1882015 - Crash caused by a Raptor Lake CPU bug in [@ Expr::evaluateToString]

Status: NEW

(Core :: XSLT, defect)

Description

[Gabriele Svelto [:gsvelto]]

Crash report: https://crash-stats.mozilla.org/report/index/8d32221a-b0bf-47c4-b159-b12150240217

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0  xul.dll  Expr::evaluateToString  dom/xslt/xpath/txExpr.cpp:23
1  xul.dll  txCoreFunctionCall::evaluate  dom/xslt/xpath/txCoreFunctionCall.cpp:226
2  xul.dll  txPredicatedNodeTest::matches  dom/xslt/xpath/txPredicatedNodeTest.cpp:29
3  xul.dll  RefPtr<txNodeSet>::operator txNodeSet* const  dom/xslt/xpath/txLocationStep.cpp:197
3  xul.dll  LocationStep::evaluate  dom/xslt/xpath/txLocationStep.cpp
4  xul.dll  PathExpr::evaluate  dom/xslt/xpath/txPathExpr.cpp:84
5  xul.dll  mozilla::dom::XPathExpression::EvaluateWithContext  dom/xslt/xpath/XPathExpression.cpp:134
6  xul.dll  mozilla::dom::XPathExpression::EvaluateWithContext  dom/xslt/xpath/XPathExpression.cpp:69
7  xul.dll  mozilla::dom::XPathExpression::Evaluate  dom/xslt/xpath/XPathExpression.h:44
7  xul.dll  mozilla::dom::XPathExpression_Binding::evaluate  dom/bindings/XPathExpressionBinding.cpp:86

I stumbled upon this crash signature this morning and further inspection revealed that this crash only happens on machines with this specific CPU: family 6 model 183 stepping 1. This is the first stepping of Intel Raptor Lake CPUs, so I'm chalking it up as a CPU bug and filing it only for tracking, there's nothing we can fix here.

Comment 1

[Gabriele Svelto [:gsvelto]]

We have no crashes on file with a microcode version higher than 0x011f, so it's possible that this has already been fixed by Intel in microcode 0x0120 and higher.

Comment 2

[Timothy Nikkel (:tnikkel)]

Another raptor cpu bug 1871892 has crashes on family 6 model 183 stepping 1 upto microcode 0x0123.