1729510 - Windows crash in [@ encoding_c_mem::encoding_mem_convert_latin1_to_utf16]

Status: RESOLVED WORKSFORME

(Core :: Internationalization, defect)

Description

[Chris Peterson [:cpeterson]]

@ Henri, has any encoding code changed recently in Nightly 93 or 94?

Crash report: https://crash-stats.mozilla.org/report/index/08c4e1cf-8162-4ee0-80f8-9eb040210907

The crash volume is very low, about one crash report per release cycle, but one Nightly 94 user has crashed 10 times today. This user's locale is ja-JP, but older crash reports have different locales.

All of the crash reports from the last six months are from Windows (7, 8.1, and 10).

Reason: EXCEPTION_ACCESS_VIOLATION_WRITE

Top 10 frames of crashing thread:

0 xul.dll encoding_c_mem::encoding_mem_convert_latin1_to_utf16 third_party/rust/encoding_c_mem/src/lib.rs:504
1 xul.dll JS::AutoStableStringChars::initTwoByte js/src/vm/StringType.cpp:1452
2 xul.dll js::ctypes::StructType::DefineInternal js/src/ctypes/CTypes.cpp:5986
3 xul.dll js::ctypes::StructType::Create js/src/ctypes/CTypes.cpp:5918
4 xul.dll js::InternalCallOrConstruct js/src/vm/Interpreter.cpp:488
5 xul.dll Interpret js/src/vm/Interpreter.cpp:3255
6 xul.dll js::ExecuteKernel js/src/vm/Interpreter.cpp:743
7 xul.dll js::Execute js/src/vm/Interpreter.cpp:775
8 xul.dll JS::Evaluate js/src/vm/CompilationAndEvaluation.cpp:593
9 xul.dll mozilla::dom::`anonymous namespace'::ScriptExecutorRunnable::WorkerRun dom/workers/ScriptLoader.cpp:2170

Comment 1

[Henri Sivonen (:hsivonen)]

(In reply to Chris Peterson [:cpeterson] from comment #0)

@ Henri, has any encoding code changed recently in Nightly 93 or 94?

No changes in a long while.

Crash report: https://crash-stats.mozilla.org/report/index/08c4e1cf-8162-4ee0-80f8-9eb040210907

The crash volume is very low, about one crash report per release cycle, but one Nightly 94 user has crashed 10 times today. This user's locale is ja-JP, but older crash reports have different locales.

I suspect that instead of a bug in this code, which would manifest more often as this code runs a lot and should have all of its branches well exercised in the wild, there is some special corruption with these particular installations, which eventually manifests by the preconditions of this function not holding.

Comment 2

[Henri Sivonen (:hsivonen)]

The most recent change was bug 1667736, which wasn't supposed to change the semantics or even code gen.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Since the crash volume is low (less than 5 per week), the severity is downgraded to S3. Feel free to change it back if you think the bug is still critical.

For more information, please visit auto_nag documentation.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.