1915302 - Crash in [@ js::frontend::ParserAtom::markUsedByStencil]

Status: NEW

(Core :: JavaScript Engine, defect, P5)

Description

[BugBot [:suhaib / :marco]]

Crash report: https://crash-stats.mozilla.org/report/index/5abd8fcb-8326-4151-afb1-a76360240811

Reason: SIGSEGV / SEGV_MAPERR

Top 10 frames of crashing thread:

0  libxul.so  js::frontend::ParserAtom::markUsedByStencil  js/src/frontend/ParserAtom.h:489
0  libxul.so  js::frontend::ParserAtomsTable::markUsedByStencil const  js/src/frontend/ParserAtom.cpp:663
0  libxul.so  js::frontend::GCThingList::append  js/src/frontend/BytecodeSection.h:55
0  libxul.so  js::frontend::BytecodeEmitter::makeAtomIndex  js/src/frontend/BytecodeEmitter.h:412
0  libxul.so  js::frontend::PropOpEmitter::prepareAtomIndex  js/src/frontend/PropOpEmitter.cpp:22
0  libxul.so  js::frontend::PropOpEmitter::emitGet  js/src/frontend/PropOpEmitter.cpp:37
0  libxul.so  js::frontend::BytecodeEmitter::emitTree  js/src/frontend/BytecodeEmitter.cpp:12688
1  libxul.so  js::frontend::BytecodeEmitter::emitConditionalExpression  js/src/frontend/BytecodeEmitter.cpp:9147
1  libxul.so  js::frontend::BytecodeEmitter::emitTree  js/src/frontend/BytecodeEmitter.cpp:12530
2  libxul.so  js::frontend::BytecodeEmitter::emitShortCircuit  js/src/frontend/BytecodeEmitter.cpp:9032

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2024-06-20
• Process type: Content
• Is startup crash: No
• Has user comments: No
• Is null crash: Yes - 1 out of 10 crashes happened on null or near null memory address
• Is use after free crash: Yes - 1 out of 10 crashes happened on or near an allocator poison value

Comment 1

[Andrew McCreight [:mccr8]]

In the last month, I only see 2 crashes on poison values, out of 113 crashes. On the other hand, I see about 50 of them that have >0 max bit flips confidence. 12 have a confidence of 92% which I think is way higher than I've ever seen. So, I think this is bad hardware.