1650745 - Crash in [@ mozilla::dom::ScriptLoader::EncodeBytecode]

Status: RESOLVED FIXED

(Core :: Performance, defect, P2)

Description

[Gabriele Svelto [:gsvelto] (PTO)]

This bug is for crash report bp-0f7bd42a-e321-4ee3-9b9a-7194d0200702.

Top 10 frames of crashing thread:

0 xul.dll mozilla::dom::ScriptLoader::EncodeBytecode dom/script/ScriptLoader.cpp:3099
1 xul.dll mozilla::detail::RunnableMethodImpl< xpcom/threads/nsThreadUtils.h:1240
2 xul.dll mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal xpcom/threads/TaskController.cpp:459
3 xul.dll mozilla::detail::RunnableFunction<`lambda at /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:82:7'>::Run xpcom/threads/nsThreadUtils.h:577
4 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1234
5 xul.dll NS_ProcessNextEvent xpcom/threads/nsThreadUtils.cpp:513
6 xul.dll mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:87
7 xul.dll MessageLoop::RunHandler ipc/chromium/src/base/message_loop.cc:327
8 xul.dll MessageLoop::Run ipc/chromium/src/base/message_loop.cc:309
9 xul.dll nsBaseAppShell::Run widget/nsBaseAppShell.cpp:137

Disregard the crashes that aren't in nightly because they're unrelated. This is a NULL pointer exception which started with buildid 20200610214041. Given the date and the fact that the crash is happening in a runnable I suspect that this might be a regression from bug 1606652. Denis, can you have a look and check if my hunch is correct?

Comment 1

[Gabriele Svelto [:gsvelto] (PTO)]

We don't have an STR but here's a couple of URLs where more than one user experienced this crash:

• http://www.bom.gov.au/places/vic/heidelberg-heights/
• https://kakaku.com/item/K0001093928/
• https://marketplace.visualstudio.com/items?itemName=timonwong.shellcheck

Comment 2

[Denis Palmeiro [:denispal]]

Based on the build id, it is very likely it's regressed by bug 1606652. These crashes seem to go back all the way to February, but it appears that my change has exposed more cases and made it much more frequent. I will try to reproduce this with the given url's.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1606652

Comment 4

[Julien Cristau [:jcristau]]

dom.script_loader.external_scripts.speculative_omt_parse.enabled is only enabled for nightly builds.

Comment 6

[Daniel Veditz [:dveditz]]

I don't remember why I marked a null deref as sec-moderate. maybe because it's a race? Any crashes that show worse symptoms than a null deref?

Comment 7

[Gabriele Svelto [:gsvelto] (PTO)]

No, it appears like a plain NULL-deref. I've scoured a couple dozen crashes and there's no signs of nastier stuff. The worst part of it is that it's a race.

Comment 8

[Simon Giesecke [:sg] [he/him]]

Adding signature [@ mozilla::dom::ScriptLoader::GiveUpBytecodeEncoding ] here as these crashes look very similar and started at a similar point of time.

Comment 9

[Denis Palmeiro [:denispal]]

Fixed by 1663051.