1862282 - Crash in [@ mozilla::Vector<T>::length | js::jit::AssemblerBuffer::size ]

Status: NEW

(Core :: JavaScript Engine: JIT, defect, P5)

Description

[BugBot [:suhaib / :marco/ :calixte]]

Crash report: https://crash-stats.mozilla.org/report/index/4427696d-6117-4549-8a5a-bedd70231029

Reason: SIGSEGV / SEGV_MAPERR

Top 10 frames of crashing thread:

0  libxul.so  mozilla::Vector<unsigned char,  const  mfbt/Vector.h:557
0  libxul.so  js::jit::AssemblerBuffer::size const  js/src/jit/x86-shared/AssemblerBuffer-x86-shared.h:172
0  libxul.so  js::jit::X86Encoding::BaseAssembler::X86InstructionFormatter::size const  js/src/jit/x86-shared/BaseAssembler-x86-shared.h:6230
0  libxul.so  js::jit::X86Encoding::BaseAssembler::label  js/src/jit/x86-shared/BaseAssembler-x86-shared.h:4510
0  libxul.so  js::jit::AssemblerX86Shared::bind  js/src/jit/x86-shared/Assembler-x86-shared.h:1042
0  libxul.so  js::jit::OutOfLineCode::bind  js/src/jit/shared/CodeGenerator-shared.h:412
0  libxul.so  js::jit::CodeGeneratorShared::generateOutOfLineCode  js/src/jit/shared/CodeGenerator-shared.cpp:204
0  libxul.so  js::jit::CodeGeneratorX86Shared::generateOutOfLineCode  js/src/jit/x86-shared/CodeGenerator-x86-shared.cpp:530
1  libxul.so  js::jit::CodeGenerator::generate  js/src/jit/CodeGenerator.cpp:14085
1  libxul.so  js::jit::GenerateCode  js/src/jit/Ion.cpp:1556

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2023-10-01
• Process type: Content
• Is startup crash: No
• Has user comments: No
• Is null crash: Yes - 3 out of 4 crashes happened on null or near null memory address

Comment 1

[Jan de Mooij [:jandem]]

This is a pretty generic signature. Some crashes are for the AssemblerBuffer vector, but this is one that's related to stencils:

https://crash-stats.mozilla.org/report/index/50cdd760-fdec-45ee-b4f2-e4f940231030

And one in the bytecode emitter:

https://crash-stats.mozilla.org/report/index/d87bbea6-aae2-4a95-8cf9-c44800231030

Comment 2

[Andrew McCreight [:mccr8]]

I'll file a bug about adding mozilla:Vector to the prefix list to split this signature up.

Comment 3

[Andrew McCreight [:mccr8]]

The signature for the crash in the first comment is now [@ mozilla::Vector<T>::length | js::jit::AssemblerBuffer::size ]

Comment 4

[Nicolas B. Pierron [:nbp]]

Given the low volume of crashes (less than 10 per day), and the fact that this signature is so generic, I have hard time to believe that there is really anything to be fixed by us.

Comment 5

[Andrew McCreight [:mccr8]]

It looks like I somehow deleted the non-generic signature.