1859381 - Crash in [@ js::wasm::Instance::callExport]

Status: NEW

(Core :: JavaScript: WebAssembly, defect, P2)

Description

[Ryan VanderMeulen [:RyanVM][PTO June 24-28]]

Seems to be happening primarily on Fenix, but there are some Desktop occurrences as well.

Crash report: https://crash-stats.mozilla.org/report/index/3eaebb34-e4da-4473-9cbf-6e6b70231016

Reason: SIGSEGV / SEGV_MAPERR

Top 2 frames of crashing thread:

0  ?  @0x50e44064  
1  libxul.so  js::wasm::Instance::callExport  js/src/wasm/WasmInstance.cpp:2644

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The bug is linked to a topcrash signature, which matches the following criterion:

• Top 10 AArch64 and ARM crashes on nightly

For more information, please visit BugBot documentation.

Comment 2

[Julian Seward [:jseward]]

This appears to be mostly arm32, with a bit of arm64, x32 and x64.

Comment 3

[Ryan Hunt [:rhunt]]

Looking at the trends, it's hard to tell if this was a 118 specific issue or if the release of 119 will cause this to spike up in that version. Crash reports are hard to tell what's going on and I need to re-up my protected data access to dig in deeper. Doing that now.

From sampling random reports, the crash seems to be happening in a JIT frame immediately below the Instance::callExport. This would be our 'interpreter entry stub'. It'd be really useful to know what instruction is failing. Most of the address violations are relatively near 0.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Based on the topcrash criteria, the crash signature linked to this bug is not a topcrash signature anymore.

For more information, please visit BugBot documentation.