Closed Bug 1837782 Opened 3 years ago Closed 2 years ago

Intermittent MOZ_DIAGNOSTIC_ASSERT(size != 0) [@ AllocInfo::GetInChunk] | marionette.py

Categories

(Core :: JavaScript: GC, defect, P5)

defect

Tracking

()

RESOLVED INCOMPLETE

People

(Reporter: intermittent-bug-filer, Unassigned)

Details

(Keywords: intermittent-failure)

Filed by: imoraru [at] mozilla.com
Parsed log: https://treeherder.mozilla.org/logviewer?job_id=418828623&repo=autoland
Full log: https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/c85ixTIOQ5-VWsKJ39lWSw/runs/0/artifacts/public/logs/live_backing.log


[task 2023-06-10T15:05:22.928Z] 15:05:22     INFO - closing window: 549dbc80-97c9-490c-802c-db47f09ec7dd
[task 2023-06-10T15:05:23.606Z] 15:05:23  WARNING - Failed to gather test failure debug: Browsing context has been discarded
[task 2023-06-10T15:05:23.606Z] 15:05:23  WARNING - stacktrace:
[task 2023-06-10T15:05:23.607Z] 15:05:23  WARNING - 	RemoteError@chrome://remote/content/shared/RemoteError.sys.mjs:8:8
[task 2023-06-10T15:05:23.607Z] 15:05:23  WARNING - 	WebDriverError@chrome://remote/content/shared/webdriver/Errors.sys.mjs:187:5
[task 2023-06-10T15:05:23.607Z] 15:05:23  WARNING - 	NoSuchWindowError@chrome://remote/content/shared/webdriver/Errors.sys.mjs:613:5
[task 2023-06-10T15:05:23.607Z] 15:05:23  WARNING - 	assert.that/<@chrome://remote/content/shared/webdriver/Assert.sys.mjs:485:13
[task 2023-06-10T15:05:23.607Z] 15:05:23  WARNING - 	assert.open@chrome://remote/content/shared/webdriver/Assert.sys.mjs:147:4
[task 2023-06-10T15:05:23.608Z] 15:05:23  WARNING - 	GeckoDriver.prototype.takeScreenshot@chrome://remote/content/marionette/driver.sys.mjs:2462:15
[task 2023-06-10T15:05:23.612Z] 15:05:23  WARNING - 	despatch@chrome://remote/content/marionette/server.sys.mjs:320:40
[task 2023-06-10T15:05:23.612Z] 15:05:23  WARNING - 	execute@chrome://remote/content/marionette/server.sys.mjs:291:16
[task 2023-06-10T15:05:23.612Z] 15:05:23  WARNING - 	onPacket/<@chrome://remote/content/marionette/server.sys.mjs:264:20
[task 2023-06-10T15:05:23.612Z] 15:05:23  WARNING - 	onPacket@chrome://remote/content/marionette/server.sys.mjs:265:9
[task 2023-06-10T15:05:23.612Z] 15:05:23  WARNING - 	_onJSONObjectReady/<@chrome://remote/content/marionette/transport.sys.mjs:496:20
[task 2023-06-10T15:05:23.612Z] 15:05:23  WARNING - 
[task 2023-06-10T15:05:23.615Z] 15:05:23     INFO - TEST-UNEXPECTED-ERROR | awsy/test_memory_usage.py TestMemoryUsage.test_open_tabs | marionette_driver.errors.UnknownException: 
[task 2023-06-10T15:05:23.616Z] 15:05:23     INFO - stacktrace:
[task 2023-06-10T15:05:23.616Z] 15:05:23     INFO - 	RemoteError@chrome://remote/content/shared/RemoteError.sys.mjs:8:8
[task 2023-06-10T15:05:23.616Z] 15:05:23     INFO - 	WebDriverError@chrome://remote/content/shared/webdriver/Errors.sys.mjs:187:5
[task 2023-06-10T15:05:23.616Z] 15:05:23     INFO - 	UnknownError@chrome://remote/content/shared/webdriver/Errors.sys.mjs:736:5
[task 2023-06-10T15:05:23.618Z] 15:05:23     INFO - 	wrap@chrome://remote/content/shared/webdriver/Errors.sys.mjs:133:12
[task 2023-06-10T15:05:23.618Z] 15:05:23     INFO - 	sendError@chrome://remote/content/marionette/message.sys.mjs:284:29
[task 2023-06-10T15:05:23.618Z] 15:05:23     INFO - Traceback (most recent call last):
[task 2023-06-10T15:05:23.618Z] 15:05:23     INFO -   File "/builds/worker/workspace/build/venv/lib/python3.7/site-packages/marionette_harness/marionette_test/testcases.py", line 198, in run
[task 2023-06-10T15:05:23.618Z] 15:05:23     INFO -     testMethod()
[task 2023-06-10T15:05:23.618Z] 15:05:23     INFO -   File "/builds/worker/workspace/build/tests/awsy/awsy/test_memory_usage.py", line 216, in test_open_tabs
[task 2023-06-10T15:05:23.618Z] 15:05:23     INFO -     self.reset_state()
[task 2023-06-10T15:05:23.618Z] 15:05:23     INFO -   File "/builds/worker/workspace/build/venv/lib/python3.7/site-packages/awsy/awsy_test_case.py", line 169, in reset_state
[task 2023-06-10T15:05:23.618Z] 15:05:23     INFO -     self.marionette.close()
[task 2023-06-10T15:05:23.618Z] 15:05:23     INFO -   File "/builds/worker/workspace/build/venv/lib/python3.7/site-packages/marionette_driver/marionette.py", line 1482, in close
[task 2023-06-10T15:05:23.618Z] 15:05:23     INFO -     return self._send_message("WebDriver:CloseWindow")
[task 2023-06-10T15:05:23.618Z] 15:05:23     INFO -   File "/builds/worker/workspace/build/venv/lib/python3.7/site-packages/marionette_driver/decorators.py", line 24, in _
[task 2023-06-10T15:05:23.618Z] 15:05:23     INFO -     return func(*args, **kwargs)
[task 2023-06-10T15:05:23.618Z] 15:05:23     INFO -   File "/builds/worker/workspace/build/venv/lib/python3.7/site-packages/marionette_driver/marionette.py", line 703, in _send_message
[task 2023-06-10T15:05:23.619Z] 15:05:23     INFO -     self._handle_error(err)
[task 2023-06-10T15:05:23.619Z] 15:05:23     INFO -   File "/builds/worker/workspace/build/venv/lib/python3.7/site-packages/marionette_driver/marionette.py", line 715, in _handle_error
[task 2023-06-10T15:05:23.619Z] 15:05:23     INFO -     raise errors.lookup(error)(message, stacktrace=stacktrace)
[task 2023-06-10T15:05:23.619Z] 15:05:23     INFO - TEST-INFO took 657553ms
[task 2023-06-10T15:05:23.619Z] 15:05:23     INFO - tearing down!
[task 2023-06-10T15:05:23.619Z] 15:05:23     INFO - tearing down webservers!
[task 2023-06-10T15:05:23.619Z] 15:05:23     INFO - mozproxy MitmproxyDesktop stop!!
[task 2023-06-10T15:05:23.619Z] 15:05:23     INFO - mozproxy Mitmproxy stop!!
[task 2023-06-10T15:05:23.619Z] 15:05:23     INFO - mozproxy Stopping mitmproxy playback, killing process 1518
[task 2023-06-10T15:05:24.558Z] 15:05:24     INFO - mozproxy Successfully killed the mitmproxy playback process
[task 2023-06-10T15:05:24.558Z] 15:05:24     INFO - mozproxy Turning off the browser proxy
[task 2023-06-10T15:05:24.558Z] 15:05:24     INFO - mozproxy writing: /builds/worker/workspace/build/application/firefox/distribution/policies.json
[task 2023-06-10T15:05:24.558Z] 15:05:24     INFO - processing data in /builds/worker/workspace/build/tests/results!
[task 2023-06-10T15:05:25.250Z] 15:05:25     INFO - mozcrash Downloading symbols from: https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/ErOuc7LJSmueIow5VN46cg/artifacts/public/build/target.crashreporter-symbols.zip
[task 2023-06-10T15:05:51.681Z] 15:05:51     INFO - mozcrash Copy/paste: /builds/worker/fetches/minidump-stackwalk/minidump-stackwalk --symbols-url=https://symbols.mozilla.org/ --cyborg=/tmp/tmphiti8c9i/55434f69-265a-8582-48a1-7956e10ada2b.trace /tmp/tmptg14xhb6.profile/minidumps/55434f69-265a-8582-48a1-7956e10ada2b.dmp /tmp/tmpaq_dr4wg
[task 2023-06-10T15:05:56.229Z] 15:05:56     INFO - mozcrash Saved minidump as /builds/worker/workspace/build/blobber_upload_dir/55434f69-265a-8582-48a1-7956e10ada2b.dmp
[task 2023-06-10T15:05:56.229Z] 15:05:56     INFO - mozcrash Saved app info as /builds/worker/workspace/build/blobber_upload_dir/55434f69-265a-8582-48a1-7956e10ada2b.extra
[task 2023-06-10T15:05:56.321Z] 15:05:56     INFO - PROCESS-CRASH | MOZ_DIAGNOSTIC_ASSERT(size != 0) [@ AllocInfo::GetInChunk] | marionette.py 
[task 2023-06-10T15:05:56.321Z] 15:05:56     INFO - Mozilla crash reason: MOZ_DIAGNOSTIC_ASSERT(size != 0)
[task 2023-06-10T15:05:56.321Z] 15:05:56     INFO - Crash dump filename: /tmp/tmptg14xhb6.profile/minidumps/55434f69-265a-8582-48a1-7956e10ada2b.dmp
[task 2023-06-10T15:05:56.321Z] 15:05:56     INFO - Operating system: Linux
[task 2023-06-10T15:05:56.321Z] 15:05:56     INFO -                   4.4.0-1014-aws #14taskcluster1-Ubuntu SMP Tue Apr 3 10:27:00 UTC 2018
[task 2023-06-10T15:05:56.321Z] 15:05:56     INFO - CPU: amd64
[task 2023-06-10T15:05:56.322Z] 15:05:56     INFO -      family 6 model 85 stepping 7
[task 2023-06-10T15:05:56.322Z] 15:05:56     INFO -      4 CPUs
[task 2023-06-10T15:05:56.322Z] 15:05:56     INFO - Linux Ubuntu 18.04 - bionic (Ubuntu 18.04.6 LTS)
[task 2023-06-10T15:05:56.322Z] 15:05:56     INFO - 
[task 2023-06-10T15:05:56.322Z] 15:05:56     INFO - Crash reason:  SIGSEGV / SEGV_MAPERR
[task 2023-06-10T15:05:56.322Z] 15:05:56     INFO - Crash address: 0x0
[task 2023-06-10T15:05:56.322Z] 15:05:56     INFO - Crashing instruction: `mov dword [0x0], 0xd8c`
[task 2023-06-10T15:05:56.322Z] 15:05:56     INFO - Memory accessed by instruction:
[task 2023-06-10T15:05:56.322Z] 15:05:56     INFO -   0. Address: 0x0000000000000000
[task 2023-06-10T15:05:56.322Z] 15:05:56     INFO -      Size: 4
[task 2023-06-10T15:05:56.322Z] 15:05:56     INFO - Process uptime: not available
[task 2023-06-10T15:05:56.322Z] 15:05:56     INFO - 
[task 2023-06-10T15:05:56.322Z] 15:05:56     INFO - Thread 0 Isolated Servic (crashed)
[task 2023-06-10T15:05:56.322Z] 15:05:56     INFO -  0  firefox-bin!AllocInfo::GetInChunk(void const*, arena_chunk_t*, unsigned long) [mozjemalloc.cpp:9c9d29101b3d0533b84b4e75dc06e89fcad3d31a : 3468]
[task 2023-06-10T15:05:56.322Z] 15:05:56     INFO -     Found by: inlining
[task 2023-06-10T15:05:56.322Z] 15:05:56     INFO -  1  firefox-bin!AllocInfo::Get<true>(void const*) [mozjemalloc.cpp:9c9d29101b3d0533b84b4e75dc06e89fcad3d31a : 3439]
[task 2023-06-10T15:05:56.323Z] 15:05:56     INFO -     Found by: inlining
[task 2023-06-10T15:05:56.323Z] 15:05:56     INFO -  2  firefox-bin!AllocInfo::GetValidated(void const*) [mozjemalloc.cpp:9c9d29101b3d0533b84b4e75dc06e89fcad3d31a : 3481]
[task 2023-06-10T15:05:56.323Z] 15:05:56     INFO -     Found by: inlining
[task 2023-06-10T15:05:56.323Z] 15:05:56     INFO -  3  firefox-bin!Allocator<MozJemallocBase>::malloc_usable_size(void*) [mozjemalloc.cpp:9c9d29101b3d0533b84b4e75dc06e89fcad3d31a : 4652]
[task 2023-06-10T15:05:56.324Z] 15:05:56     INFO -     Found by: inlining
[task 2023-06-10T15:05:56.324Z] 15:05:56     INFO -  4  firefox-bin!replace_malloc_usable_size(void*) [PHC.cpp:9c9d29101b3d0533b84b4e75dc06e89fcad3d31a : 1423]
[task 2023-06-10T15:05:56.324Z] 15:05:56     INFO -     Found by: inlining
[task 2023-06-10T15:05:56.325Z] 15:05:56     INFO -  5  firefox-bin!Allocator<ReplaceMallocBase>::malloc_usable_size(void*) [malloc_decls.h:9c9d29101b3d0533b84b4e75dc06e89fcad3d31a : 61]
[task 2023-06-10T15:05:56.325Z] 15:05:56     INFO -     Found by: inlining
[task 2023-06-10T15:05:56.325Z] 15:05:56     INFO -  6  firefox-bin!malloc_usable_size [malloc_decls.h:9c9d29101b3d0533b84b4e75dc06e89fcad3d31a : 61]
[task 2023-06-10T15:05:56.326Z] 15:05:56     INFO -     Found by: inlining
[task 2023-06-10T15:05:56.326Z] 15:05:56     INFO -  7  firefox-bin!moz_malloc_usable_size [mozalloc.cpp:9c9d29101b3d0533b84b4e75dc06e89fcad3d31a : 130]
[task 2023-06-10T15:05:56.326Z] 15:05:56     INFO -     Found by: inlining
[task 2023-06-10T15:05:56.327Z] 15:05:56     INFO -  8  firefox-bin!moz_malloc_size_of [mozalloc.cpp:9c9d29101b3d0533b84b4e75dc06e89fcad3d31a : 139 + 0x16]
[task 2023-06-10T15:05:56.327Z] 15:05:56     INFO -      rax = 0x000055bef2491ac1    rdx = 0x0000000000000018
[task 2023-06-10T15:05:56.327Z] 15:05:56     INFO -      rcx = 0x000055bef24ac678    rbx = 0x00000000000fdbb4
[task 2023-06-10T15:05:56.327Z] 15:05:56     INFO -      rsi = 0x00007ffcbd86c690    rdi = 0x00007f24fdbb4690
[task 2023-06-10T15:05:56.327Z] 15:05:56     INFO -      rbp = 0x00007ffcbd86c4a0    rsp = 0x00007ffcbd86c490
[task 2023-06-10T15:05:56.327Z] 15:05:56     INFO -       r8 = 0x00007f250cea8358     r9 = 0x00007f24fd411001
[task 2023-06-10T15:05:56.327Z] 15:05:56     INFO -      r10 = 0x00007f2518900ea0    r11 = 0x00007f2518900e80
[task 2023-06-10T15:05:56.328Z] 15:05:56     INFO -      r12 = 0x0000000000000000    r13 = 0x0000000000000000
[task 2023-06-10T15:05:56.328Z] 15:05:56     INFO -      r14 = 0x0000000000000000    r15 = 0x0000000000000040
[task 2023-06-10T15:05:56.328Z] 15:05:56     INFO -      rip = 0x000055bef2469925
[task 2023-06-10T15:05:56.329Z] 15:05:56     INFO -     Found by: given as instruction pointer in context
[task 2023-06-10T15:05:56.329Z] 15:05:56     INFO -  9  libxul.so!mozilla::LinkedList<js::GCParallelTask>::sizeOfExcludingThis(unsigned long (*)(void const*)) const [LinkedList.h:9c9d29101b3d0533b84b4e75dc06e89fcad3d31a : 620]
[task 2023-06-10T15:05:56.329Z] 15:05:56     INFO -     Found by: inlining
[task 2023-06-10T15:05:56.329Z] 15:05:56     INFO - 10  libxul.so!js::GCParallelTaskList::sizeOfExcludingThis(unsigned long (*)(void const*), js::AutoLockHelperThreadState const&) const [GCParallelTask.h:9c9d29101b3d0533b84b4e75dc06e89fcad3d31a : 77]
[task 2023-06-10T15:05:56.329Z] 15:05:56     INFO -     Found by: inlining
[task 2023-06-10T15:05:56.330Z] 15:05:56     INFO - 11  libxul.so!js::GlobalHelperThreadState::addSizeOfIncludingThis(JS::GlobalStats*, js::AutoLockHelperThreadState const&) const [HelperThreads.cpp:9c9d29101b3d0533b84b4e75dc06e89fcad3d31a : 1824 + 0x6]
[task 2023-06-10T15:05:56.330Z] 15:05:56     INFO -      rbx = 0x00007f24fdbb4698    rbp = 0x00007ffcbd86c560
[task 2023-06-10T15:05:56.330Z] 15:05:56     INFO -      rsp = 0x00007ffcbd86c4b0    r12 = 0x0000000000000000
[task 2023-06-10T15:05:56.330Z] 15:05:56     INFO -      r13 = 0x0000000000000000    r14 = 0x00007f2504836b80
[task 2023-06-10T15:05:56.331Z] 15:05:56     INFO -      r15 = 0x0000000000000040    rip = 0x00007f250722cb2f
[task 2023-06-10T15:05:56.331Z] 15:05:56     INFO -     Found by: call frame info
[task 2023-06-10T15:05:56.332Z] 15:05:56     INFO - 12  libxul.so!JS::CollectGlobalStats(JS::GlobalStats*) [MemoryMetrics.cpp:9c9d29101b3d0533b84b4e75dc06e89fcad3d31a : 746 + 0xa]
[task 2023-06-10T15:05:56.332Z] 15:05:56     INFO -      rbx = 0x00007ffcbd86c690    rbp = 0x00007ffcbd86c590
[task 2023-06-10T15:05:56.332Z] 15:05:56     INFO -      rsp = 0x00007ffcbd86c570    r12 = 0x00007f2504836b80
[task 2023-06-10T15:05:56.333Z] 15:05:56     INFO -      r13 = 0x00007f24fe220100    r14 = 0x00007ffcbd86c570
[task 2023-06-10T15:05:56.333Z] 15:05:56     INFO -      r15 = 0x0000000000000000    rip = 0x00007f2507249c09
[task 2023-06-10T15:05:56.334Z] 15:05:56     INFO -     Found by: call frame info
[task 2023-06-10T15:05:56.334Z] 15:05:56     INFO - 13  libxul.so!xpc::JSReporter::CollectReports(nsBaseHashtable<nsIntegralHashKey<unsigned long, 0>, nsTString<char>, nsTString<char>, nsDefaultConverter<nsTString<char>, nsTString<char> > >*, nsBaseHashtable<nsIntegralHashKey<unsigned long, 0>, nsTString<char>, nsTString<char>, nsDefaultConverter<nsTString<char>, nsTString<char> > >*, nsIHandleReportCallback*, nsISupports*, bool) [XPCJSRuntime.cpp:9c9d29101b3d0533b84b4e75dc06e89fcad3d31a : 2279 + 0x4]
[task 2023-06-10T15:05:56.334Z] 15:05:56     INFO -      rbx = 0x00007ffcbd86c6e0    rbp = 0x00007ffcbd86cbc0
[task 2023-06-10T15:05:56.335Z] 15:05:56     INFO -      rsp = 0x00007ffcbd86c5a0    r12 = 0x00007f2504836b80
[task 2023-06-10T15:05:56.335Z] 15:05:56     INFO -      r13 = 0x00007f24fe220100    r14 = 0x00007f250c8db640
[task 2023-06-10T15:05:56.336Z] 15:05:56     INFO -      r15 = 0x0000000000000000    rip = 0x00007f2504834fe5
[task 2023-06-10T15:05:56.336Z] 15:05:56     INFO -     Found by: call frame info
[task 2023-06-10T15:05:56.337Z] 15:05:56     INFO - 14  libxul.so!nsWindowMemoryReporter::CollectReports(nsIHandleReportCallback*, nsISupports*, bool) [nsWindowMemoryReporter.cpp:9c9d29101b3d0533b84b4e75dc06e89fcad3d31a : 574 + 0xd]
[task 2023-06-10T15:05:56.337Z] 15:05:56     INFO -      rbx = 0x0000000000000000    rbp = 0x00007ffcbd86d640
[task 2023-06-10T15:05:56.337Z] 15:05:56     INFO -      rsp = 0x00007ffcbd86cbd0    r12 = 0x0000000000000000
[task 2023-06-10T15:05:56.338Z] 15:05:56     INFO -      r13 = 0x00007ffcbd86cc78    r14 = 0x00007ffcbd86d548
[task 2023-06-10T15:05:56.338Z] 15:05:56     INFO -      r15 = 0x00007f24fca441a0    rip = 0x00007f2504bf1a94
[task 2023-06-10T15:05:56.339Z] 15:05:56     INFO -     Found by: call frame info
[task 2023-06-10T15:05:56.339Z] 15:05:56     INFO - 15  libxul.so!nsMemoryReporterManager::DispatchReporter(nsIMemoryReporter*, bool, nsIHandleReportCallback*, nsISupports*, bool)::$_0::operator()() const [nsMemoryReporterManager.cpp:9c9d29101b3d0533b84b4e75dc06e89fcad3d31a : 1979]
[task 2023-06-10T15:05:56.339Z] 15:05:56     INFO -     Found by: inlining
[task 2023-06-10T15:05:56.340Z] 15:05:56     INFO - 16  libxul.so!mozilla::detail::RunnableFunction<nsMemoryReporterManager::DispatchReporter(nsIMemoryReporter*, bool, nsIHandleReportCallback*, nsISupports*, bool)::$_0>::Run() [nsThreadUtils.h:9c9d29101b3d0533b84b4e75dc06e89fcad3d31a : 548 + 0x15]
[task 2023-06-10T15:05:56.340Z] 15:05:56     INFO -      rbx = 0x00007f24fca442e0    rbp = 0x00007ffcbd86d660
[task 2023-06-10T15:05:56.341Z] 15:05:56     INFO -      rsp = 0x00007ffcbd86d650    r12 = 0x00007ffcbd86d758
[task 2023-06-10T15:05:56.341Z] 15:05:56     INFO -      r13 = 0x00007f24fc011200    r14 = 0x00007f2518894e00
[task 2023-06-10T15:05:56.342Z] 15:05:56     INFO -      r15 = 0x00007ffcbd86d76c    rip = 0x00007f2504393c1f
[task 2023-06-10T15:05:56.342Z] 15:05:56     INFO -     Found by: call frame info
[task 2023-06-10T15:05:56.342Z] 15:05:56     INFO - 17  libxul.so!mozilla::RunnableTask::Run() [TaskController.cpp:9c9d29101b3d0533b84b4e75dc06e89fcad3d31a : 555]
[task 2023-06-10T15:05:56.343Z] 15:05:56     INFO -     Found by: inlining
[task 2023-06-10T15:05:56.343Z] 15:05:56     INFO - 18  libxul.so!mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) [TaskController.cpp:9c9d29101b3d0533b84b4e75dc06e89fcad3d31a : 880 + 0x1f]
[task 2023-06-10T15:05:56.344Z] 15:05:56     INFO -      rbx = 0x0000000000000004    rbp = 0x00007ffcbd86dce0
[task 2023-06-10T15:05:56.344Z] 15:05:56     INFO -      rsp = 0x00007ffcbd86d670    r12 = 0x00007ffcbd86d758
[task 2023-06-10T15:05:56.344Z] 15:05:56     INFO -      r13 = 0x00007f24fc011200    r14 = 0x00007f2518894e00
[task 2023-06-10T15:05:56.345Z] 15:05:56     INFO -      r15 = 0x00007ffcbd86d76c    rip = 0x00007f2507f97c11
[task 2023-06-10T15:05:56.345Z] 15:05:56     INFO -     Found by: call frame info
[task 2023-06-10T15:05:56.346Z] 15:05:56     INFO - 19  libxul.so!mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) [TaskController.cpp:9c9d29101b3d0533b84b4e75dc06e89fcad3d31a : 704]
[task 2023-06-10T15:05:56.346Z] 15:05:56     INFO -     Found by: inlining
[task 2023-06-10T15:05:56.347Z] 15:05:56     INFO - 20  libxul.so!mozilla::TaskController::ProcessPendingMTTask(bool) [TaskController.cpp:9c9d29101b3d0533b84b4e75dc06e89fcad3d31a : 491]
[task 2023-06-10T15:05:56.347Z] 15:05:56     INFO -     Found by: inlining
[task 2023-06-10T15:05:56.347Z] 15:05:56     INFO - 21  libxul.so!mozilla::TaskController::TaskController()::$_0::operator()() const [TaskController.cpp:9c9d29101b3d0533b84b4e75dc06e89fcad3d31a : 218]
[task 2023-06-10T15:05:56.348Z] 15:05:56     INFO -     Found by: inlining
[task 2023-06-10T15:05:56.348Z] 15:05:56     INFO - 22  libxul.so!mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() [nsThreadUtils.h:9c9d29101b3d0533b84b4e75dc06e89fcad3d31a : 548 + 0x3a]
[task 2023-06-10T15:05:56.349Z] 15:05:56     INFO -      rbx = 0x00007f2518894e00    rbp = 0x00007ffcbd86dd30
[task 2023-06-10T15:05:56.349Z] 15:05:56     INFO -      rsp = 0x00007ffcbd86dcf0    r12 = 0x0000035ff10f4948
[task 2023-06-10T15:05:56.349Z] 15:05:56     INFO -      r13 = 0x00007f2518892190    r14 = 0x00007ffcbd86dcf8
[task 2023-06-10T15:05:56.350Z] 15:05:56     INFO -      r15 = 0x00007f2518834850    rip = 0x00007f2507f9937f
[task 2023-06-10T15:05:56.350Z] 15:05:56     INFO -     Found by: call frame info
[task 2023-06-10T15:05:56.350Z] 15:05:56     INFO - 23  libxul.so!nsThread::ProcessNextEvent(bool, bool*) [nsThread.cpp:9c9d29101b3d0533b84b4e75dc06e89fcad3d31a : 1199 + 0x8]
[task 2023-06-10T15:05:56.351Z] 15:05:56     INFO -      rbx = 0x00007f25188f4050    rbp = 0x00007ffcbd86df90
[task 2023-06-10T15:05:56.351Z] 15:05:56     INFO -      rsp = 0x00007ffcbd86dd40    r12 = 0x0000035ff10f4948
[task 2023-06-10T15:05:56.352Z] 15:05:56     INFO -      r13 = 0x00007f2518892190    r14 = 0x00007f2518887401
[task 2023-06-10T15:05:56.352Z] 15:05:56     INFO -      r15 = 0x00007f2518834850    rip = 0x00007f2507f9b3cb
[task 2023-06-10T15:05:56.352Z] 15:05:56     INFO -     Found by: call frame info
[task 2023-06-10T15:05:56.352Z] 15:05:56     INFO - 24  libxul.so!NS_ProcessNextEvent(nsIThread*, bool) [nsThreadUtils.cpp:9c9d29101b3d0533b84b4e75dc06e89fcad3d31a : 479]
[task 2023-06-10T15:05:56.353Z] 15:05:56     INFO -     Found by: inlining
[task 2023-06-10T15:05:56.353Z] 15:05:56     INFO - 25  libxul.so!mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) [MessagePump.cpp:9c9d29101b3d0533b84b4e75dc06e89fcad3d31a : 85 + 0x2a]
[task 2023-06-10T15:05:56.353Z] 15:05:56     INFO -      rbx = 0x00007f25188a45b0    rbp = 0x00007ffcbd86e000
[task 2023-06-10T15:05:56.353Z] 15:05:56     INFO -      rsp = 0x00007ffcbd86dfa0    r12 = 0x0000000000000000
[task 2023-06-10T15:05:56.354Z] 15:05:56     INFO -      r13 = 0x0000000000000501    r14 = 0x00007ffcbd86e128
[task 2023-06-10T15:05:56.354Z] 15:05:56     INFO -      r15 = 0x00007f25188f4050    rip = 0x00007f2507fea417
[task 2023-06-10T15:05:56.354Z] 15:05:56     INFO -     Found by: call frame info
[task 2023-06-10T15:05:56.354Z] 15:05:56     INFO - 26  libxul.so!MessageLoop::RunInternal() [message_loop.cc:9c9d29101b3d0533b84b4e75dc06e89fcad3d31a : 370]
[task 2023-06-10T15:05:56.354Z] 15:05:56     INFO -     Found by: inlining
[task 2023-06-10T15:05:56.354Z] 15:05:56     INFO - 27  libxul.so!MessageLoop::RunHandler() [message_loop.cc:9c9d29101b3d0533b84b4e75dc06e89fcad3d31a : 363]
[task 2023-06-10T15:05:56.354Z] 15:05:56     INFO -     Found by: inlining
[task 2023-06-10T15:05:56.355Z] 15:05:56     INFO - 28  libxul.so!MessageLoop::Run() [message_loop.cc:9c9d29101b3d0533b84b4e75dc06e89fcad3d31a : 345 + 0xb]
[task 2023-06-10T15:05:56.355Z] 15:05:56     INFO -      rbx = 0x00007ffcbd86e018    rbp = 0x00007ffcbd86e040
[task 2023-06-10T15:05:56.355Z] 15:05:56     INFO -      rsp = 0x00007ffcbd86e010    r12 = 0x00007f25188b8e00
[task 2023-06-10T15:05:56.355Z] 15:05:56     INFO -      r13 = 0x00000000000005f8    r14 = 0x00007f25188f4050
[task 2023-06-10T15:05:56.355Z] 15:05:56     INFO -      r15 = 0x0000000080004005    rip = 0x00007f2508bce4cf
[task 2023-06-10T15:05:56.355Z] 15:05:56     INFO -     Found by: call frame info
[task 2023-06-10T15:05:56.355Z] 15:05:56     INFO - 29  libxul.so!nsBaseAppShell::Run() [nsBaseAppShell.cpp:9c9d29101b3d0533b84b4e75dc06e89fcad3d31a : 148 + 0xc]
[task 2023-06-10T15:05:56.355Z] 15:05:56     INFO -      rbx = 0x00007f2518836dd0    rbp = 0x00007ffcbd86e060
[task 2023-06-10T15:05:56.355Z] 15:05:56     INFO -      rsp = 0x00007ffcbd86e050    r12 = 0x00007f25188b8e00
[task 2023-06-10T15:05:56.355Z] 15:05:56     INFO -      r13 = 0x00000000000005f8    r14 = 0x00007f25188f4050
[task 2023-06-10T15:05:56.355Z] 15:05:56     INFO -      r15 = 0x0000000080004005    rip = 0x00007f250933e0b9
[task 2023-06-10T15:05:56.356Z] 15:05:56     INFO -     Found by: call frame info
[task 2023-06-10T15:05:56.356Z] 15:05:56     INFO - 30  libxul.so!XRE_RunAppShell() [nsEmbedFunctions.cpp:9c9d29101b3d0533b84b4e75dc06e89fcad3d31a : 717 + 0x8]
[task 2023-06-10T15:05:56.356Z] 15:05:56     INFO -      rbx = 0x00007ffcbd86e0b8    rbp = 0x00007ffcbd86e0a0
[task 2023-06-10T15:05:56.356Z] 15:05:56     INFO -      rsp = 0x00007ffcbd86e070    r12 = 0x00007f25188b8e00
[task 2023-06-10T15:05:56.356Z] 15:05:56     INFO -      r13 = 0x00000000000005f8    r14 = 0x00007f2518836dd0
[task 2023-06-10T15:05:56.356Z] 15:05:56     INFO -      r15 = 0x0000000080004005    rip = 0x00007f25096488bc
[task 2023-06-10T15:05:56.357Z] 15:05:56     INFO -     Found by: call frame info
[task 2023-06-10T15:05:56.357Z] 15:05:56     INFO - 31  libxul.so!MessageLoop::RunInternal() [message_loop.cc:9c9d29101b3d0533b84b4e75dc06e89fcad3d31a : 370]
[task 2023-06-10T15:05:56.357Z] 15:05:56     INFO -     Found by: inlining
[task 2023-06-10T15:05:56.358Z] 15:05:56     INFO - 32  libxul.so!MessageLoop::RunHandler() [message_loop.cc:9c9d29101b3d0533b84b4e75dc06e89fcad3d31a : 363]
[task 2023-06-10T15:05:56.358Z] 15:05:56     INFO -     Found by: inlining
[task 2023-06-10T15:05:56.358Z] 15:05:56     INFO - 33  libxul.so!MessageLoop::Run() [message_loop.cc:9c9d29101b3d0533b84b4e75dc06e89fcad3d31a : 345 + 0xb]
[task 2023-06-10T15:05:56.359Z] 15:05:56     INFO -      rbx = 0x00007ffcbd86e0b8    rbp = 0x00007ffcbd86e0e0
[task 2023-06-10T15:05:56.359Z] 15:05:56     INFO -      rsp = 0x00007ffcbd86e0b0    r12 = 0x00007f25188b8e00
[task 2023-06-10T15:05:56.359Z] 15:05:56     INFO -      r13 = 0x00000000000005f8    r14 = 0x000000000000000f
[task 2023-06-10T15:05:56.360Z] 15:05:56     INFO -      r15 = 0x0000000080004005    rip = 0x00007f2508bce4cf
[task 2023-06-10T15:05:56.360Z] 15:05:56     INFO -     Found by: call frame info
[task 2023-06-10T15:05:56.360Z] 15:05:56     INFO - 34  libxul.so!XRE_InitChildProcess(int, char**, XREChildData const*) [nsEmbedFunctions.cpp:9c9d29101b3d0533b84b4e75dc06e89fcad3d31a : 652 + 0x7]
[task 2023-06-10T15:05:56.360Z] 15:05:56     INFO -      rbx = 0x00007ffcbd86e128    rbp = 0x00007ffcbd86e390
[task 2023-06-10T15:05:56.361Z] 15:05:56     INFO -      rsp = 0x00007ffcbd86e0f0    r12 = 0x00007f25188b8e00
[task 2023-06-10T15:05:56.361Z] 15:05:56     INFO -      r13 = 0x00000000000005f8    r14 = 0x000000000000000f
[task 2023-06-10T15:05:56.361Z] 15:05:56     INFO -      r15 = 0x0000000080004005    rip = 0x00007f25096484ff
[task 2023-06-10T15:05:56.361Z] 15:05:56     INFO -     Found by: call frame info
[task 2023-06-10T15:05:56.362Z] 15:05:56     INFO - 35  firefox-bin!content_process_main(mozilla::Bootstrap*, int, char**) [plugin-container.cpp:9c9d29101b3d0533b84b4e75dc06e89fcad3d31a : 57]
[task 2023-06-10T15:05:56.362Z] 15:05:56     INFO -     Found by: inlining
[task 2023-06-10T15:05:56.362Z] 15:05:56     INFO - 36  firefox-bin!main [nsBrowserApp.cpp:9c9d29101b3d0533b84b4e75dc06e89fcad3d31a : 375 + 0x23]
[task 2023-06-10T15:05:56.363Z] 15:05:56     INFO -      rbx = 0x0000000000000012    rbp = 0x00007ffcbd86f400
[task 2023-06-10T15:05:56.365Z] 15:05:56     INFO -      rsp = 0x00007ffcbd86e3a0    r12 = 0x00007ffcbd86f4e8
[task 2023-06-10T15:05:56.365Z] 15:05:56     INFO -      r13 = 0x00007ffcbd86f4e0    r14 = 0x00007ffcbd86f4e8
[task 2023-06-10T15:05:56.365Z] 15:05:56     INFO -      r15 = 0x00007f25188036d0    rip = 0x000055bef2477115
[task 2023-06-10T15:05:56.365Z] 15:05:56     INFO -     Found by: call frame info
[task 2023-06-10T15:05:56.365Z] 15:05:56     INFO - 37  libc.so.6!__libc_start_main [libc-start.c : 310 + 0x19]
[task 2023-06-10T15:05:56.365Z] 15:05:56     INFO -      rbx = 0x0000000000000000    rbp = 0x000055bef2490bd0
[task 2023-06-10T15:05:56.365Z] 15:05:56     INFO -      rsp = 0x00007ffcbd86f410    r12 = 0x000055bef2476e72
[task 2023-06-10T15:05:56.365Z] 15:05:56     INFO -      r13 = 0x00007ffcbd86f4e0    r14 = 0x0000000000000000
[task 2023-06-10T15:05:56.365Z] 15:05:56     INFO -      r15 = 0x0000000000000000    rip = 0x00007f2518cd7b97
[task 2023-06-10T15:05:56.365Z] 15:05:56     INFO -     Found by: call frame info
[task 2023-06-10T15:05:56.365Z] 15:05:56     INFO - 38  firefox-bin!_start + 0x28
[task 2023-06-10T15:05:56.365Z] 15:05:56     INFO -      rbx = 0x0000000000000000    rbp = 0x0000000000000000
[task 2023-06-10T15:05:56.365Z] 15:05:56     INFO -      rsp = 0x00007ffcbd86f4d0    r12 = 0x000055bef2476e72
[task 2023-06-10T15:05:56.365Z] 15:05:56     INFO -      r13 = 0x00007ffcbd86f4e0    r14 = 0x0000000000000000
[task 2023-06-10T15:05:56.365Z] 15:05:56     INFO -      r15 = 0x0000000000000000    rip = 0x000055bef2476e9b
[task 2023-06-10T15:05:56.365Z] 15:05:56     INFO -     Found by: call frame info
[task 2023-06-10T15:05:56.365Z] 15:05:56     INFO - 

This crash can occur when jemalloc is given a bad pointer. Most likely an interior pointer to a valid jemalloc object given that it already passed assertions that check that it is pointing to a valid chunk. And that the interior pointer points to a different page from the object itself. Eg:


void* good_pointer = malloc(PAGE_SIZE * 4);
void* bad_pointer = good_pointer + PAGE_SIZE;
malloc_usable_size(bad_pointer) // crash

Or a UAF:


void* old_pointer = malloc(PAGE_SIZE);
free(old_pointer); // Can merge adjacent free runs
void* new_pointer = malloc(PAGE_SIZE*4); // Could allocate a run such that old_pointer is an interior pointer.
malloc_usable_size(old_pointer) // crash

I'm going to punt this to the JS GC team in case they have any clues regarding the call site. But it could be anything, including heap corruption.

Component: Memory Allocator → JavaScript: GC
Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → INCOMPLETE
Status: RESOLVED → REOPENED
Resolution: INCOMPLETE → ---
Status: REOPENED → RESOLVED
Closed: 2 years ago2 years ago
Resolution: --- → INCOMPLETE
You need to log in before you can comment on or make changes to this bug.