1856414 - Crash in [@ js::BaseShape::realm]

Status: NEW

(Core :: JavaScript Engine, defect, P5)

Description

[Mayank Bansal]

Crash report: https://crash-stats.mozilla.org/report/index/03ca2e9f-cf5c-4e11-a9ff-4cac70230928

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0  xul.dll  js::BaseShape::realm const  js/src/vm/Shape.h:258
0  xul.dll  js::Shape::realm const  js/src/vm/Shape.h:380
0  xul.dll  JSObject::nonCCWRealm const  js/src/vm/JSObject.h:411
0  xul.dll  js::NativeObject::realm const  js/src/vm/NativeObject.h:1700
0  xul.dll  js::BaseScript::realm const  js/src/vm/JSScript.h:1516
0  xul.dll  js::jit::BaselineEntry::lookupRealmID const  js/src/jit/JitcodeMap.cpp:188
0  xul.dll  js::jit::JitcodeGlobalEntry::lookupRealmID const  js/src/jit/JitcodeMap.cpp:470
1  xul.dll  JS::ProfiledFrameHandle::realmID const  js/src/jit/JitcodeMap.cpp:1120
1  xul.dll  StreamJITFrame  tools/profiler/core/ProfileBufferEntry.cpp:554
1  xul.dll  JSONForJITFrame  tools/profiler/core/ProfileBufferEntry.cpp:578

Comment 1

[Mayank Bansal]

Attachment: about:support

Comment 2

[Mayank Bansal]

I dont know how/what/when I got this crash. I saw an unsubmitted crash, submitted it and this is what I got.

Comment 3

[Iain Ireland [:iain]]

Taking a quick look at the crash, it does look like there might be some sort of bug in the profiling code. One register contains 0xe5e5e5e5e5e5e5e5, which is the jemalloc poison value implying that there's a use-after-free happening. The crash address is 0x6000000fafb49a34, which is a hard value to explain: the low bits would be relatively small for an address, and there are high bits set outside the 48-bit address space.

I didn't manage to get any disassembly out of breakpad.

There have been ~1400 crashes in the last six months in BaseShape::realm, and only three of them involve BaselineEntry::lookupRealmID. So this does not appear to be a particular common problem.

Overall, this is mildly interesting, but not particularly actionable. Assuming that it's profiler-specific, it's also unlikely to be exploitable.

There's not much we can do here unless we manage to replicate it more reliably.

Comment 4

[Harshit Sohaney [:hsohaney]]

Attachment: WIP: Bug 1856414 - Updating clear data dialog UI. WIP

Comment 5

[Mayank Bansal]

wrong bug?

Comment 6

[Harshit Sohaney [:hsohaney]]

Yeah sorry about that, wrong bug

Comment 7

[Phabricator Automation]

Comment on attachment 9360040 [details]
WIP: Bug 1856414 - Updating clear data dialog UI. WIP

Revision D189947 was moved to bug 1856415. Setting attachment 9360040 [details] to obsolete.

Comment 8

[Mayank Bansal]

Got this again today: https://crash-stats.mozilla.org/report/index/73f504cd-e7d4-4694-a6cf-5fff90250713#tab-bugzilla
While profiling a desmos graph.

Comment 9

[Iain Ireland [:iain]]

This looks like bug 1833295, in which case my patches in bug 1969435 might fix it.