Closed Bug 1774662 Opened 3 years ago Closed 3 years ago

[Apple M1] Crash in js::jit::MaybeEnterJit (DOM Worker Thread) (chess.com; zoom.us)

Categories

(Core :: JavaScript Engine: JIT, defect, P2)

Product:
Core
Component:
JavaScript Engine: JIT
Type:
defect

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1774449

People

(Reporter: tcampbell, Unassigned)

References

(Blocks 1 open bug)

Details

https://crash-stats.mozilla.org/report/index/e8f89cd8-cf8f-4943-83c5-fc63b0220616

I got reports of crashes in the Zoom web client on Apple M1 laptops. There are similar crashes on chess.com. These seem to correlate to MacOS ARM64 machines and in both cases are happening in DOM Worker threads.

Group: javascript-core-security

This is likely bug 1774449.

Depends on: 1774449
Severity: -- → S2
Component: JavaScript Engine → JavaScript Engine: JIT
Priority: -- → P2

I think the evidence is pretty strong that this is just a duplicate.
In the raw dump of the crash report we can see that the sp value is 0x000000016d96cc88, which is misaligned.

Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → DUPLICATE
Group: javascript-core-security
You need to log in before you can comment on or make changes to this bug.