1759107 - Crash in [@ js::gc::UnmarkGrayGCThingUnchecked]

Status: RESOLVED FIXED

(Core :: JavaScript: GC, defect, P1)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

There were single crashes with this signature before and 4 for Firefox 95.0.2 but in the last
2 days 5 different machines have submit 6 such crash reports. First affected build is Firefox 100.0a1 20220309213717, on all operating systems.

Crash report: https://crash-stats.mozilla.org/report/index/4662f456-1386-4e7f-a66f-62af90220310

Reason: EXC_BAD_ACCESS / KERN_INVALID_ADDRESS

Top 10 frames of crashing thread:

0 XUL js::gc::UnmarkGrayGCThingUnchecked js/src/gc/Marking.cpp:3044
1 XUL ShouldTraceCrossCompartment js/src/gc/Marking.cpp:358
2 XUL js::ProxyObject::trace js/src/proxy/Proxy.cpp:870
3 XUL js::GCMarker::markUntilBudgetExhausted js/src/gc/Marking.cpp:1797
4 XUL js::gc::GCRuntime::markUntilBudgetExhausted js/src/gc/GC.cpp:2780
5 XUL js::gc::BackgroundMarkTask::run js/src/gc/Sweeping.cpp:1714
6 XUL js::GCParallelTask::runHelperThreadTask js/src/gc/GCParallelTask.cpp:165
7 XUL js::GlobalHelperThreadState::runOneTask js/src/vm/HelperThreads.cpp:2629
8 XUL mozilla::ThreadFuncPoolThread xpcom/threads/TaskController.cpp:116
9 libnss3.dylib _pt_root nsprpub/pr/src/pthreads/ptthread.c:201

Comment 1

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

From bug 1643586?

Comment 2

[Jon Coppeard (:jonco)]

Attachment: Bug 1759107 - Don't add gecko profiler stack frames when unmarking gray things on helper threads r?jandem

This is a null pointer dereference because TlsContext is null on helper
threads.

We don't support adding profiler entries like this on helper threads at the
moment, but it's possible and we should maybe do this in the future.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1643586

Comment 5

[Andrew McCreight [:mccr8]]

This is a null deref, so it doesn't need to be hidden.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/mozilla-central/rev/5af2e0c7d94b
Don't add gecko profiler stack frames when unmarking gray things on helper threads r=jandem

Comment 7

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/5af2e0c7d94b

Comment 8

[Intermittent Failures Robot]

1 failures in 2837 pushes (0.0 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• autoland: 1

Platform and build breakdown:

• windows10-32-2004-qr: 1
  • debug: 1

For more details, see:
https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=1759107&startday=2022-03-07&endday=2022-03-13&tree=all