1595360 - Crash in [@ nsTSubstringTuple<T>::Length]

Status: RESOLVED FIXED

(External Software Affecting Firefox :: Other, defect)

Description

[Pascal Chevrel:pascalc]

This bug is for crash report bp-b1afda0b-baff-4b6c-b52a-7cf560191109.

Top 10 frames of crashing thread:

0 libxul.so nsTSubstringTuple<char>::Length const /build/firefox-gZLdr5/firefox-71.0~b8+build1/xpcom/string/nsTSubstringTuple.cpp:23
1 libxul.so nsTSubstringTuple<char>::Length const /build/firefox-gZLdr5/firefox-71.0~b8+build1/xpcom/string/nsTSubstringTuple.cpp:17
2 libxul.so nsTSubstringTuple<char>::Length const /build/firefox-gZLdr5/firefox-71.0~b8+build1/xpcom/string/nsTSubstringTuple.cpp:17
3 libxul.so nsTSubstring<char>::Assign /build/firefox-gZLdr5/firefox-71.0~b8+build1/xpcom/string/nsTSubstring.cpp:559
4 libxul.so nsTSubstring<char>::Assign /build/firefox-gZLdr5/firefox-71.0~b8+build1/xpcom/string/nsTSubstring.cpp:546
5 libxul.so mozilla::dom::indexedDB:: /build/firefox-gZLdr5/firefox-71.0~b8+build1/dom/indexedDB/ActorsParent.cpp:26326
6 libxul.so mozilla::dom::indexedDB:: /build/firefox-gZLdr5/firefox-71.0~b8+build1/dom/indexedDB/ActorsParent.cpp:21971
7 libxul.so mozilla::dom::indexedDB:: /build/firefox-gZLdr5/firefox-71.0~b8+build1/dom/indexedDB/ActorsParent.cpp:22136
8 libxul.so nsThread::ProcessNextEvent /build/firefox-gZLdr5/firefox-71.0~b8+build1/xpcom/threads/nsThread.cpp:1225
9 libxul.so NS_ProcessNextEvent /build/firefox-gZLdr5/firefox-71.0~b8+build1/xpcom/threads/nsThreadUtils.cpp:486

This is a new linux top crash that started yesterday. This could coincide with beta 8 release but according to Socorro the version affected is 71.b0 and some locales like 'und' are not locale codes we support. That makes we suspect that this is a distro provided beta build or a personal repository.

172 crashes since yesterday with these 2 buildids:
20191107154949
20191104205125

Almost all kernel versions are Ubuntu ones.

Comment 1

[Mats Palmgren (inactive)]

Fwiw, the stack above reminds me of bug 1594686, which also started with some mozilla::dom::indexedDB at the bottom before recursing into the String stuff I listed in that bug. Maybe these builds were also miscompiled in some way due to using an old compiler?

Comment 2

[Julien Cristau [:jcristau]]

https://launchpad.net/~mozillateam/+archive/ubuntu/firefox-next/+packages shows build logs with clang-6, e.g. https://launchpadlibrarian.net/450988112/buildlog_ubuntu-xenial-amd64.firefox_71.0~b9+build1-0ubuntu0.16.04.1_BUILDING.txt.gz

Comment 3

[Julien Cristau [:jcristau]]

This is also filed in ubuntu: https://bugs.launchpad.net/ubuntu/+source/firefox/+bug/1850529

Comment 4

[Gabriele Svelto [:gsvelto]]

This is an Ubuntu build of beta. All the beta versions they build show up as ".b0".

Comment 5

[Gabriele Svelto [:gsvelto]]

I skimmed the aggregations for this crash and all the crashes seem to be coming from Ubuntu 16.04, recent versions seem unaffected. It's possible this is a toolchain problem with that particular build.

Comment 6

[Pascal Chevrel:pascalc]

I am calling it fixed for 71 since we stopped receiving crashes from Ubuntu builds and the packagers know about the issue and are on it.