1801916 - Crash in [@ js::frontend::ParseNode::getKind]

Status: NEW

(Core :: JavaScript Engine, defect, P3)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Not a new signature, e.g. ~100 crashes for Firefox 106.0.x builds.

Crash report: https://crash-stats.mozilla.org/report/index/703b9a12-7f69-45cf-a26e-7f3dc0221119

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0  xul.dll  js::frontend::ParseNode::getKind const  js/src/frontend/ParseNode.h:746
0  xul.dll  js::frontend::RewritingParseNodeVisitor<FoldVisitor>::visit  js/src/frontend/ParseNodeVisitor.h:116
1  xul.dll  js::frontend::ListNode::accept  js/src/frontend/ParseNode.h:1234
1  xul.dll  js::frontend::RewritingParseNodeVisitor<FoldVisitor>::visitObjectExpr  js/src/frontend/ParseNodeVisitor.h:134
1  xul.dll  FoldVisitor::visitObjectExpr  js/src/frontend/FoldConstants.cpp:1553
1  xul.dll  js::frontend::RewritingParseNodeVisitor<FoldVisitor>::visit  js/src/frontend/ParseNodeVisitor.h:120
2  xul.dll  js::frontend::ListNode::accept  js/src/frontend/ParseNode.h:1234
2  xul.dll  js::frontend::RewritingParseNodeVisitor<FoldVisitor>::visitArguments  js/src/frontend/ParseNodeVisitor.h:134
2  xul.dll  js::frontend::RewritingParseNodeVisitor<FoldVisitor>::visit  js/src/frontend/ParseNodeVisitor.h:120
3  xul.dll  js::frontend::ListNode::accept  js/src/frontend/ParseNode.h:1230

Comment 1

[Nicolas B. Pierron [:nbp]]

15% of the reports matching ParseNode::getKind are reporting a failure in the following assertions:

    JS_PARSE_NODE_ASSERT(ParseNodeKind::Start <= pn_type);
    JS_PARSE_NODE_ASSERT(pn_type < ParseNodeKind::Limit);

Arai, would this suggest anything actionable?
If not, I guess we can mark this bug as stalled.

Comment 2

[Tooru Fujisawa [:arai]]

So far I don't find anything specifically.

there's no trend for the context within multiple reports:

• expected parse node kind
• surrounding structure
• compilation phase (constant folding, name resolve, bytecode emitter)

except that, almost all reports are for helper thread.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

The bug is linked to a topcrash signature, which matches the following criterion:

• Top 10 content process crashes on beta

:sdetar, could you consider increasing the severity of this top-crash bug?

For more information, please visit auto_nag documentation.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

The bug is linked to a topcrash signature, which matches the following criteria:

• Top 20 desktop browser crashes on release (startup)
• Top 10 content process crashes on beta
• Top 10 content process crashes on release

:sdetar, could you consider increasing the severity of this top-crash bug?

For more information, please visit auto_nag documentation.

Comment 5

[Randell Jesup [:jesup] (needinfo me)]

We have some PHC failures for this signature: https://crash-stats.mozilla.org/report/index/b5bfc963-9e06-405b-b7b4-297690230421 for example

Comment 6

[Gabriele Svelto [:gsvelto]]

I couldn't find one even looking back 6 months :(

Comment 7

[BugBot [:suhaib / :marco/ :calixte]]

Based on the topcrash criteria, the crash signature linked to this bug is not a topcrash signature anymore.

For more information, please visit BugBot documentation.

Comment 8

[Tooru Fujisawa [:arai]]

most of recent crashes happens in FoldConstants.cpp.
I'll look into it

Comment 9

[BugBot [:suhaib / :marco/ :calixte]]

Sorry for removing the keyword earlier but there is a recent change in the ranking, so the bug is again linked to a topcrash signature, which matches the following criteria:

• Top 20 desktop browser crashes on release (startup)
• Top 10 content process crashes on release

For more information, please visit BugBot documentation.

Comment 10

[Intermittent Failures Robot]

1 failures in 4547 pushes (0.0 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• mozilla-central: 1

Platform and build breakdown:

• macosx1015-64-shippable-qr: 1
  • opt: 1

For more details, see:
https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=1801916&startday=2024-05-13&endday=2024-05-19&tree=all

Comment 11

[BugBot [:suhaib / :marco/ :calixte]]

Based on the topcrash criteria, the crash signature linked to this bug is not a topcrash signature anymore.

For more information, please visit BugBot documentation.