Crash in [@ _chkstk | base::internal::PlatformThreadLocalStorage::OnThreadExit]
Categories
(Core :: XPCOM, defect)
Tracking
()
People
(Reporter: gsvelto, Unassigned)
Details
(Keywords: crash, Whiteboard: [tbird crash])
Crash Data
Crash report: https://crash-stats.mozilla.org/report/index/1ac9f928-089a-4503-aa4e-c61210220305
Reason: EXCEPTION_STACK_OVERFLOW
Top 10 frames of crashing thread:
0 firefox.exe _chkstk /builds/worker/workspace/obj-build/browser/app/d:/agent/_work/1/s/src/vctools/crt/vcstartup/src/misc/amd64/chkstk.asm:109
1 firefox.exe static base::internal::PlatformThreadLocalStorage::OnThreadExit security/sandbox/chromium/base/threading/thread_local_storage.cc:328
2 ntdll.dll LdrpCallInitRoutine
3 ntdll.dll LdrpCallTlsInitializers
4 ntdll.dll LdrShutdownThread
5 ntdll.dll RtlExitUserThread
6 kernelbase.dll FreeLibraryAndExitThread
7 ucrtbase.dll common_end_thread
8 ucrtbase.dll thread_start<unsigned int , 1>
9 kernel32.dll BaseThreadInitThunk
Odd crash, can't make heads or tails of it. Kris do you know what might be going on? This seems to be happening deep down in threading code.
|
Reporter | |
Comment 1•4 years ago
|
||
Added a signature.
|
||
Comment 2•3 years ago
|
||
This seems to be a Windows issue with StreamTransit going over? Maybe something is being stuck alive in the thread pool. We can't always guarantee tasks are killed before we enter the shutdown threads loop.
|
||
Comment 3•3 years ago
|
||
Since the crash volume is low (less than 5 per week), the severity is downgraded to S3. Feel free to change it back if you think the bug is still critical.
For more information, please visit auto_nag documentation.
|
|
||
Comment 4•3 years ago
|
||
Closing because no crashes reported for 12 weeks.
|
|
Reporter | |
Comment 5•3 years ago
|
||
This was a signature change.
|
||
Comment 6•4 months ago
|
||
Triage update — re-checking including Thunderbird (Core::XPCOM covers both products).
tl;dr: I have no idea why Thunderbird would show up with recent versions while Firefox doesn't.
Volume:
- Firefox: 15 crashes / 180d, 6 / 90d, 0 / 30d, 0 crash pings — 100% Firefox 115 ESR, decaying.
- Thunderbird: 372 crashes / 90d, all current channels (ESR 140.x, release 148-150.0.1, nightly 151), all Windows, all parent process, all EXCEPTION_STACK_OVERFLOW.
Top Thunderbird proto_signature clusters by thread-exit pathway:
- FreeLibraryAndExitThread | common_end_thread: ~195 reports
- TppWorkerThread: ~50
- SockAsyncThread: ~14
- CRpcThreadCache: ~9
So the crash isn't tied to a specific thread pool (the 2022 StreamTransportService hypothesis in comment 2 was specific to the Firefox population at the time but doesn't generalize) — it's any thread whose teardown happens to land in deep ACL recursion.
The deep frames in every cluster are Windows ntdll loader internals: RtlpOwnerAcesPresent | ImageTlsCallbackCaller | LdrpCallInitRoutineInternal | LdrpCallTlsInitializers | LdrShutdownThread | RtlExitUserThread. The crashing function (https://searchfox.org/firefox-main/source/security/sandbox/chromium/base/threading/thread_local_storage.cc#403-419) is a stack-cheap two-line wrapper; the overflow is a symptom of stack already drained by Windows loader doing security-descriptor walks during DLL unload at thread exit. Several clusters show mozilla::interceptor::FuncHook frames and AV-injected hook frames inflating teardown.
100% parent process across both products rules out the classic sandbox-restricted-token hypothesis (which would predict child-process concentration where restricted SIDs walk longer DACLs).
Not a high priority to dive deep here, but if something comes to your mind...
|
||
Comment 7•4 months ago
|
||
Looking at the only nightly thunderbird crash I can see, it appears to be a likely OOM like bug 1982752 comment 2.
|
||
Comment 8•2 months ago
|
||
Thunderbird 152.0.1 https://crash-stats.mozilla.org/report/index/a48d2065-4c74-4487-a1d8-a5bbd0260719
User provides their email address and this comment, "I was On Google sites, most fire fox sites, mozilla, slow down,
and Mcafee works with both Microsoft and Google crashes more time on me crashes because of Microsoft but by itself
Microsoft run better but it has too much bias, restrictions, permission, that block you. charge to much keep you behind in your school work, everything is about money. On Firefox crashed all the time"
Description
•