Closed Bug 1871303 (CVE-2024-7527) Opened 2 years ago Closed 1 year ago

Intermittent MOZ_ASSERT(marker->isDrained()) [@ js::gc::GCRuntime::assertNoMarkingWork] | single tracking bug

Categories

(Core :: JavaScript: GC, defect, P1)

defect

Tracking

()

RESOLVED FIXED
130 Branch
Tracking Status
firefox-esr115 129+ fixed
firefox-esr128 129+ fixed
firefox128 --- wontfix
firefox129 + fixed
firefox130 + fixed

People

(Reporter: intermittent-bug-filer, Assigned: jonco)

References

(Blocks 1 open bug, Regression)

Details

(5 keywords, Whiteboard: [necko-monitor][adv-main129+r][adv-ESR115.14+r][adv-ESR128.1+r])

Crash Data

Attachments

(3 files, 2 obsolete files)

Filed by: nfay [at] mozilla.com
Parsed log: https://treeherder.mozilla.org/logviewer?job_id=440986774&repo=autoland
Full log: https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/FUflbG4ITHKLU8-dFNws3w/runs/0/artifacts/public/logs/live_backing.log


[task 2023-12-21T07:34:18.613Z] 07:34:18     INFO -  TEST-START | dom/xhr/tests/test_xhr_progressevents.html
[task 2023-12-21T07:34:38.832Z] 07:34:38     INFO -  wait for org.mozilla.geckoview.test_runner complete; top activity=com.android.launcher3
[task 2023-12-21T07:34:38.832Z] 07:34:38     INFO -  runtestsremote.py | Application ran for: 0:06:07.529870
[task 2023-12-21T07:34:38.905Z] 07:34:38     INFO -  mozcrash Copy/paste: /builds/worker/fetches/minidump-stackwalk/minidump-stackwalk --symbols-url=https://symbols.mozilla.org/ --cyborg=/tmp/tmp344zbtol/22688eca-044b-b094-bdc0-ce15553ba83b.trace /tmp/tmp3qby0_wp/22688eca-044b-b094-bdc0-ce15553ba83b.dmp /builds/worker/workspace/build/symbols
[task 2023-12-21T07:34:42.932Z] 07:34:42     INFO -  mozcrash Saved minidump as /builds/worker/workspace/build/blobber_upload_dir/22688eca-044b-b094-bdc0-ce15553ba83b.dmp
[task 2023-12-21T07:34:42.933Z] 07:34:42     INFO -  mozcrash Saved app info as /builds/worker/workspace/build/blobber_upload_dir/22688eca-044b-b094-bdc0-ce15553ba83b.extra
[task 2023-12-21T07:34:42.933Z] 07:34:42  WARNING -  PROCESS-CRASH | MOZ_ASSERT(marker->isDrained()) [@ js::gc::GCRuntime::assertNoMarkingWork] | dom/xhr/tests/mochitest.toml
[task 2023-12-21T07:34:42.933Z] 07:34:42     INFO -  Process type: content
[task 2023-12-21T07:34:42.933Z] 07:34:42     INFO -  Process pid: 8195
[task 2023-12-21T07:34:42.934Z] 07:34:42     INFO -  Mozilla crash reason: MOZ_ASSERT(marker->isDrained())
[task 2023-12-21T07:34:42.934Z] 07:34:42     INFO -  Crash dump filename: /tmp/tmp3qby0_wp/22688eca-044b-b094-bdc0-ce15553ba83b.dmp
[task 2023-12-21T07:34:42.934Z] 07:34:42     INFO -  Operating system: Android
[task 2023-12-21T07:34:42.934Z] 07:34:42     INFO -                    0.0.0 Linux 3.10.0+ #260 SMP PREEMPT Fri May 19 12:48:14 PDT 2017 x86_64
[task 2023-12-21T07:34:42.934Z] 07:34:42     INFO -  CPU: amd64
[task 2023-12-21T07:34:42.934Z] 07:34:42     INFO -       family 6 model 6 stepping 3
[task 2023-12-21T07:34:42.934Z] 07:34:42     INFO -       4 CPUs
[task 2023-12-21T07:34:42.934Z] 07:34:42     INFO -  Crash reason:  SIGSEGV / SEGV_MAPERR
[task 2023-12-21T07:34:42.934Z] 07:34:42     INFO -  Crash address: 0x0000000000000000
[task 2023-12-21T07:34:42.934Z] 07:34:42     INFO -  Crashing instruction: `mov dword [0x0], 0x528`
[task 2023-12-21T07:34:42.934Z] 07:34:42     INFO -  Memory accessed by instruction:
[task 2023-12-21T07:34:42.934Z] 07:34:42     INFO -    0. Address: 0x0000000000000000
[task 2023-12-21T07:34:42.934Z] 07:34:42     INFO -       Size: 4
[task 2023-12-21T07:34:42.934Z] 07:34:42     INFO -  Crashing address may be the result of a flipped bit:
[task 2023-12-21T07:34:42.934Z] 07:34:42     INFO -    0. Valid address: 0x0000000020000000 (0.250)
[task 2023-12-21T07:34:42.934Z] 07:34:42     INFO -    1. Valid address: 0x0000000040000000 (0.250)
[task 2023-12-21T07:34:42.934Z] 07:34:42     INFO -  Process uptime: not available
[task 2023-12-21T07:34:42.934Z] 07:34:42     INFO -  Thread 12 Web Content (crashed)
[task 2023-12-21T07:34:42.934Z] 07:34:42     INFO -   0  libxul.so!js::gc::GCRuntime::assertNoMarkingWork() const [GC.cpp:2339ef37f5863c45acf6280581ec0994b40f11d5 : 1320 + 0x0]
[task 2023-12-21T07:34:42.934Z] 07:34:42     INFO -       rax = 0x000076e4bba9b38b    rdx = 0x0000000000000001
[task 2023-12-21T07:34:42.935Z] 07:34:42     INFO -       rcx = 0x000076e4e01f94a0    rbx = 0x000076e4c7623620
[task 2023-12-21T07:34:42.935Z] 07:34:42     INFO -       rsi = 0x000076e4c93e1bf3    rdi = 0x000076e4e01fae34
[task 2023-12-21T07:34:42.935Z] 07:34:42     INFO -       rbp = 0x000076e4c8331540    rsp = 0x000076e4c8331540
[task 2023-12-21T07:34:42.935Z] 07:34:42     INFO -        r8 = 0x0000000000002003     r9 = 0x000076e4c8333450
[task 2023-12-21T07:34:42.935Z] 07:34:42     INFO -       r10 = 0x000076e4c8330e40    r11 = 0x0000000000000246
[task 2023-12-21T07:34:42.935Z] 07:34:42     INFO -       r12 = 0x000076e4c8331740    r13 = 0xaaaaaaaaaaaaaaaa
[task 2023-12-21T07:34:42.935Z] 07:34:42     INFO -       r14 = 0x000076e4c7623570    r15 = 0x000076e4c7623000
[task 2023-12-21T07:34:42.935Z] 07:34:42     INFO -       rip = 0x000076e4c4435480
[task 2023-12-21T07:34:42.935Z] 07:34:42     INFO -      Found by: given as instruction pointer in context
[task 2023-12-21T07:34:42.935Z] 07:34:42     INFO -   1  libxul.so!js::gc::GCRuntime::performSweepActions(js::SliceBudget&) [Sweeping.cpp:2339ef37f5863c45acf6280581ec0994b40f11d5 : 2321 + 0x7]
[task 2023-12-21T07:34:42.935Z] 07:34:42     INFO -       rbx = 0x000076e4c7623620    rbp = 0x000076e4c83315f0
[task 2023-12-21T07:34:42.935Z] 07:34:42     INFO -       rsp = 0x000076e4c8331550    r12 = 0x000076e4c8331740
[task 2023-12-21T07:34:42.935Z] 07:34:42     INFO -       r13 = 0xaaaaaaaaaaaaaaaa    r14 = 0x000076e4c7623570
[task 2023-12-21T07:34:42.935Z] 07:34:42     INFO -       r15 = 0x000076e4c7623000    rip = 0x000076e4c44f2539
[task 2023-12-21T07:34:42.935Z] 07:34:42     INFO -      Found by: call frame info
[task 2023-12-21T07:34:42.935Z] 07:34:42     INFO -   2  libxul.so!js::gc::GCRuntime::incrementalSlice(js::SliceBudget&, JS::GCReason, bool) [GC.cpp:2339ef37f5863c45acf6280581ec0994b40f11d5 : 3737 + 0xa]
[task 2023-12-21T07:34:42.936Z] 07:34:42     INFO -       rbx = 0x000076e4c7623570    rbp = 0x000076e4c83316d0
[task 2023-12-21T07:34:42.936Z] 07:34:42     INFO -       rsp = 0x000076e4c8331600    r12 = 0x000076e4c8331740
[task 2023-12-21T07:34:42.936Z] 07:34:42     INFO -       r13 = 0x000000000000002f    r14 = 0x0000000000000001
[task 2023-12-21T07:34:42.936Z] 07:34:42     INFO -       r15 = 0x0000000000000000    rip = 0x000076e4c4445c55
[task 2023-12-21T07:34:42.936Z] 07:34:42     INFO -      Found by: call frame info
[task 2023-12-21T07:34:42.936Z] 07:34:42     INFO -   3  libxul.so!js::gc::GCRuntime::gcCycle(bool, js::SliceBudget const&, JS::GCReason) [GC.cpp:2339ef37f5863c45acf6280581ec0994b40f11d5 : 4248 + 0xc]
[task 2023-12-21T07:34:42.936Z] 07:34:42     INFO -       rbx = 0x000000000000002f    rbp = 0x000076e4c83317a0
[task 2023-12-21T07:34:42.936Z] 07:34:42     INFO -       rsp = 0x000076e4c83316e0    r12 = 0x0000000000000000
[task 2023-12-21T07:34:42.936Z] 07:34:42     INFO -       r13 = 0x000076e4c7623620    r14 = 0x000076e4c7623570
[task 2023-12-21T07:34:42.936Z] 07:34:42     INFO -       r15 = 0x0000000000000001    rip = 0x000076e4c4447f5b
[task 2023-12-21T07:34:42.936Z] 07:34:42     INFO -      Found by: call frame info
[task 2023-12-21T07:34:42.936Z] 07:34:42     INFO -   4  libxul.so!js::gc::GCRuntime::collect(bool, js::SliceBudget const&, JS::GCReason) [GC.cpp:2339ef37f5863c45acf6280581ec0994b40f11d5 : 4439 + 0xf]
[task 2023-12-21T07:34:42.936Z] 07:34:42     INFO -       rbx = 0x000000000000002f    rbp = 0x000076e4c8331820
[task 2023-12-21T07:34:42.936Z] 07:34:42     INFO -       rsp = 0x000076e4c83317b0    r12 = 0x0000000000000000
[task 2023-12-21T07:34:42.936Z] 07:34:42     INFO -       r13 = 0x000076e4c83318c0    r14 = 0x000076e4c7623570
[task 2023-12-21T07:34:42.936Z] 07:34:42     INFO -       r15 = 0x0000000000000000    rip = 0x000076e4c4449050
[task 2023-12-21T07:34:42.937Z] 07:34:42     INFO -      Found by: call frame info
[task 2023-12-21T07:34:42.937Z] 07:34:42     INFO -   5  libxul.so!GarbageCollectImpl(JS::GCReason, nsJSContext::IsShrinking, js::SliceBudget const&) [nsJSEnvironment.cpp:2339ef37f5863c45acf6280581ec0994b40f11d5 : 1059 + 0xc]
[task 2023-12-21T07:34:42.937Z] 07:34:42     INFO -       rbx = 0x000000000000002f    rbp = 0x000076e4c8331870
[task 2023-12-21T07:34:42.937Z] 07:34:42     INFO -       rsp = 0x000076e4c8331830    r12 = 0x0000000000000001
[task 2023-12-21T07:34:42.937Z] 07:34:42     INFO -       r13 = 0x000076e4c8331900    r14 = 0x000076e4c83318c0
[task 2023-12-21T07:34:42.937Z] 07:34:42     INFO -       r15 = 0x000076e4c7633400    rip = 0x000076e4c097cf74
[task 2023-12-21T07:34:42.937Z] 07:34:42     INFO -      Found by: call frame info
[task 2023-12-21T07:34:42.937Z] 07:34:42     INFO -   6  libxul.so!nsJSContext::RunIncrementalGCSlice(JS::GCReason, nsJSContext::IsShrinking, js::SliceBudget&) [nsJSEnvironment.cpp:2339ef37f5863c45acf6280581ec0994b40f11d5 : 1096 + 0xd]
[task 2023-12-21T07:34:42.937Z] 07:34:42     INFO -       rbx = 0x000076e4c83318c0    rbp = 0x000076e4c83318b0
[task 2023-12-21T07:34:42.937Z] 07:34:42     INFO -       rsp = 0x000076e4c8331880    r12 = 0x000076e4c8331880
[task 2023-12-21T07:34:42.937Z] 07:34:42     INFO -       r13 = 0x000076e4c8331958    r14 = 0x0000000000000001
[task 2023-12-21T07:34:42.937Z] 07:34:42     INFO -       r15 = 0x000000000000002f    rip = 0x000076e4c097d059
[task 2023-12-21T07:34:42.937Z] 07:34:42     INFO -      Found by: call frame info
[task 2023-12-21T07:34:42.937Z] 07:34:42     INFO -   7  libxul.so!mozilla::CCGCScheduler::GCRunnerFiredDoGC(mozilla::TimeStamp, mozilla::GCRunnerStep const&) [CCGCScheduler.cpp:2339ef37f5863c45acf6280581ec0994b40f11d5 : 446 + 0xe]
[task 2023-12-21T07:34:42.937Z] 07:34:42     INFO -       rbx = 0x000076e4c6c9f730    rbp = 0x000076e4c8331920
[task 2023-12-21T07:34:42.938Z] 07:34:42     INFO -       rsp = 0x000076e4c83318c0    r12 = 0x000076e4c83318c0
[task 2023-12-21T07:34:42.938Z] 07:34:42     INFO -       r13 = 0x000076e4c8331958    r14 = 0x0000000000000001
[task 2023-12-21T07:34:42.938Z] 07:34:42     INFO -       r15 = 0x000076e4c83318d0    rip = 0x000076e4c07c0663
[task 2023-12-21T07:34:42.938Z] 07:34:42     INFO -      Found by: call frame info
[task 2023-12-21T07:34:42.938Z] 07:34:42     INFO -   8  libxul.so!mozilla::CCGCScheduler::GCRunnerFired(mozilla::TimeStamp) [CCGCScheduler.cpp:2339ef37f5863c45acf6280581ec0994b40f11d5 : 405 + 0xa]
[task 2023-12-21T07:34:42.938Z] 07:34:42     INFO -       rbx = 0x000000b5f787a962    rbp = 0x000076e4c83319a0
[task 2023-12-21T07:34:42.938Z] 07:34:42     INFO -       rsp = 0x000076e4c8331930    r12 = 0x000076e4b32054c0
[task 2023-12-21T07:34:42.938Z] 07:34:42     INFO -       r13 = 0x000076e4d9b5a220    r14 = 0x000076e4c6c9f730
[task 2023-12-21T07:34:42.938Z] 07:34:42     INFO -       r15 = 0x000000000000002f    rip = 0x000076e4c07c02b3
[task 2023-12-21T07:34:42.938Z] 07:34:42     INFO -      Found by: call frame info
[task 2023-12-21T07:34:42.938Z] 07:34:42     INFO -   9  libxul.so!std::__ndk1::function<bool (mozilla::TimeStamp)>::operator()(mozilla::TimeStamp) const [functional : 2556 + 0x7]
[task 2023-12-21T07:34:42.938Z] 07:34:42     INFO -       rbx = 0x000076e4b3eef6b0    rbp = 0x000076e4c83319c0
[task 2023-12-21T07:34:42.938Z] 07:34:42     INFO -       rsp = 0x000076e4c83319b0    r12 = 0x000076e4b32054c0
[task 2023-12-21T07:34:42.938Z] 07:34:42     INFO -       r13 = 0x000076e4d9b5a220    r14 = 0x000076e4b3eef6d0
[task 2023-12-21T07:34:42.938Z] 07:34:42     INFO -       r15 = 0x000076e4b3eef710    rip = 0x000076e4bf8c1f44
[task 2023-12-21T07:34:42.938Z] 07:34:42     INFO -      Found by: call frame info
[task 2023-12-21T07:34:42.938Z] 07:34:42     INFO -  10  libxul.so!mozilla::IdleTaskRunner::Run() [IdleTaskRunner.cpp:2339ef37f5863c45acf6280581ec0994b40f11d5 : 124 + 0xb]
[task 2023-12-21T07:34:42.939Z] 07:34:42     INFO -       rbx = 0x000076e4b3eef6b0    rbp = 0x000076e4c8331a00
[task 2023-12-21T07:34:42.939Z] 07:34:42     INFO -       rsp = 0x000076e4c83319d0    r12 = 0x000076e4b32054c0
[task 2023-12-21T07:34:42.939Z] 07:34:42     INFO -       r13 = 0x000076e4d9b5a220    r14 = 0x000076e4b3eef6d0
[task 2023-12-21T07:34:42.939Z] 07:34:42     INFO -       r15 = 0x000076e4b3eef710    rip = 0x000076e4bf8c1e07
[task 2023-12-21T07:34:42.939Z] 07:34:42     INFO -      Found by: call frame info
[task 2023-12-21T07:34:42.939Z] 07:34:42     INFO -  11  libxul.so!mozilla::IdleTaskRunnerTask::Run() [IdleTaskRunner.cpp:2339ef37f5863c45acf6280581ec0994b40f11d5 : 45 + 0xf]
[task 2023-12-21T07:34:42.939Z] 07:34:42     INFO -       rbx = 0x000076e4c8331a18    rbp = 0x000076e4c8331a30
[task 2023-12-21T07:34:42.939Z] 07:34:42     INFO -       rsp = 0x000076e4c8331a10    r12 = 0x000076e4b32054c0
[task 2023-12-21T07:34:42.939Z] 07:34:42     INFO -       r13 = 0x000076e4d9b5a220    r14 = 0x000076e4c8331b80
[task 2023-12-21T07:34:42.939Z] 07:34:42     INFO -       r15 = 0x000076e4c8331ab0    rip = 0x000076e4bf8c26ae
[task 2023-12-21T07:34:42.939Z] 07:34:42     INFO -      Found by: call frame info
[task 2023-12-21T07:34:42.939Z] 07:34:42     INFO -  12  libxul.so!mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) [TaskController.cpp:2339ef37f5863c45acf6280581ec0994b40f11d5 : 884 + 0x9]
[task 2023-12-21T07:34:42.939Z] 07:34:42     INFO -       rbx = 0x0000000000000000    rbp = 0x000076e4c8332050
[task 2023-12-21T07:34:42.939Z] 07:34:42     INFO -       rsp = 0x000076e4c8331a40    r12 = 0x000076e4b32054c0
[task 2023-12-21T07:34:42.939Z] 07:34:42     INFO -       r13 = 0x000076e4d9b5a220    r14 = 0x000076e4c8331b80
[task 2023-12-21T07:34:42.939Z] 07:34:42     INFO -       r15 = 0x000076e4c8331ab0    rip = 0x000076e4bf8cb8ed
[task 2023-12-21T07:34:42.939Z] 07:34:42     INFO -      Found by: call frame info
[task 2023-12-21T07:34:42.940Z] 07:34:42     INFO -  13  libxul.so!mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) [TaskController.cpp:2339ef37f5863c45acf6280581ec0994b40f11d5 : 749 + 0xa]
[task 2023-12-21T07:34:42.940Z] 07:34:42     INFO -       rbx = 0x000076e4d9b4da00    rbp = 0x000076e4c83320b0
[task 2023-12-21T07:34:42.940Z] 07:34:42     INFO -       rsp = 0x000076e4c8332060    r12 = 0x000076e4d9b4daf8
[task 2023-12-21T07:34:42.940Z] 07:34:42     INFO -       r13 = 0x000076e4c83320c8    r14 = 0x000076e4d9b4dbe8
[task 2023-12-21T07:34:42.940Z] 07:34:42     INFO -       r15 = 0x000076e4c8332078    rip = 0x000076e4bf8cad10
[task 2023-12-21T07:34:42.940Z] 07:34:42     INFO -      Found by: call frame info
[task 2023-12-21T07:34:42.940Z] 07:34:42     INFO -  14  libxul.so!mozilla::TaskController::ProcessPendingMTTask(bool) [TaskController.cpp:2339ef37f5863c45acf6280581ec0994b40f11d5 : 493 + 0xb]
[task 2023-12-21T07:34:42.940Z] 07:34:42     INFO -       rbx = 0x000076e4d9b4da00    rbp = 0x000076e4c8332100
[task 2023-12-21T07:34:42.940Z] 07:34:42     INFO -       rsp = 0x000076e4c83320c0    r12 = 0x000076e4d9b4daf8
[task 2023-12-21T07:34:42.940Z] 07:34:42     INFO -       r13 = 0x000076e4bbba0917    r14 = 0x0000000000000001
[task 2023-12-21T07:34:42.940Z] 07:34:42     INFO -       r15 = 0x000076e4c83320c0    rip = 0x000076e4bf8cae66
[task 2023-12-21T07:34:42.940Z] 07:34:42     INFO -      Found by: call frame info
[task 2023-12-21T07:34:42.940Z] 07:34:42     INFO -  15  libxul.so!mozilla::TaskController::TaskController()::$_0::operator()() const [TaskController.cpp:2339ef37f5863c45acf6280581ec0994b40f11d5 : 211]
[task 2023-12-21T07:34:42.940Z] 07:34:42     INFO -      Found by: inlining
[task 2023-12-21T07:34:42.940Z] 07:34:42     INFO -  16  libxul.so!mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() [nsThreadUtils.h:2339ef37f5863c45acf6280581ec0994b40f11d5 : 548 + 0xe]
[task 2023-12-21T07:34:42.941Z] 07:34:42     INFO -       rbx = 0x000076e4d9b5e5c0    rbp = 0x000076e4c8332110
[task 2023-12-21T07:34:42.941Z] 07:34:42     INFO -       rsp = 0x000076e4c8332110    r12 = 0x000076e4c8332101
[task 2023-12-21T07:34:42.941Z] 07:34:42     INFO -       r13 = 0x000000b5f48c3232    r14 = 0xaaaaaaaaaaaaaaaa
[task 2023-12-21T07:34:42.941Z] 07:34:42     INFO -       r15 = 0x000076e4c83321b0    rip = 0x000076e4bf8d79b7
[task 2023-12-21T07:34:42.941Z] 07:34:42     INFO -      Found by: call frame info
[task 2023-12-21T07:34:42.941Z] 07:34:42     INFO -  17  libxul.so!nsThread::ProcessNextEvent(bool, bool*) [nsThread.cpp:2339ef37f5863c45acf6280581ec0994b40f11d5 : 1199 + 0xd]
[task 2023-12-21T07:34:42.941Z] 07:34:42     INFO -       rbx = 0x000076e4d9b5e5c0    rbp = 0x000076e4c8332250
[task 2023-12-21T07:34:42.941Z] 07:34:42     INFO -       rsp = 0x000076e4c8332120    r12 = 0x000076e4c8332101
[task 2023-12-21T07:34:42.941Z] 07:34:42     INFO -       r13 = 0x000000b5f48c3232    r14 = 0xaaaaaaaaaaaaaaaa
[task 2023-12-21T07:34:42.941Z] 07:34:42     INFO -       r15 = 0x000076e4c83321b0    rip = 0x000076e4bf8e62b7
[task 2023-12-21T07:34:42.941Z] 07:34:42     INFO -      Found by: call frame info
[task 2023-12-21T07:34:42.941Z] 07:34:42     INFO -  18  libxul.so!NS_ProcessNextEvent(nsIThread*, bool) [nsThreadUtils.cpp:2339ef37f5863c45acf6280581ec0994b40f11d5 : 480 + 0x11]
[task 2023-12-21T07:34:42.941Z] 07:34:42     INFO -       rbx = 0x0000000000000000    rbp = 0x000076e4c8332290
[task 2023-12-21T07:34:42.941Z] 07:34:42     INFO -       rsp = 0x000076e4c8332260    r12 = 0x0000000000000001
[task 2023-12-21T07:34:42.941Z] 07:34:42     INFO -       r13 = 0x000076e4d9b07120    r14 = 0x000076e4d9b5e5c0
[task 2023-12-21T07:34:42.941Z] 07:34:42     INFO -       r15 = 0x000076e4c833226f    rip = 0x000076e4bf8ea5d8
[task 2023-12-21T07:34:42.941Z] 07:34:42     INFO -      Found by: call frame info
[task 2023-12-21T07:34:42.942Z] 07:34:42     INFO -  19  libxul.so!mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) [MessagePump.cpp:2339ef37f5863c45acf6280581ec0994b40f11d5 : 85 + 0x9]
[task 2023-12-21T07:34:42.942Z] 07:34:42     INFO -       rbx = 0x000076e4d9b07100    rbp = 0x000076e4c83322e0
[task 2023-12-21T07:34:42.942Z] 07:34:42     INFO -       rsp = 0x000076e4c83322a0    r12 = 0x0000000000000001
[task 2023-12-21T07:34:42.942Z] 07:34:42     INFO -       r13 = 0x000076e4d9b07120    r14 = 0x000076e4c83324b8
[task 2023-12-21T07:34:42.942Z] 07:34:42     INFO -       r15 = 0x000076e4d9b5e5c0    rip = 0x000076e4c0017992
[task 2023-12-21T07:34:42.942Z] 07:34:42     INFO -      Found by: call frame info
[task 2023-12-21T07:34:42.942Z] 07:34:42     INFO -  20  libxul.so!MessageLoop::RunInternal() [message_loop.cc:2339ef37f5863c45acf6280581ec0994b40f11d5 : 370 + 0x16]
[task 2023-12-21T07:34:42.942Z] 07:34:42     INFO -       rbx = 0x000076e4c83324b8    rbp = 0x000076e4c8332320
[task 2023-12-21T07:34:42.942Z] 07:34:42     INFO -       rsp = 0x000076e4c83322f0    r12 = 0x0000000080004005
[task 2023-12-21T07:34:42.942Z] 07:34:42     INFO -       r13 = 0x0000000000000003    r14 = 0x000076e4c8332330
[task 2023-12-21T07:34:42.942Z] 07:34:42     INFO -       r15 = 0x000076e4c8332480    rip = 0x000076e4bffb9fa8
[task 2023-12-21T07:34:42.943Z] 07:34:42     INFO -      Found by: call frame info
[task 2023-12-21T07:34:42.943Z] 07:34:42     INFO -  21  libxul.so!MessageLoop::RunHandler() [message_loop.cc:2339ef37f5863c45acf6280581ec0994b40f11d5 : 363]
[task 2023-12-21T07:34:42.943Z] 07:34:42     INFO -      Found by: inlining
[task 2023-12-21T07:34:42.943Z] 07:34:42     INFO -  22  libxul.so!MessageLoop::Run() [message_loop.cc:2339ef37f5863c45acf6280581ec0994b40f11d5 : 345 + 0x7]
[task 2023-12-21T07:34:42.943Z] 07:34:42     INFO -       rbx = 0x000076e4c83324b8    rbp = 0x000076e4c8332360
[task 2023-12-21T07:34:42.943Z] 07:34:42     INFO -       rsp = 0x000076e4c8332330    r12 = 0x0000000080004005
[task 2023-12-21T07:34:42.943Z] 07:34:42     INFO -       r13 = 0x0000000000000003    r14 = 0x000076e4c8332330
[task 2023-12-21T07:34:42.943Z] 07:34:42     INFO -       r15 = 0x000076e4c8332480    rip = 0x000076e4bffb9f11
[task 2023-12-21T07:34:42.943Z] 07:34:42     INFO -      Found by: call frame info
[task 2023-12-21T07:34:42.943Z] 07:34:42     INFO -  23  libxul.so!nsBaseAppShell::Run() [nsBaseAppShell.cpp:2339ef37f5863c45acf6280581ec0994b40f11d5 : 148 + 0xc]
[task 2023-12-21T07:34:42.943Z] 07:34:42     INFO -       rbx = 0x000076e4c75af500    rbp = 0x000076e4c8332380
[task 2023-12-21T07:34:42.943Z] 07:34:42     INFO -       rsp = 0x000076e4c8332370    r12 = 0x0000000080004005
[task 2023-12-21T07:34:42.943Z] 07:34:42     INFO -       r13 = 0x0000000000000003    r14 = 0x000076e4d9b5e5c0
[task 2023-12-21T07:34:42.943Z] 07:34:42     INFO -       r15 = 0x000076e4c8332480    rip = 0x000076e4c2812d0d
[task 2023-12-21T07:34:42.944Z] 07:34:42     INFO -      Found by: call frame info
[task 2023-12-21T07:34:42.944Z] 07:34:42     INFO -  24  libxul.so!XRE_RunAppShell() [nsEmbedFunctions.cpp:2339ef37f5863c45acf6280581ec0994b40f11d5 : 721 + 0xd]
[task 2023-12-21T07:34:42.944Z] 07:34:42     INFO -       rbx = 0x000076e4c8332398    rbp = 0x000076e4c83323b0
[task 2023-12-21T07:34:42.944Z] 07:34:42     INFO -       rsp = 0x000076e4c8332390    r12 = 0x0000000080004005
[task 2023-12-21T07:34:42.944Z] 07:34:42     INFO -       r13 = 0x0000000000000003    r14 = 0x000076e4d9b07100
[task 2023-12-21T07:34:42.944Z] 07:34:42     INFO -       r15 = 0x000076e4c8332480    rip = 0x000076e4c39b9d11
[task 2023-12-21T07:34:42.944Z] 07:34:42     INFO -      Found by: call frame info
[task 2023-12-21T07:34:42.944Z] 07:34:42     INFO -  25  libxul.so!mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) [MessagePump.cpp:2339ef37f5863c45acf6280581ec0994b40f11d5 : 235 + 0x4]
[task 2023-12-21T07:34:42.944Z] 07:34:42     INFO -       rbx = 0x000076e4c83324b8    rbp = 0x000076e4c83323e0
[task 2023-12-21T07:34:42.944Z] 07:34:42     INFO -       rsp = 0x000076e4c83323c0    r12 = 0x0000000080004005
[task 2023-12-21T07:34:42.944Z] 07:34:42     INFO -       r13 = 0x0000000000000003    r14 = 0x000076e4d9b07100
[task 2023-12-21T07:34:42.944Z] 07:34:42     INFO -       r15 = 0x000076e4c8332480    rip = 0x000076e4c0017ffb
[task 2023-12-21T07:34:42.944Z] 07:34:42     INFO -      Found by: call frame info
[task 2023-12-21T07:34:42.944Z] 07:34:42     INFO -  26  libxul.so!MessageLoop::RunInternal() [message_loop.cc:2339ef37f5863c45acf6280581ec0994b40f11d5 : 370 + 0x16]
[task 2023-12-21T07:34:42.944Z] 07:34:42     INFO -       rbx = 0x000076e4c83324b8    rbp = 0x000076e4c8332420
[task 2023-12-21T07:34:42.944Z] 07:34:42     INFO -       rsp = 0x000076e4c83323f0    r12 = 0x0000000080004005
[task 2023-12-21T07:34:42.945Z] 07:34:42     INFO -       r13 = 0x0000000000000003    r14 = 0x000076e4c8332430
[task 2023-12-21T07:34:42.945Z] 07:34:42     INFO -       r15 = 0x000076e4c8332480    rip = 0x000076e4bffb9fa8
[task 2023-12-21T07:34:42.945Z] 07:34:42     INFO -      Found by: call frame info
[task 2023-12-21T07:34:42.945Z] 07:34:42     INFO -  27  libxul.so!MessageLoop::RunHandler() [message_loop.cc:2339ef37f5863c45acf6280581ec0994b40f11d5 : 363]
[task 2023-12-21T07:34:42.945Z] 07:34:42     INFO -      Found by: inlining
[task 2023-12-21T07:34:42.945Z] 07:34:42     INFO -  28  libxul.so!MessageLoop::Run() [message_loop.cc:2339ef37f5863c45acf6280581ec0994b40f11d5 : 345 + 0x7]
[task 2023-12-21T07:34:42.945Z] 07:34:42     INFO -       rbx = 0x000076e4c83324b8    rbp = 0x000076e4c8332460
[task 2023-12-21T07:34:42.945Z] 07:34:42     INFO -       rsp = 0x000076e4c8332430    r12 = 0x0000000080004005
[task 2023-12-21T07:34:42.945Z] 07:34:42     INFO -       r13 = 0x0000000000000003    r14 = 0x000076e4c8332430
[task 2023-12-21T07:34:42.945Z] 07:34:42     INFO -       r15 = 0x000076e4c8332480    rip = 0x000076e4bffb9f11
[task 2023-12-21T07:34:42.945Z] 07:34:42     INFO -      Found by: call frame info
[task 2023-12-21T07:34:42.945Z] 07:34:42     INFO -  29  libxul.so!XRE_InitChildProcess(int, char**, XREChildData const*) [nsEmbedFunctions.cpp:2339ef37f5863c45acf6280581ec0994b40f11d5 : 656 + 0x4]
[task 2023-12-21T07:34:42.945Z] 07:34:42     INFO -       rbx = 0x000076e4d9b1c520    rbp = 0x000076e4c83326f0
[task 2023-12-21T07:34:42.945Z] 07:34:42     INFO -       rsp = 0x000076e4c8332470    r12 = 0x0000000080004005
[task 2023-12-21T07:34:42.945Z] 07:34:42     INFO -       r13 = 0x0000000000000003    r14 = 0x000000000000000e
[task 2023-12-21T07:34:42.945Z] 07:34:42     INFO -       r15 = 0x000076e4c8332480    rip = 0x000076e4c39b9720
[task 2023-12-21T07:34:42.945Z] 07:34:42     INFO -      Found by: call frame info
[task 2023-12-21T07:34:42.946Z] 07:34:42     INFO -  30  libmozglue.so!Java_org_mozilla_gecko_mozglue_GeckoLoader_nativeRun [APKOpen.cpp:2339ef37f5863c45acf6280581ec0994b40f11d5 : 401 + 0x1f]
[task 2023-12-21T07:34:42.946Z] 07:34:42     INFO -       rbx = 0x0000000000000012    rbp = 0x000076e4c8332780
[task 2023-12-21T07:34:42.946Z] 07:34:42     INFO -       rsp = 0x000076e4c8332700    r12 = 0x000076e4d9b1c520
[task 2023-12-21T07:34:42.946Z] 07:34:42     INFO -       r13 = 0x0000000000000012    r14 = 0x000076e4c8332740
[task 2023-12-21T07:34:42.946Z] 07:34:42     INFO -       r15 = 0x0000000000000011    rip = 0x000076e4e012048b
[task 2023-12-21T07:34:42.946Z] 07:34:42     INFO -      Found by: call frame info
[task 2023-12-21T07:34:42.946Z] 07:34:42     INFO -  31  base.odex + 0x10adbf3
[task 2023-12-21T07:34:42.946Z] 07:34:42     INFO -       rbx = 0x000076e4e1aba200    rbp = 0x000076e4c8332868
[task 2023-12-21T07:34:42.946Z] 07:34:42     INFO -       rsp = 0x000076e4c8332790    r12 = 0x000076e4c83329f0
[task 2023-12-21T07:34:42.946Z] 07:34:42     INFO -       r13 = 0x000076e4e5e7bd28    r14 = 0x000076e4c8332c10
[task 2023-12-21T07:34:42.946Z] 07:34:42     INFO -       r15 = 0x000076e4c8332c10    rip = 0x000076e4c93e1bf4
[task 2023-12-21T07:34:42.946Z] 07:34:42     INFO -      Found by: call frame info
[task 2023-12-21T07:34:42.946Z] 07:34:42     INFO -  32  0x76e4c8332c0f
[task 2023-12-21T07:34:42.946Z] 07:34:42     INFO -       rbp = 0x000076e4c8332c10    rsp = 0x000076e4c8332878
[task 2023-12-21T07:34:42.946Z] 07:34:42     INFO -       rip = 0x000076e4c8332c10
[task 2023-12-21T07:34:42.946Z] 07:34:42     INFO -      Found by: previous frame's frame pointer
[task 2023-12-21T07:34:42.946Z] 07:34:42     INFO -  33  base.odex + 0xc12ef6
[task 2023-12-21T07:34:42.946Z] 07:34:42     INFO -       rbp = 0x000076e4c8332c10    rsp = 0x000076e4c8332898
[task 2023-12-21T07:34:42.946Z] 07:34:42     INFO -       rip = 0x000076e4c8f46ef7
[task 2023-12-21T07:34:42.946Z] 07:34:42     INFO -      Found by: stack scanning
[task 2023-12-21T07:34:42.946Z] 07:34:42     INFO -  34  libart.so + 0x14546c
[task 2023-12-21T07:34:42.946Z] 07:34:42     INFO -       rbp = 0x000076e4c8332c10    rsp = 0x000076e4c83328b0
[task 2023-12-21T07:34:42.947Z] 07:34:42     INFO -       rip = 0x000076e4e145146d
[task 2023-12-21T07:34:42.947Z] 07:34:42     INFO -      Found by: stack scanning
[task 2023-12-21T07:34:42.947Z] 07:34:42     INFO -  35  base.odex + 0xa0dfb3
[task 2023-12-21T07:34:42.947Z] 07:34:42     INFO -       rbp = 0x000076e4c8332c10    rsp = 0x000076e4c83328e0
[task 2023-12-21T07:34:42.947Z] 07:34:42     INFO -       rip = 0x000076e4c8d41fb4
[task 2023-12-21T07:34:42.947Z] 07:34:42     INFO -      Found by: stack scanning
[task 2023-12-21T07:34:42.947Z] 07:34:42     INFO -  36  base.odex + 0x9e668b
[task 2023-12-21T07:34:42.947Z] 07:34:42     INFO -       rbp = 0x000076e4c8332c10    rsp = 0x000076e4c8332938
[task 2023-12-21T07:34:42.947Z] 07:34:42     INFO -       rip = 0x000076e4c8d1a68c
[task 2023-12-21T07:34:42.947Z] 07:34:42     INFO -      Found by: stack scanning
[task 2023-12-21T07:34:42.947Z] 07:34:42     INFO -  37  libart.so + 0x310b7f
[task 2023-12-21T07:34:42.947Z] 07:34:42     INFO -       rsp = 0x000076e4c8332940    rip = 0x000076e4e161cb80
[task 2023-12-21T07:34:42.947Z] 07:34:42     INFO -      Found by: stack scanning
[task 2023-12-21T07:34:42.947Z] 07:34:42     INFO -  38  boot.oat + 0x263b7
[task 2023-12-21T07:34:42.947Z] 07:34:42     INFO -       rsp = 0x000076e4c8332958    rip = 0x00000000710803b8
[task 2023-12-21T07:34:42.947Z] 07:34:42     INFO -      Found by: stack scanning
[task 2023-12-21T07:34:42.947Z] 07:34:42     INFO -  39  libart.so + 0x310b7f
[task 2023-12-21T07:34:42.947Z] 07:34:42     INFO -       rsp = 0x000076e4c8332960    rip = 0x000076e4e161cb80
[task 2023-12-21T07:34:42.947Z] 07:34:42     INFO -      Found by: stack scanning
[task 2023-12-21T07:34:42.947Z] 07:34:42     INFO -  40  boot.oat + 0x263b7
[task 2023-12-21T07:34:42.947Z] 07:34:42     INFO -       rsp = 0x000076e4c8332968    rip = 0x00000000710803b8
[task 2023-12-21T07:34:42.947Z] 07:34:42     INFO -      Found by: stack scanning
[task 2023-12-21T07:34:42.947Z] 07:34:42     INFO -  41  libart.so + 0x310b7f
[task 2023-12-21T07:34:42.948Z] 07:34:42     INFO -       rsp = 0x000076e4c8332970    rip = 0x000076e4e161cb80
[task 2023-12-21T07:34:42.948Z] 07:34:42     INFO -      Found by: stack scanning
[task 2023-12-21T07:34:42.948Z] 07:34:42     INFO -  42  libart.so + 0x1ed2ad
[task 2023-12-21T07:34:42.948Z] 07:34:42     INFO -       rsp = 0x000076e4c83329a0    rip = 0x000076e4e14f92ae
[task 2023-12-21T07:34:42.948Z] 07:34:42     INFO -      Found by: stack scanning
[task 2023-12-21T07:34:42.948Z] 07:34:42     INFO -  43  libart.so + 0x30a401
[task 2023-12-21T07:34:42.948Z] 07:34:42     INFO -       rsp = 0x000076e4c83329f0    rip = 0x000076e4e1616402
[task 2023-12-21T07:34:42.948Z] 07:34:42     INFO -      Found by: stack scanning
[task 2023-12-21T07:34:42.948Z] 07:34:42     INFO -  44  base.odex + 0xa534c7
[task 2023-12-21T07:34:42.948Z] 07:34:42     INFO -       rsp = 0x000076e4c8332b10    rip = 0x000076e4c8d874c8
[task 2023-12-21T07:34:42.948Z] 07:34:42     INFO -      Found by: stack scanning
[task 2023-12-21T07:34:42.948Z] 07:34:42     INFO -  45  libart.so + 0x619bda
[task 2023-12-21T07:34:42.948Z] 07:34:42     INFO -       rsp = 0x000076e4c8332b20    rip = 0x000076e4e1925bdb
[task 2023-12-21T07:34:42.948Z] 07:34:42     INFO -      Found by: stack scanning
[task 2023-12-21T07:34:42.948Z] 07:34:42     INFO -  46  base.odex + 0xa533f9
[task 2023-12-21T07:34:42.948Z] 07:34:42     INFO -       rsp = 0x000076e4c8332b40    rip = 0x000076e4c8d873fa
[task 2023-12-21T07:34:42.948Z] 07:34:42     INFO -      Found by: stack scanning
[task 2023-12-21T07:34:42.948Z] 07:34:42     INFO -  47  base.odex + 0xa534c7
[task 2023-12-21T07:34:42.948Z] 07:34:42     INFO -       rsp = 0x000076e4c8332b98    rip = 0x000076e4c8d874c8
[task 2023-12-21T07:34:42.948Z] 07:34:42     INFO -      Found by: stack scanning
[task 2023-12-21T07:34:42.948Z] 07:34:42     INFO -  48  libart.so + 0x1251ff
[task 2023-12-21T07:34:42.948Z] 07:34:42     INFO -       rsp = 0x000076e4c8332ba8    rip = 0x000076e4e1431200
[task 2023-12-21T07:34:42.948Z] 07:34:42     INFO -      Found by: stack scanning
[task 2023-12-21T07:34:42.949Z] 07:34:42     INFO -  49  libart.so + 0x128d99
[task 2023-12-21T07:34:42.949Z] 07:34:42     INFO -       rsp = 0x000076e4c8332bc0    rip = 0x000076e4e1434d9a
[task 2023-12-21T07:34:42.949Z] 07:34:42     INFO -      Found by: stack scanning
[task 2023-12-21T07:34:42.949Z] 07:34:42     INFO -  50  base.odex + 0xa5323b
[task 2023-12-21T07:34:42.949Z] 07:34:42     INFO -       rsp = 0x000076e4c8332bd0    rip = 0x000076e4c8d8723c
[task 2023-12-21T07:34:42.949Z] 07:34:42     INFO -      Found by: stack scanning
<...>
[task 2023-12-21T07:34:42.954Z] 07:34:42     INFO -  80  libart.so + 0x383cf5
[task 2023-12-21T07:34:42.954Z] 07:34:42     INFO -       rsp = 0x000076e4c83331c0    rip = 0x000076e4e168fcf6
[task 2023-12-21T07:34:42.954Z] 07:34:42     INFO -      Found by: stack scanning
[task 2023-12-21T07:34:42.954Z] 07:34:42     INFO -  81  libart.so + 0x5022be
[task 2023-12-21T07:34:42.954Z] 07:34:42     INFO -       rsp = 0x000076e4c8333220    rip = 0x000076e4e180e2bf
[task 2023-12-21T07:34:42.954Z] 07:34:42     INFO -      Found by: stack scanning
[task 2023-12-21T07:34:42.954Z] 07:34:42     INFO -  82  base.odex + 0xc123b6
[task 2023-12-21T07:34:42.954Z] 07:34:42     INFO -       rsp = 0x000076e4c8333260    rip = 0x000076e4c8f463b7
[task 2023-12-21T07:34:42.954Z] 07:34:42     INFO -      Found by: stack scanning
[task 2023-12-21T07:34:42.954Z] 07:34:42     INFO -  83  libart.so + 0x4d76e9
[task 2023-12-21T07:34:42.954Z] 07:34:42     INFO -       rsp = 0x000076e4c8333270    rip = 0x000076e4e17e36ea
[task 2023-12-21T07:34:42.955Z] 07:34:42     INFO -      Found by: stack scanning
[task 2023-12-21T07:34:42.955Z] 07:34:42     INFO -  84  base.odex + 0xc123b6
[task 2023-12-21T07:34:42.955Z] 07:34:42     INFO -       rsp = 0x000076e4c8333298    rip = 0x000076e4c8f463b7
[task 2023-12-21T07:34:42.955Z] 07:34:42     INFO -      Found by: stack scanning
[task 2023-12-21T07:34:42.955Z] 07:34:42     INFO -  85  libart.so + 0x6345ec
[task 2023-12-21T07:34:42.955Z] 07:34:42     INFO -       rsp = 0x000076e4c83332c0    rip = 0x000076e4e19405ed
[task 2023-12-21T07:34:42.955Z] 07:34:42     INFO -      Found by: stack scanning
[task 2023-12-21T07:34:42.955Z] 07:34:42     INFO -  86  libc.so + 0x9e0f8
[task 2023-12-21T07:34:42.955Z] 07:34:42     INFO -       rsp = 0x000076e4c83332d0    rip = 0x000076e4e433e0f9
[task 2023-12-21T07:34:42.955Z] 07:34:42     INFO -      Found by: stack scanning
[task 2023-12-21T07:34:42.955Z] 07:34:42     INFO -  87  libart.so + 0x615d12
[task 2023-12-21T07:34:42.955Z] 07:34:42     INFO -       rsp = 0x000076e4c83332e0    rip = 0x000076e4e1921d13
[task 2023-12-21T07:34:42.955Z] 07:34:42     INFO -      Found by: stack scanning
[task 2023-12-21T07:34:42.955Z] 07:34:42     INFO -  88  libart.so + 0x6345ec
[task 2023-12-21T07:34:42.955Z] 07:34:42     INFO -       rsp = 0x000076e4c8333308    rip = 0x000076e4e19405ed
[task 2023-12-21T07:34:42.956Z] 07:34:42     INFO -      Found by: stack scanning
[task 2023-12-21T07:34:42.956Z] 07:34:42     INFO -  89  libart.so + 0x4f8eed
[task 2023-12-21T07:34:42.956Z] 07:34:42     INFO -       rsp = 0x000076e4c8333330    rip = 0x000076e4e1804eee
[task 2023-12-21T07:34:42.956Z] 07:34:42     INFO -      Found by: stack scanning
[task 2023-12-21T07:34:42.956Z] 07:34:42     INFO -  90  libc.so + 0x895ff
[task 2023-12-21T07:34:42.956Z] 07:34:42     INFO -       rsp = 0x000076e4c83333b0    rip = 0x000076e4e4329600
[task 2023-12-21T07:34:42.956Z] 07:34:42     INFO -      Found by: stack scanning
[task 2023-12-21T07:34:42.956Z] 07:34:42     INFO -  91  libart.so + 0x4f897f
[task 2023-12-21T07:34:42.956Z] 07:34:42     INFO -       rsp = 0x000076e4c83333d0    rip = 0x000076e4e1804980
[task 2023-12-21T07:34:42.956Z] 07:34:42     INFO -      Found by: stack scanning
[task 2023-12-21T07:34:42.956Z] 07:34:42     INFO -  92  libc.so + 0x89771
[task 2023-12-21T07:34:42.956Z] 07:34:42     INFO -       rsp = 0x000076e4c83333f0    rip = 0x000076e4e4329772
[task 2023-12-21T07:34:42.956Z] 07:34:42     INFO -      Found by: stack scanning
[task 2023-12-21T07:34:42.956Z] 07:34:42     INFO -  93  libart.so + 0x4f897f
[task 2023-12-21T07:34:42.956Z] 07:34:42     INFO -       rsp = 0x000076e4c8333428    rip = 0x000076e4e1804980
[task 2023-12-21T07:34:42.956Z] 07:34:42     INFO -      Found by: stack scanning
[task 2023-12-21T07:34:42.957Z] 07:34:42     INFO -  94  libc.so + 0x299eb
[task 2023-12-21T07:34:42.957Z] 07:34:42     INFO -       rsp = 0x000076e4c8333440    rip = 0x000076e4e42c99ec
[task 2023-12-21T07:34:42.957Z] 07:34:42     INFO -      Found by: stack scanning
[task 2023-12-21T07:34:42.957Z] 07:34:42     INFO -  95  libc.so + 0x896bf
[task 2023-12-21T07:34:42.957Z] 07:34:42     INFO -       rsp = 0x000076e4c8333448    rip = 0x000076e4e43296c0
[task 2023-12-21T07:34:42.957Z] 07:34:42     INFO -      Found by: stack scanning
[task 2023-12-21T07:34:42.957Z] 07:34:42     INFO -  96  libc.so + 0x1ca65
[task 2023-12-21T07:34:42.957Z] 07:34:42     INFO -       rsp = 0x000076e4c8333450    rip = 0x000076e4e42bca66
[task 2023-12-21T07:34:42.957Z] 07:34:42     INFO -      Found by: stack scanning
[task 2023-12-21T07:34:42.957Z] 07:34:42     INFO -  97  libart.so + 0x4f897f
[task 2023-12-21T07:34:42.957Z] 07:34:42     INFO -       rsp = 0x000076e4c83334b8    rip = 0x000076e4e1804980
[task 2023-12-21T07:34:42.957Z] 07:34:42     INFO -      Found by: stack scanning
[task 2023-12-21T07:34:42.957Z] 07:34:42     INFO -  Thread 0 st_runner:tab15
Whiteboard: [necko-monitor]
Severity: S4 → --
Component: DOM: Networking → JavaScript: GC
Priority: P5 → --

Looking briefly at the most recent android failures the following test case seems to show up frequently (among the low likelyhood of intermittent failures): dom/xhr/tests/test_xhr_progressevents.html

I do not know if there is any mean to have rr / pernosco support on android x86_64, but this might be one way to investigate.

Blocks: GC.stability
Severity: -- → S4
Priority: -- → P3

Copying crash signatures from duplicate bugs.

Crash Signature: [@ js::gc::GCRuntime::assertNoMarkingWork]

Setting security sensitive because this could result in use after free if we sweep something that should have been marked.

Group: javascript-core-security

I'll mark this high, then, though I'm not sure if it is actionable, so it may end up stalled.

There are two issues here. The first is that there unexpected marking work at
the start of sweeping after entering from the mark phase without yielding. We
previously called assertNoMarkingWork() after markUntilBudgetExhausted() in the
marking phase so something since then must have added it.

As far as I can tell this must be the conditional call to
collectNurseryFromMajorGC(), where a post barrier for a pointer cleared during
finalization (e.g. for Maps in mapObject::sweepAfterMinorGC) ends up marking
something. I'm not sure such barriers are necessary, but for now the safest
thing to do is to move this nursery collection to the start of the slice so
that it happens before we drain the mark stack.

The second issue is that we check the budget and conditionally yield if we
enter from the marking state. The comment above this code states that this is
not safe since we have not yet started sweeping a sweep group. This check was
added in bug 1865383 but was not the main part of the fix. I think we should
remove this.

I wasn't able to come up with a test case to reproduce this.

Assignee: nobody → jcoppeard
Status: NEW → ASSIGNED
Keywords: regression
Regressed by: 1681533, 1865383

Comment on attachment 9411563 [details]
Bug 1871303 - Ensure there is no more marking at the start of sweeping r?sfink

Security Approval Request

  • How easily could an exploit be constructed based on the patch?: Very difficult.
  • Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?: No
  • Which branches (beta, release, and/or ESR) are affected by this flaw, and do the release status flags reflect this affected/unaffected state correctly?: All (back to FF86)
  • If not all supported branches, which bug introduced the flaw?: 1681533, 1865383
  • Do you have backports for the affected branches?: No
  • If not, how different, hard to create, and risky will they be?: They should be trivial.
  • How likely is this patch to cause regressions; how much testing does it need?: This is a fairly simple patch that removes a possible yield point from GC and moves nursery collection earlier in the process. It's unlikely to cause regressions.
  • Is the patch ready to land after security approval is given?: Yes
  • Is Android affected?: Yes
Attachment #9411563 - Flags: sec-approval?

Comment on attachment 9411563 [details]
Bug 1871303 - Ensure there is no more marking at the start of sweeping r?sfink

sec-approval+ = dveditz

Attachment #9411563 - Flags: sec-approval? → sec-approval+
Pushed by jcoppeard@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/417d42aa08ef Ensure there is no more marking at the start of sweeping r=sfink
Group: javascript-core-security → core-security-release
Status: ASSIGNED → RESOLVED
Closed: 1 year ago
Resolution: --- → FIXED
Target Milestone: --- → 130 Branch

The patch landed in nightly and beta is affected.
:jonco, is this bug important enough to require an uplift?

  • If yes, please nominate the patch for beta approval.
  • If no, please set status-firefox129 to wontfix.

For more information, please visit BugBot documentation.

Flags: needinfo?(jcoppeard)

Comment on attachment 9411563 [details]
Bug 1871303 - Ensure there is no more marking at the start of sweeping r?sfink

Beta/Release Uplift Approval Request

  • User impact if declined: Possible crash / security vulnerability.
  • Is this code covered by automated tests?: Yes
  • Has the fix been verified in Nightly?: Yes
  • Needs manual test from QE?: No
  • If yes, steps to reproduce:
  • List of other uplifts needed: None
  • Risk to taking this patch: Low
  • Why is the change risky/not risky? (and alternatives if risky): This is a simple change that 1) removes a place we can yield in GC and 2) moves some GC work so it happens earlier.
    It's been on central for 4 days without incident.
  • String changes made/needed:
  • Is Android affected?: Yes
Flags: needinfo?(jcoppeard)
Attachment #9411563 - Flags: approval-mozilla-release?

Comment on attachment 9411563 [details]
Bug 1871303 - Ensure there is no more marking at the start of sweeping r?sfink

Beta/Release Uplift Approval Request

  • User impact if declined: Possible crash / security vulnerability.
  • Is this code covered by automated tests?: Yes
  • Has the fix been verified in Nightly?: Yes
  • Needs manual test from QE?: No
  • If yes, steps to reproduce:
  • List of other uplifts needed: None
  • Risk to taking this patch: Low
  • Why is the change risky/not risky? (and alternatives if risky): This is a simple change that 1) removes a place we can yield in GC and 2) moves some GC work so it happens earlier.
  • String changes made/needed:
  • Is Android affected?: Yes
Attachment #9411563 - Flags: approval-mozilla-release? → approval-mozilla-beta?

:jonco could you also add an esr115/esr128 uplift request?

Flags: needinfo?(jcoppeard)

Comment on attachment 9411563 [details]
Bug 1871303 - Ensure there is no more marking at the start of sweeping r?sfink

Approved for 129.0b6

Attachment #9411563 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
QA Whiteboard: [post-critsmash-triage]
Flags: qe-verify-

Comment on attachment 9411563 [details]
Bug 1871303 - Ensure there is no more marking at the start of sweeping r?sfink

ESR Uplift Approval Request

  • If this is not a sec:{high,crit} bug, please state case for ESR consideration: This is a sec high bug.
  • User impact if declined: Possible crash / security vulnerability.
  • Fix Landed on Version: 130
  • Risk to taking this patch: Low
  • Why is the change risky/not risky? (and alternatives if risky): This is a simple change that 1) removes a place we can yield in GC and 2) moves some GC work so it happens earlier.
Flags: needinfo?(jcoppeard)
Attachment #9411563 - Flags: approval-mozilla-esr128?
Attachment #9411563 - Flags: approval-mozilla-esr115?

:jonco this graft cleanly to esr128, but it will need a rebased patch for esr115

Flags: needinfo?(jcoppeard)

Comment on attachment 9411563 [details]
Bug 1871303 - Ensure there is no more marking at the start of sweeping r?sfink

Approved for 128.1esr.

Attachment #9411563 - Flags: approval-mozilla-esr128? → approval-mozilla-esr128+

There are two issues here. The first is that there unexpected marking work at
the start of sweeping after entering from the mark phase without yielding. We
previously called assertNoMarkingWork() after markUntilBudgetExhausted() in the
marking phase so something since then must have added it.

As far as I can tell this must be the conditional call to
collectNurseryFromMajorGC(), where a post barrier for a pointer cleared during
finalization (e.g. for Maps in mapObject::sweepAfterMinorGC) ends up marking
something. I'm not sure such barriers are necessary, but for now the safest
thing to do is to move this nursery collection to the start of the slice so
that it happens before we drain the mark stack.

The second issue is that we check the budget and conditionally yield if we
enter from the marking state. The comment above this code states that this is
not safe since we have not yet started sweeping a sweep group. This check was
added in bug 1865383 but was not the main part of the fix. I think we should
remove this.

I wasn't able to come up with a test case to reproduce this.

(In reply to Donal Meehan [:dmeehan] from comment #46)
I've uploaded a patch for ESR115.

Flags: needinfo?(jcoppeard)

A patch has been attached on this bug, which was already closed. Filing a separate bug will ensure better tracking. If this was not by mistake and further action is needed, please alert the appropriate party. (Or: if the patch doesn't change behavior -- e.g. landing a test case, or fixing a typo -- then feel free to disregard this message)

Comment on attachment 9411563 [details]
Bug 1871303 - Ensure there is no more marking at the start of sweeping r?sfink

Approved for 115.14esr

Attachment #9411563 - Flags: approval-mozilla-esr115? → approval-mozilla-esr115+
Whiteboard: [necko-monitor] → [necko-monitor][adv-main129+r]
Whiteboard: [necko-monitor][adv-main129+r] → [necko-monitor][adv-main129+r][adv-ESR115.14+r]
Whiteboard: [necko-monitor][adv-main129+r][adv-ESR115.14+r] → [necko-monitor][adv-main129+r][adv-ESR115.14+r][adv-ESR128.1+r]
Attached file advisory.txt (obsolete) —
Attached file advisory.txt (obsolete) —
Attachment #9417383 - Attachment is obsolete: true
Attached file advisory.txt
Attachment #9417384 - Attachment is obsolete: true
Alias: CVE-2024-7527
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: