1677087 - Startup Crash in [@ js::frontend::CompilationInfo::instantiateStencilsAfterPreparation]

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect, P5)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

2 crashes on 2 devices, both with Firefox 840a1, older one with 20201105045247

Crash report: https://crash-stats.mozilla.org/report/index/cae4bc14-3c15-4dcb-9c8c-d08e50201106

MOZ_CRASH Reason: MOZ_CRASH(ParserAtom should already be instantiatedd)

Top 9 frames of crashing thread:

0 xul.dll js::frontend::CompilationInfo::instantiateStencilsAfterPreparation js/src/frontend/Stencil.cpp:694
1 xul.dll js::frontend::InstantiateStencils js/src/frontend/BytecodeCompiler.cpp:330
2 xul.dll ScriptParseTask<mozilla::Utf8Unit>::parse js/src/vm/HelperThreads.cpp:698
3 xul.dll js::ParseTask::runHelperThreadTask js/src/vm/HelperThreads.cpp:613
4 xul.dll static js::HelperThread::ThreadMain js/src/vm/HelperThreads.cpp:2362
5 xul.dll static js::detail::ThreadTrampoline<void  js/src/threading/Thread.h:206
6 ucrtbase.dll thread_start<unsigned int , 1> 
7 kernel32.dll BaseThreadInitThunk 
8 ntdll.dll RtlUserThreadStart 

Comment 1

[Tooru Fujisawa [:arai]]

https://crash-stats.mozilla.org/report/index/f92c8190-6d5b-45a0-aaae-6cfe90201113#tab-details seems to be different issue.
function's baseScript is nullptr here
https://hg.mozilla.org/mozilla-central/file/7bc6104186054d5b1b5383d480446bd7fa4cdfc8/js/src/frontend/Stencil.cpp#l568

Comment 2

[Tooru Fujisawa [:arai]]

(In reply to Tooru Fujisawa [:arai] from comment #1)

https://crash-stats.mozilla.org/report/index/f92c8190-6d5b-45a0-aaae-6cfe90201113#tab-details seems to be different issue.
function's baseScript is nullptr here
https://hg.mozilla.org/mozilla-central/file/7bc6104186054d5b1b5383d480446bd7fa4cdfc8/js/src/frontend/Stencil.cpp#l568

this was wrong.
inner was nullptr there

Comment 3

[Tooru Fujisawa [:arai]]

(In reply to Tooru Fujisawa [:arai] from comment #2)

inner was nullptr there

given that it passes is<JSObject>(), and also inner.as<JSObject>() results in nullptr, the inner value is completely 0.

This means

given it's lazy script, there can only be atom/null/function.

• NullScriptThing should become GCCellPtr with Null tag that is 6.
• at that point ParserAtomEntry::toExistingJSAtom no more have MOZ_CRASH for not-instantiated case, and it can return nullptr if the atom isn't instantiated, but in that case it has String tag that is 2.

so, it should be a function entry, that can have Object tag that is 0,
gcOutput.functions is initialized for all functions as long as ScriptStencil::isFunction() return true.
but it can be false for function because of bug 1677354.

Comment 4

[Tooru Fujisawa [:arai]]

(In reply to Tooru Fujisawa [:arai] from comment #3)

but it can be false for function because of bug 1677354.

bug 1677354 affects script flag, and isFunction checks functionFlags. so this isn't the reason.

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.