1777933 - Crash in [@ mozilla::dom::IOUtils::Read]

Status: RESOLVED FIXED

(Toolkit Graveyard :: OS.File, defect)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

42 crashes for 14 installations of Firefox 103.0 beta 2 and 3, and Firefox 104.0b1. 12 for Firefox 103.0a1. Multiple OS affected and cpu architectures affected. Peter, could you investigate the issue? The code got modified in bug 1766130 but this landed for Firefox 102.

Crash report: https://crash-stats.mozilla.org/report/index/f9bfa1a8-8206-4e5b-af42-b56290220704

MOZ_CRASH Reason: MOZ_DIAGNOSTIC_ASSERT(XRE_IsParentProcess())

Top 10 frames of crashing thread:

0 xul.dll static mozilla::dom::IOUtils::Read dom/system/IOUtils.cpp:318
1 xul.dll mozilla::dom::IOUtils_Binding::read dom/bindings/IOUtilsBinding.cpp:1452
2 xul.dll mozilla::dom::StaticMethodPromiseWrapper dom/bindings/BindingUtils.cpp:3311
3 xul.dll js::CallFromStack js/src/vm/Interpreter.cpp:579
4 xul.dll js::jit::DoCallFallback js/src/jit/BaselineIC.cpp:1582
5 None @0x3de9256d 
6 None @0x3de98007 
7 None @0x3deee602 
8 None @0x3de98077 
9 None @0x3de903d7 

Comment 1

[Peter Van der Beken [:peterv]]

This assert has been there for a long time (added in bug 1659839), so someone would need to find the JS caller of this API that's triggering this. And totally unrelated to the changes in bug 1766130, which just fixed other crashes.

Comment 2

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Could this be a regression from one of the IOUtils porting bugs which landed last month?

Comment 3

[Barret Rennie [:barret] (they/them)]

I just kicked off landing of bug 1778553, which adds the caller location to the crash string. That should tell us what to fix.

Comment 4

[:Gijs (he/him)]

The beta crashes are much more prevalent on devedition (aurora channel) vs beta channel (183 vs 29 crashes at time of writing), whereas crash volume overall in the past week is much heavier on beta (serveral multiples). So it seems like this is primarily hit on devedition.

The first nightly crash was on a June 6 build. https://phabricator.services.mozilla.com/D147589 landed on the June 3rd build and added a read callsite to a general purpose fetch method (albeit in relatively rare cases, when the channel load doesn't succeed for a file: URL read - but this is pretty plausible when developing code on the local machine). That fetch method gets used by the stylesheet devtools 'server' actor which runs in the same process as the code being debugged, ie a child proc if devtool'ing a regular webpage or local file:/// html page.

Barret reproduced a crash on an instrumented nightly: https://crash-stats.mozilla.org/report/index/b2360071-7901-4fb8-844a-4859f0220714

It's still possible that other migrations also introduced these issues, or that other parts of the patch in bug 1771608 or the other migrations in this list of bugs: https://mzl.la/3O35ru1 introduced similar problems. But it seems a reasonable guess for what the issue here is. Devtools folks might be more reliably able to point us in the direction of other problematic .read callsites.

Comment 5

[Barret Rennie [:barret] (they/them)]

Any crashes that occur with the updated telemetry will have the signature in bug 1779572.

Comment 6

[Barret Rennie [:barret] (they/them)]

This was fixed by bug 1779574