1535346 - Crash in [@ JSAutoRealm::JSAutoRealm] - bad object pointer

Status: REOPENED

(Core :: JavaScript Engine, defect, P3)

Description

[Pascal Chevrel (relman team) -> :pascalc]

This bug is for crash report bp-75138ad3-55ba-4c40-a2dc-2ddf20190314.

Top 10 frames of crashing thread:

0 xul.dll JSAutoRealm::JSAutoRealm js/src/jsapi.cpp:565
1 xul.dll xpc::XrayWrapper<js::CrossCompartmentWrapper, xpc::JSXrayTraits>::getPrototype js/xpconnect/wrappers/XrayWrapper.cpp:2281
2  @0x24cc6f 
3 xul.dll js::Proxy::getPrototype js/src/proxy/Proxy.cpp:201
4 xul.dll static bool xpc::JSXrayTraits::getOwnPropertyFromTargetIfSafe js/xpconnect/wrappers/XrayWrapper.cpp:363
5 xul.dll static bool xpc::JSXrayTraits::getOwnPropertyFromWrapperIfSafe js/xpconnect/wrappers/XrayWrapper.cpp:287
6 xul.dll xpc::XrayWrapper<js::CrossCompartmentWrapper, xpc::JSXrayTraits>::getOwnPropertyDescriptor js/xpconnect/wrappers/XrayWrapper.cpp:1959
7 xul.dll js::BaseProxyHandler::hasOwn js/src/proxy/BaseProxyHandler.cpp:86
8 xul.dll js::Proxy::get js/src/proxy/Proxy.cpp:381
9 xul.dll js::GetProperty js/src/vm/Interpreter.cpp:4739

Comment 1

[Jason Orendorff [:jorendorff]]

Stacks are varied. The general situation is "someone got hold of a bad object pointer and is trying to enter the JS engine".

I don't see a way to pursue this.

Comment 2

[Marcia Knous [:marcia]]

It appears we have a spike in this signature in the Fennec 68.1 release: https://crash-stats.mozilla.org/signature/?signature=JSAutoRealm%3A%3AJSAutoRealm#summary. No particular trend in the URLs. APIs range from 16-28. Top crashing devices so far are two HUAWEI CLT-L29 and WAS-LX1A, followed by the Samsung Galaxy S5 mini.

Comment 3

[Ryan VanderMeulen [:RyanVM]]

Jason, this is spiking on Fennec 68.1 post-release. Can someone please take a look at the incoming reports and see if there's any correlations to be found?

Comment 4

[Jan de Mooij [:jandem]]

nullptr in XPConnect's ScriptPreloader.

Comment 5

[Marcia Knous [:marcia]]

[Tracking Requested - why for this release]: Nominating for tracking based on the volume and the fact it is a new crash.

Comment 6

[Kris Maglione [:kmag]]

(In reply to Marcia Knous [:marcia - needinfo? me] from comment #2)

It appears we have a spike in this signature in the Fennec 68.1 release: https://crash-stats.mozilla.org/signature/?signature=JSAutoRealm%3A%3AJSAutoRealm#summary. No particular trend in the URLs. APIs range from 16-28. Top crashing devices so far are two HUAWEI CLT-L29 and WAS-LX1A, followed by the Samsung Galaxy S5 mini.

Can you please file a separate bug for this? There are a lot of unrelated crashes with the same signature, and I don't want a fix for that single one to close this bug.

Comment 7

[Marcia Knous [:marcia]]

Created Bug 1579222 for the Fennec crash.

Comment 8

[Hani Yacoub, Desktop QA]

Closing this as resolved:worksforme since there were no crashes in the last 6 months for this signature.

Comment 9

[Hani Yacoub, Desktop QA]

I'll Reopen this bug again. There have been crashes with this signature.

Comment 10

[Wayne Mery (:wsmwk)]

(In reply to Jason Orendorff [:jorendorff] from comment #1)

Stacks are varied. The general situation is "someone got hold of a bad object pointer and is trying to enter the JS engine".
I don't see a way to pursue this.

Not useful keeping bug open for this case?

Comment 11

[Steven DeTar [:sdetar]]

Jan, could you help answer Wayne's question in Comment 10?

Comment 12

[Jan de Mooij [:jandem]]

We're still seeing a small number of crashes, so I think it's fine to leave this open.

Comment 13

[BugBot [:suhaib / :marco/ :calixte]]

Since the crash volume is low (less than 5 per week), the severity is downgraded to S3. Feel free to change it back if you think the bug is still critical.

For more information, please visit auto_nag documentation.