1880737 - Crash in [@ snappy::DecompressBranchless<T>]

Status: RESOLVED WONTFIX

(Core :: Storage: IndexedDB, defect, P5)

Description

[BugBot [:suhaib / :marco/ :calixte]]

Crash report: https://crash-stats.mozilla.org/report/index/66c1b263-2cb9-445e-bcd5-8cd620240212

Reason: EXCEPTION_ACCESS_VIOLATION_EXEC

Top 10 frames of crashing thread:

0  xul.dll  snappy::DecompressBranchless<char*>  other-licenses/snappy/src/snappy.cc:1156
1  xul.dll  snappy::SnappyDecompressor::DecompressAllTags<snappy::SnappyArrayWriter>  other-licenses/snappy/src/snappy.cc:1260
2  xul.dll  snappy::InternalUncompressAllTags  other-licenses/snappy/src/snappy.cc:1456
2  xul.dll  snappy::InternalUncompress  other-licenses/snappy/src/snappy.cc:1443
2  xul.dll  snappy::RawUncompress  other-licenses/snappy/src/snappy.cc:1831
3  xul.dll  snappy::RawUncompress  other-licenses/snappy/src/snappy.cc:1826
3  xul.dll  mozilla::dom::indexedDB::  dom/indexedDB/ActorsParentCommon.cpp:368
4  xul.dll  mozilla::dom::indexedDB::  dom/indexedDB/ActorsParentCommon.cpp:496
4  xul.dll  mozilla::dom::indexedDB::GetStructuredCloneReadInfoFromStatement  dom/indexedDB/ActorsParentCommon.cpp:703
5  xul.dll  mozilla::dom::indexedDB::  dom/indexedDB/ActorsParent.cpp:19286

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2023-12-17
• Process type: Parent
• Is startup crash: No
• Has user comments: No
• Is null crash: No

Comment 1

[Kagami Rosylight [:saschanaz] (they/them)]

Snappy in IDB sounds like a Jan thing: https://searchfox.org/mozilla-central/rev/6bc0f370cc459bf79e1330ef74b21009a9848c91/dom/indexedDB/ActorsParentCommon.cpp#368-370

Line 1156 of snappy.cc is a while loop condition expression but it doesn't do any deference there 🤔

Comment 2

[Jan Varga [:janv]]

Well, without actual data causing this, I'm not sure what we can do here (other than filing a bug for Snappy).

Comment 3

[Andrew Sutherland [:asuth] (he/him)]

(In reply to Jan Varga [:janv] from comment #2)

Well, without actual data causing this, I'm not sure what we can do here (other than filing a bug for Snappy).

I don't think this is a snappy bug; looking at the recent reports with the bitflip column visible and sorting by install date it looks a lot like specific machines are experiencing hardware problems.

That said, we are on snappy 1.1.9 (bug 1743947 upgraded) and 1.1.10 was released in March of 2023; it wouldn't be unreasonable to update, but I don't think there's anything in there that would help if this is indeed hardware problems. (https://github.com/google/snappy/commit/7b82423c597bfed223dff27f880fe91e169375b4 did change the loop's access patterns a bit though, but that added a sign warning that the unreleased https://github.com/google/snappy/commit/27f34a580be4a3becf5f8c0cba13433f53c21337 fixes.)

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

This bug has the keyword crash, so its type should be defect.

Comment 5

[Jens Stutte [:jstutte]]

That said, we are on snappy 1.1.9 (bug 1743947 upgraded) and 1.1.10 was released in March of 2023; it wouldn't be unreasonable to update

Might deserve its own bug? The bot is not happy with a crash-bug being a task, so we might just want to say WONTFIX here?

Comment 6

[Andrew Sutherland [:asuth] (he/him)]

(In reply to Jens Stutte [:jstutte] from comment #5)

That said, we are on snappy 1.1.9 (bug 1743947 upgraded) and 1.1.10 was released in March of 2023; it wouldn't be unreasonable to update

Might deserve its own bug? The bot is not happy with a crash-bug being a task, so we might just want to say WONTFIX here?

Yes; thanks for filing bug 1883629, RyanVM.

I'll mark this WONTFIX because I don't know how to stop the bot otherwise.