1567902 - Crash in [@ nsXPConnect::InitStatics]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Marcia Knous [:marcia]]

Seen while looking at nightly crash stats - crashes started in 20190719215614: https://bit.ly/2JVVkbA. All crashes have MOZ_CRASH(InitSelfHostedCode failed).

Possible regression range based on Build ID: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=b3f5385fa0b37bca7c46269ff394aca964baec7c&tochange=23d4ebd5f8e70bb86f179556572b55655d6e066d

Comment 1

[Marcia Knous [:marcia]]

This has amassed 312 crashes, but only 31 installations so far. ni on Steven for triage since we are a few days in to the spike, and we should probably figure out what caused it.

Comment 2

[Steven DeTar [:sdetar]]

Ted, do you who would be a good person on the JS team to look at this?

Comment 3

[Daniel Veditz [:dveditz]]

I have a dead profile because of this bug. Other profiles work fine, my main one won't start any content processes anymore. The browser chrome and at least some chrome-privileged about: pages work (about:crashes, about:addons, about:support), but all I have is the main Firefox process and the Socket process. No child processes. In case it's a clue this seems to have started when my webextension process seemed to be "stuck" (high CPU, pages were frozen) so I killed it. After that browser is non-functional, even after restarting and updating.

A high number of today's crashes are from me. It seems to send off many crash reports every time I restart. More than I have windows (4), but fewer than I have tabs open (150-ish?). There are 10 new crashes each restart (one for each child process that didn't start?), but only 4 get submitted. The others show up in "unsubmitted" and fail when I try to manually submit them. Are these failures logged anywhere, and would that log be useful?

Anything you want me to preserve for investigation? Otherwise I think it's new-profile time.

Comment 4

[Daniel Veditz [:dveditz]]

InitSelfHostedCode only returns false for four reasons:

if (!rt->initializeAtoms(cx)) { ...
if (!rt->createJitRuntime(cx)) { ...
if (!rt->initSelfHosting(cx)) { ...
if (!rt->parentRuntime && !rt->initMainAtomsTables(cx)) { ...

Those all sound pretty generic. Which ones are going to depend on profile data?

Comment 5

[Ted Campbell [:tcampbell]]

Thanks for poking at this. Yeah, I'm a bit confused on which of those is affected by profile data. The rt->initSelfHosting will invoke the spidermonkey js frontend on a piece of JS that is burned into XUL.

The one wild theory that I am wondering about is if the watchdog timeout is corrupted and we are killing initSelfHosting as taking too long to start (based on a broken timeout value). This could also be consistent with webextensions process exploding since it also has a watchdog timer pref, and probably wouldn't like a stream of timeout exceptions being thrown.

There is an older variant with the same crash signature in Bug 1326539 that was never solved.

Comment 6

[Robert Strong (they/them - no direct email)]

Daniel, I had the same crash this morning and was able to narrow it down on my system to having javascript.options.strict set to true in my main profile. After removing that I no longer experienced the crash. Could you check if this is set in your profile and if so, does removing it resolve this for you?

Comment 7

[Jan de Mooij [:jandem]]

Good find! If I do a JS shell release build with local changes to set the extraWarnings flag before we call InitSelfHostedCode, I get this:

self-hosted:1700:39 mistyped ; after conditional?:
self-hosted:1700:39     if (!callFunction(ts.nextToken, ts)) ;;;
self-hosted:1700:39 .......................................^

Maybe we should always set extraWarnings when we compile self hosted code...

Comment 8

[Jan de Mooij [:jandem]]

(In reply to Jan de Mooij [:jandem] from comment #7)

Maybe we should always set extraWarnings when we compile self hosted code...

Oh, DEBUG builds already do that, but not release builds: https://searchfox.org/mozilla-central/rev/40e889be8ff926e32f7567957f4c316f14f6fbef/js/src/vm/SelfHosting.cpp#2980-2982

Comment 9

[André Bargull [:anba]]

Attachment: Bug 1567902: Don't emit an if-statement with an elided assertion in self-hosted code. r=jandem!

Because that breaks profiles where extra-warnings are set.

Comment 10

[André Bargull [:anba]]

Wow, that's unexpected. Sorry for the trouble!

Comment 11

[Jan de Mooij [:jandem]]

I filed bug 1568546 to prevent similar issues in the future.

Comment 12

[André Bargull [:anba]]

Try: https://treeherder.mozilla.org/#/jobs?repo=try&revision=631ab201b7641d46ded3c48abbfa6f883d0afe57

Comment 13

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/d21b28aecf43
Don't emit an if-statement with an elided assertion in self-hosted code. r=jandem

Comment 14

[Daniel Varga [:dvarga]]

https://hg.mozilla.org/mozilla-central/rev/d21b28aecf43