment 1

[Marcia Knous [:marcia]]

No crashes yet in b7, will continue monitoring.

Comment 2

[Neha Kochar [:neha]]

Assigning P3 since there are no crashes on 66 beta7 (yet) and none on Nightly (since Nov 2018). Priority may need to be bumped up if the frequency increases.

Comment 3

[Neha Kochar [:neha]]

No crashes since 66 b7.

Comment 4

[Liz Henry (:lizzard) (relman/hg->git project)]

Interesting that this shows up again on 66.0.2. Maybe a compiler issue.

Comment 5

[Pascal Chevrel:pascalc]

Crashes only affect 66 so far

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.