1702007 - Crash in [@ mozilla::CycleCollectedJSRuntime::UnmarkSkippableJSHolders]

Status: RESOLVED INCOMPLETE

(Core :: Cycle Collector, defect)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Observed with esr, release, beta and aurora - no reports for nightly. All crashes with x86, both on Windows 7 and 10.

Crash report: https://crash-stats.mozilla.org/report/index/bf84772b-226d-4dd2-a80a-45af60210325

Reason: EXCEPTION_ACCESS_VIOLATION_READ
Crash address: 0xe5e5e5e5

Top 10 frames of crashing thread:

0 xul.dll mozilla::CycleCollectedJSRuntime::UnmarkSkippableJSHolders xpcom/base/CycleCollectedJSRuntime.cpp:757
1 xul.dll nsCCUncollectableMarker::Observe dom/base/nsCCUncollectableMarker.cpp:421
2 xul.dll nsObserverList::NotifyObservers xpcom/ds/nsObserverList.cpp:70
3 xul.dll nsObserverService::NotifyObservers xpcom/ds/nsObserverService.cpp:288
4 xul.dll XPCJSRuntime::PrepareForForgetSkippable js/xpconnect/src/XPCJSRuntime.cpp:736
5 xul.dll nsCycleCollector_forgetSkippable xpcom/base/nsCycleCollector.cpp:3869
6 xul.dll FireForgetSkippable dom/base/nsJSEnvironment.cpp:1140
7 xul.dll CCRunnerFired dom/base/nsJSEnvironment.cpp:1633
8 xul.dll virtual bool __thiscall std::_Func_impl_no_alloc<bool  
9 xul.dll mozilla::IdleTaskRunner::Run xpcom/threads/IdleTaskRunner.cpp:109

Comment 1

[Andrew McCreight [:mccr8]]

Hmm, could something be adding or removing a JS holder while we're iterating over the hash table?

Comment 2

[Andrew McCreight [:mccr8]]

Either that or maybe there's a pointer to a dead object in the holder table?

Comment 3

[Daniel Veditz [:dveditz]]

I bet a lot of the 64-bit ones are UAFs too -- the first one I clicked on had the UAF marker in rax bp-ffe26b40-3c91-4f32-9e65-6d55b0210331 (another one wasn't).

Comment 4

[Joe Walker [:jwalker]]

Andrew, do you think this one should be marked stalled or do we have a way of making progress here?

Comment 5

[BugBot [:suhaib / :marco]]

The severity field for this bug is set to S3. However, the bug is flagged with the sec-high keyword.
:nika, could you consider increasing the severity of this security bug?

For more information, please visit auto_nag documentation.

Comment 6

[Andrew McCreight [:mccr8]]

This bug is stalled because it is unactionable.

Comment 7

[Tom Ritter [:tjr]]

Only 5 crashes on a version > 102 in the past 6 months, plus this bug is unactionable.

Comment 8

[BugBot (nomail) [:suhaib / :marco/ :calixte]]

Since the bug is closed, the stalled keyword is now meaningless.
For more information, please visit BugBot documentation.