1596117 - Crash in [@ <name omitted> | XDRLazyClosedOverBindings<T>]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Marcia Knous [:marcia]]

This bug is for crash report bp-1cdc7564-569f-43ec-beec-bbbf80191111.

Small volume macOS crash which started in 20191110095330: https://bit.ly/2rz1M2v. Some code appears to have been touched in Bug 1587638. ni on :ianin for any clues

Possible regression range based on build id: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=caf55914ccddba34d462a1206530d7868b6c4992&tochange=72c52c0101cfd102b207224646c3007d6872e65c

Top 10 frames of crashing thread:

0 XUL <name omitted> js/src/vm/JSAtom.cpp:1262
1 XUL mozilla::Result<mozilla::Ok, JS::TranscodeResult> XDRLazyClosedOverBindings< js/src/vm/JSScript.cpp:257
2 XUL mozilla::Result<mozilla::Ok, JS::TranscodeResult> js::XDRLazyScript< js/src/vm/JSScript.cpp:1309
3 XUL mozilla::Result<mozilla::Ok, JS::TranscodeResult> js::XDRInterpretedFunction< js/src/vm/JSFunction.cpp:627
4 XUL mozilla::Result<mozilla::Ok, JS::TranscodeResult> js::XDRLazyScript< js/src/vm/JSScript.cpp:1319
5 XUL mozilla::Result<mozilla::Ok, JS::TranscodeResult> js::XDRInterpretedFunction< js/src/vm/JSFunction.cpp:627
6 XUL mozilla::Result<mozilla::Ok, JS::TranscodeResult> js::XDRScript< js/src/vm/JSScript.cpp:1184
7 XUL mozilla::Result<mozilla::Ok, JS::TranscodeResult> js::XDRInterpretedFunction< js/src/vm/JSFunction.cpp:629
8 XUL mozilla::Result<mozilla::Ok, JS::TranscodeResult> js::XDRScript< js/src/vm/JSScript.cpp:1184
9 XUL mozilla::Result<mozilla::Ok, JS::TranscodeResult> js::XDRInterpretedFunction< js/src/vm/JSFunction.cpp:629

Comment 1

[Iain Ireland [:iain]]

The line of code where this is crashing was added in bug 1587638, so this definitely seems related to that patch.

There are five crashes: three on 20191111215252 which all share one install time, and two on 20191110095330 which share another. Based on differing hardware, it doesn't look like all five crashes came from the same person

We crash while trying to retrieve an atom from the atom table during XDR decoding. This implies that either the index is wrong or the atom table pointer itself is bad. It's easiest to validate the index, so let's try doing that first and see if anybody else runs into the problem.

Comment 2

[Iain Ireland [:iain]]

Attachment: Bug 1596117: Fail early on bad atom table indices in XDR decoding r=tcampbell

Before we read an atom from the atom table, verify that the index is valid.

Instead of checking for null atoms when we read them out of the atom table, check when the atom table is created.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/f6825602e27a
Fail early on bad atom table indices in XDR decoding r=tcampbell

Comment 4

[Arthur Iakab [arthur_iakab]]

https://hg.mozilla.org/mozilla-central/rev/f6825602e27a

Comment 5

[[:philipp]]

the patch seems to have worked judging on last week's nightly crash data.