1869084 - Crash in [@ JS::RealmCreationOptions::profilerRealmID]

Status: NEW

(Core :: Gecko Profiler, defect, P3)

Description

[Andrew McCreight [:mccr8]]

Crash report: https://crash-stats.mozilla.org/report/index/f1557067-a165-45c6-9b4e-336a60231003

Reason: SIGSEGV / SEGV_MAPERR

Top 10 frames of crashing thread:

0  libxul.so  JS::RealmCreationOptions::profilerRealmID const  js/public/RealmOptions.h:283
0  libxul.so  js::jit::IonEntry::lookupRealmID const  js/src/jit/JitcodeMap.cpp:111
1  libxul.so  JS::ProfiledFrameHandle::realmID const  js/src/jit/JitcodeMap.cpp:1120
1  libxul.so  StreamJITFrame  tools/profiler/core/ProfileBufferEntry.cpp:554
1  libxul.so  JSONForJITFrame  tools/profiler/core/ProfileBufferEntry.cpp:578
1  libxul.so  JITFrameInfo::AddInfoForRange const  tools/profiler/core/ProfileBufferEntry.cpp:620
1  libxul.so  std::_Function_handler<void   /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/include/c++/8/bits/std_function.h:297
2  libxul.so  std::function<void  const  /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/include/c++/8/bits/std_function.h:687
2  libxul.so  ProfileBuffer::AddJITInfoForRange const  tools/profiler/core/ProfileBufferEntry.cpp:1575
3  libxul.so  mozilla::ProfileChunkedBuffer::Read<ProfileBuffer::AddJITInfoForRange const  mozglue/baseprofiler/public/ProfileChunkedBuffer.h:652

4 crashes in the last 6 months, so it is very low volume. Some kind of null deref crash.

Comment 1

[Andrew McCreight [:mccr8]]

The signature looks generic, but all of the crashes are on the GatherProfileThread thread.