Closed Bug 1779968 Opened 2 years ago Closed 2 years ago

Startup Crash in [@ vixl::CPU::EnsureIAndDCacheCoherency]

Categories

(Core :: JavaScript: WebAssembly, defect, P1)

Unspecified
Android
defect

Tracking

()

RESOLVED FIXED
104 Branch
Tracking Status
firefox-esr91 --- unaffected
firefox-esr102 --- unaffected
firefox102 --- unaffected
firefox103 --- unaffected
firefox104 blocking fixed

People

(Reporter: t.matsuu, Unassigned)

References

(Regression)

Details

(Keywords: crash, regression, topcrash-startup)

Crash Data

This is top startup crash in GeckoView/Fenix in Build ID 20220717090304.

Crash report: https://crash-stats.mozilla.org/report/index/54dc72bb-e1c0-40b0-809a-d0e830220718

MOZ_CRASH Reason: MOZ_RELEASE_ASSERT(CPU::CanFlushICacheFromBackgroundThreads())

Top 10 frames of crashing thread:

0 libxul.so vixl::CPU::EnsureIAndDCacheCoherency js/src/jit/arm64/vixl/MozCpu-vixl.cpp:281
1 libxul.so js::jit::ReprotectRegion js/src/jit/ProcessExecutableMemory.cpp:782
2 libxul.so js::wasm::ModuleSegment::initialize js/src/wasm/WasmCode.cpp:345
3 libxul.so js::wasm::ModuleGenerator::finishModule js/src/wasm/WasmGenerator.cpp:1223
4 libxul.so js::wasm::CompileStreaming js/src/wasm/WasmCompile.cpp:919
5 libxul.so CompileStreamTask::execute js/src/wasm/WasmJS.cpp:5133
6 libxul.so {virtual override thunk} 
7 libxul.so js::GlobalHelperThreadState::runOneTask js/src/vm/HelperThreads.cpp:2786
8 libxul.so HelperThreadTaskHandler::Run js/xpconnect/src/XPCJSContext.cpp:1167
9 libxul.so mozilla::ThreadFuncPoolThread xpcom/threads/TaskController.cpp:179

Set to P1 S1 because this is startup crash.

Severity: S2 → S1
Priority: -- → P1
Summary: Crash in [@ vixl::CPU::EnsureIAndDCacheCoherency] → Startup Crash in [@ vixl::CPU::EnsureIAndDCacheCoherency]

This bug seems to occur when the uBlock Origin add-on is enabled in Firefox Nightly for Android.

Related: mozilla-mobile/fenix#26062

Component: General → JavaScript Engine: JIT
Product: GeckoView → Core

Bug 1777604 seems like a very likely candidate given the regression window.
https://hg.mozilla.org/mozilla-central/rev/491e6ce8da1547923e113051e4a4774e9cb34e2e

Component: JavaScript Engine: JIT → JavaScript: WebAssembly
Flags: needinfo?(rhunt)

This was backed out in bug 1777604. Following up there.

Flags: needinfo?(rhunt)
Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → 104 Branch
You need to log in before you can comment on or make changes to this bug.