1917148 - Crash in [@ js::jit::JitFrameLayout::calleeToken]

Status: NEW

(Core :: JavaScript Engine: JIT, defect, P5)

Description

[BugBot [:suhaib / :marco]]

Crash report: https://crash-stats.mozilla.org/report/index/f09379e7-a452-48f5-92b7-cf6620240831

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0  xul.dll  js::jit::JitFrameLayout::calleeToken const  js/src/jit/JitFrames.h:252
0  xul.dll  js::jit::JSJitFrameIter::calleeToken const  js/src/jit/JSJitFrameIter.cpp:84
0  xul.dll  js::jit::JSJitFrameIter::script const  js/src/jit/JSJitFrameIter.cpp:120
0  xul.dll  js::JitFrameIter::isSelfHostedIgnoringInlining const  js/src/vm/FrameIter.cpp:117
0  xul.dll  JS::GetScriptedCallerActivationRealmFast  js/src/jsapi.cpp:4752
0  xul.dll  JS::GetScriptedCallerGlobal  js/src/jsapi.cpp:4783
0  xul.dll  mozilla::dom::GetIncumbentGlobal  dom/script/ScriptSettings.cpp:213
1  xul.dll  mozilla::dom::CallbackObject::FinishSlowJSInitIfMoreThanOneOwner  dom/bindings/CallbackObject.cpp:109
2  xul.dll  mozilla::dom::binding_detail::FastFunction::FinishSlowJSInitIfMoreThanOneOwner  dist/include/mozilla/dom/FunctionBinding.h:131
2  xul.dll  mozilla::dom::RootedCallback<mozilla::OwningNonNull<mozilla::dom::binding_detail::FastFunction> >::~RootedCallback  dom/bindings/CallbackObject.h:640

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2024-07-06
• Process type: Content
• Is startup crash: No
• Has user comments: No
• Is null crash: Yes - 2 out of 5 crashes happened on null or near null memory address

Comment 1

[Steven DeTar [:sdetar]]

Moving to core: JavaScript Engine: JIT to evaluate

Comment 2

[Nicolas B. Pierron [:nbp] {away}]

Looking at the crash addresses, these looks like values that would be expected on the stack, and thus suggest a bad stack walking offset.
These are likely to happen on off-by-(few bytes offsets).

Given the low volume, I am going to assume this might be some memory corruption, especially given one of the user comment reporting many tabs crashes. No URL to investigate yet.