Closed Bug 1918224 Opened 1 year ago Closed 1 year ago

ThreadSanitizer: data race [@ Test] vs. [@ operator=]

Categories

(Core :: JavaScript: GC, defect, P1)

Product:
Core
Component:
JavaScript: GC
Type:
defect

Tracking

()

Status:
VERIFIED FIXED
Milestone:
132 Branch
Tracking Flags:
Tracking Status
firefox-esr115 --- unaffected
firefox-esr128 --- unaffected
firefox130 --- unaffected
firefox131 --- unaffected
firefox132 --- verified

People

(Reporter: tsmith, Assigned: jonco)

References

(Blocks 1 open bug, Regression)

Details

(Keywords: csectype-race, regression, Whiteboard: [bugmon:bisected,confirmed])

Attachments

(2 files)

testcase.zip
4.14 KB, application/x-zip-compressed
Details
Bug 1918224 - Don't run verifier heap check while background decommit is running r?sfink
48 bytes, text/x-phabricator-request
Details | Review
Attached file testcase.zip —

Found while fuzzing m-c 20240909-50016ed27344 (--enable-thread-sanitizer --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -t --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

The attached test case is not actually a test case but will trigger the issue when run with Grizzly.

This issue is likely triggered by a combination of the prefs:

  • javascript.options.baselinejit.threshold = 1
  • javascript.options.ion.threshold = 10
  • javascript.options.mem.gc_zeal.mode = 15
WARNING: ThreadSanitizer: data race (pid=5201)
  Write of size 4 at 0x7fff5b703f4c by thread T14 (mutexes: write M0):
    #0 operator= /builds/worker/workspace/obj-build/dist/include/mozilla/BitSet.h:54:12 (libxul.so+0x9da3178) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #1 js::gc::ArenaChunk::decommitOneFreePage(js::gc::GCRuntime*, unsigned long, js::AutoLockGC&) /builds/worker/checkouts/gecko/js/src/gc/Heap.cpp:379:37 (libxul.so+0x9da3178)
    #2 js::gc::ArenaChunk::decommitFreeArenas(js::gc::GCRuntime*, bool const&, js::AutoLockGC&) /builds/worker/checkouts/gecko/js/src/gc/Heap.cpp:343:32 (libxul.so+0x9da30ec) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #3 js::gc::GCRuntime::decommitFreeArenas(bool const&, js::AutoLockGC&) /builds/worker/checkouts/gecko/js/src/gc/GC.cpp:2187:12 (libxul.so+0x9d84259) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #4 js::gc::BackgroundDecommitTask::run(js::AutoLockHelperThreadState&) /builds/worker/checkouts/gecko/js/src/gc/GC.cpp:2120:13 (libxul.so+0x9d83c6f) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #5 js::GCParallelTask::runTask(JS::GCContext*, js::AutoLockHelperThreadState&) /builds/worker/checkouts/gecko/js/src/gc/GCParallelTask.cpp:218:3 (libxul.so+0x9da0dc7) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #6 js::GCParallelTask::runHelperThreadTask(js::AutoLockHelperThreadState&) /builds/worker/checkouts/gecko/js/src/gc/GCParallelTask.cpp:200:3 (libxul.so+0x9da1081) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #7 runTaskLocked /builds/worker/checkouts/gecko/js/src/vm/HelperThreads.cpp:650:11 (libxul.so+0x9830f85) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #8 runOneTask /builds/worker/checkouts/gecko/js/src/vm/HelperThreads.cpp:606:3 (libxul.so+0x9830f85)
    #9 JS::RunHelperThreadTask(JS::HelperThreadTask*) /builds/worker/checkouts/gecko/js/src/vm/HelperThreads.cpp:595:23 (libxul.so+0x9830f85)
    #10 HelperThreadTaskHandler::Run() /builds/worker/checkouts/gecko/js/xpconnect/src/XPCJSContext.cpp:1135:5 (libxul.so+0x419d67f) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #11 mozilla::TaskController::RunPoolThread(mozilla::PoolThread*) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:350:29 (libxul.so+0x3573945) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #12 mozilla::ThreadFuncPoolThread(void*) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:257:26 (libxul.so+0x3573408) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #13 _pt_root /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:201:5 (libnspr4.so+0x4aef8) (BuildId: 4d19424047847c24517bd43b12f47ea44bdff1dc)

  Previous read of size 4 at 0x7fff5b703f4c by main thread:
    #0 Test /builds/worker/workspace/obj-build/dist/include/mozilla/BitSet.h:82:12 (libxul.so+0x9da124b) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #1 operator bool /builds/worker/workspace/obj-build/dist/include/mozilla/BitSet.h:58:57 (libxul.so+0x9da124b)
    #2 js::gc::Arena::allocated() const /builds/worker/checkouts/gecko/js/src/gc/Heap.cpp:99:18 (libxul.so+0x9da124b)
    #3 IsGCThingValidAfterMovingGC<js::gc::Cell> /builds/worker/checkouts/gecko/js/src/gc/Marking-inl.h:225:25 (libxul.so+0x9dff487) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #4 CheckHeapTracer::checkCell(js::gc::Cell*, char const*) /builds/worker/checkouts/gecko/js/src/gc/Verifier.cpp:941:39 (libxul.so+0x9dff487)
    #5 HeapCheckTracerBase::onChild(JS::GCCellPtr, char const*) /builds/worker/checkouts/gecko/js/src/gc/Verifier.cpp:846:3 (libxul.so+0x9dfedd7) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #6 onEdge<JSString> /builds/worker/workspace/obj-build/dist/include/js/TracingAPI.h:245:5 (libxul.so+0x348dcfd) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #7 js::GenericTracerImpl<JS::CallbackTracer>::onStringEdge(JSString**, char const*) /builds/worker/workspace/obj-build/dist/include/js/TracingAPI.h:219:3 (libxul.so+0x348dcfd)
    #8 TraceEdgeInternal /builds/worker/checkouts/gecko/js/src/gc/Tracer.h:109:1 (libxul.so+0x985022e) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #9 TraceRoot<JSAtom *> /builds/worker/checkouts/gecko/js/src/gc/Tracer.h:221:3 (libxul.so+0x985022e)
    #10 tracePinnedAtoms /builds/worker/checkouts/gecko/js/src/vm/JSAtomUtils.cpp:288:5 (libxul.so+0x985022e)
    #11 js::TraceAtoms(JSTracer*) /builds/worker/checkouts/gecko/js/src/vm/JSAtomUtils.cpp:295:17 (libxul.so+0x985022e)
    #12 traceRuntimeAtoms /builds/worker/checkouts/gecko/js/src/gc/RootMarking.cpp:291:3 (libxul.so+0x9dd14dd) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #13 js::gc::GCRuntime::traceRuntime(JSTracer*, js::gc::AutoTraceSession&) /builds/worker/checkouts/gecko/js/src/gc/RootMarking.cpp:285:3 (libxul.so+0x9dd14dd)
    #14 traceHeap /builds/worker/checkouts/gecko/js/src/gc/Verifier.cpp:872:12 (libxul.so+0x9dff575) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #15 CheckHeapTracer::check(js::gc::AutoTraceSession&) /builds/worker/checkouts/gecko/js/src/gc/Verifier.cpp:950:8 (libxul.so+0x9dff575)
    #16 js::gc::CheckHeapAfterGC(JSRuntime*) /builds/worker/checkouts/gecko/js/src/gc/Verifier.cpp:971:10 (libxul.so+0x9dff824) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #17 js::gc::GCRuntime::collect(bool, JS::SliceBudget const&, JS::GCReason) /builds/worker/checkouts/gecko/js/src/gc/GC.cpp:4648:5 (libxul.so+0x9d8ff6a) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #18 js::gc::GCRuntime::gcSlice(JS::GCReason, JS::SliceBudget const&) /builds/worker/checkouts/gecko/js/src/gc/GC.cpp:4709:3 (libxul.so+0x9d90504) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #19 JS::IncrementalGCSlice(JSContext*, JS::GCReason, JS::SliceBudget const&) /builds/worker/checkouts/gecko/js/src/gc/GCAPI.cpp:318:21 (libxul.so+0x9d9da8c) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #20 GarbageCollectImpl(JS::GCReason, nsJSContext::IsShrinking, JS::SliceBudget const&) /builds/worker/checkouts/gecko/dom/base/nsJSEnvironment.cpp:993:5 (libxul.so+0x552cba6) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #21 nsJSContext::RunIncrementalGCSlice(JS::GCReason, nsJSContext::IsShrinking, JS::SliceBudget&) /builds/worker/checkouts/gecko/dom/base/nsJSEnvironment.cpp:1030:3 (libxul.so+0x552cdd3) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #22 mozilla::CCGCScheduler::GCRunnerFiredDoGC(mozilla::TimeStamp, mozilla::GCRunnerStep const&) /builds/worker/checkouts/gecko/dom/base/CCGCScheduler.cpp:353:3 (libxul.so+0x52ad88d) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #23 mozilla::CCGCScheduler::GCRunnerFired(mozilla::TimeStamp) /builds/worker/checkouts/gecko/dom/base/CCGCScheduler.cpp:312:10 (libxul.so+0x52ad05e) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #24 operator() /builds/worker/checkouts/gecko/dom/base/CCGCScheduler.cpp:554:44 (libxul.so+0x52b8f21) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #25 std::_Function_handler<bool (mozilla::TimeStamp), mozilla::CCGCScheduler::EnsureGCRunner(mozilla::BaseTimeDuration<mozilla::TimeDurationValueCalculator>)::$_0>::_M_invoke(std::_Any_data const&, mozilla::TimeStamp&&) /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/std_function.h:282:9 (libxul.so+0x52b8f21)
    #26 operator() /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/std_function.h:687:14 (libxul.so+0x356c3a3) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #27 mozilla::IdleTaskRunner::Run() /builds/worker/checkouts/gecko/xpcom/threads/IdleTaskRunner.cpp:124:14 (libxul.so+0x356c3a3)
    #28 mozilla::IdleTaskRunnerTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/IdleTaskRunner.cpp:45:15 (libxul.so+0x356ce96) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #29 mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:945:26 (libxul.so+0x35770b3) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #30 mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:810:15 (libxul.so+0x3575ab6) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #31 mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:554:36 (libxul.so+0x3575c2f) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #32 operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:268:37 (libxul.so+0x3585424) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #33 mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548:5 (libxul.so+0x3585424)
    #34 nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1155:16 (libxul.so+0x35988bd) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #35 NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10 (libxul.so+0x359ede4) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #36 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21 (libxul.so+0x406ce3e) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #37 mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:267:30 (libxul.so+0x406d65b) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #38 RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:370:10 (libxul.so+0x3febc48) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #39 RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3 (libxul.so+0x3febc48)
    #40 MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3 (libxul.so+0x3febc48)
    #41 nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:148:27 (libxul.so+0x85c4e33) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #42 nsAppShell::Run() /builds/worker/checkouts/gecko/widget/gtk/nsAppShell.cpp:469:33 (libxul.so+0x86acc9c) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #43 XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:710:20 (libxul.so+0x95781df) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #44 mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:235:9 (libxul.so+0x406d60a) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #45 RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:370:10 (libxul.so+0x3febc48) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #46 RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3 (libxul.so+0x3febc48)
    #47 MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3 (libxul.so+0x3febc48)
    #48 XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:645:34 (libxul.so+0x9577e36) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #49 mozilla::BootstrapImpl::XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/Bootstrap.cpp:63:12 (libxul.so+0x9583b72) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #50 main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:403:22 (firefox-bin+0x151f9d) (BuildId: 8591814bf6e59a85f61eb92e30e811bd8320e309)

  Location is global '??' at 0x7fff5b700000 ([anon:js-gc-heap]+0x3f4c)

  Mutex M0 (0x72b400001ab0) created at:
    #0 pthread_mutex_init /builds/worker/fetches/llvm-project/compiler-rt/lib/tsan/rtl/tsan_interceptors_posix.cpp:1316:3 (firefox-bin+0xd525f) (BuildId: 8591814bf6e59a85f61eb92e30e811bd8320e309)
    #1 mozilla::detail::MutexImpl::MutexImpl() /builds/worker/checkouts/gecko/mozglue/misc/Mutex_posix.cpp:76:3 (firefox-bin+0x1beca2) (BuildId: 8591814bf6e59a85f61eb92e30e811bd8320e309)
    #2 MutexImpl /builds/worker/checkouts/gecko/js/src/threading/Mutex.h:39:3 (libxul.so+0x9d7c8e3) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #3 Mutex /builds/worker/checkouts/gecko/js/src/threading/Mutex.h:75:12 (libxul.so+0x9d7c8e3)
    #4 js::gc::GCRuntime::GCRuntime(JSRuntime*) /builds/worker/checkouts/gecko/js/src/gc/GC.cpp:488:7 (libxul.so+0x9d7c8e3)
    #5 JSRuntime::JSRuntime(JSRuntime*) /builds/worker/checkouts/gecko/js/src/vm/Runtime.cpp:124:7 (libxul.so+0x995ecc9) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #6 js_new<JSRuntime, JSRuntime *&> /builds/worker/workspace/obj-build/dist/include/js/Utility.h:545:1 (libxul.so+0x98674b3) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #7 js::NewContext(unsigned int, JSRuntime*) /builds/worker/checkouts/gecko/js/src/vm/JSContext.cpp:169:24 (libxul.so+0x98674b3)
    #8 JS_NewContext(unsigned int, JSRuntime*) /builds/worker/checkouts/gecko/js/src/jsapi.cpp:407:10 (libxul.so+0x9afaa63) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #9 mozilla::CycleCollectedJSContext::Initialize(JSRuntime*, unsigned int) /builds/worker/checkouts/gecko/xpcom/base/CycleCollectedJSContext.cpp:125:16 (libxul.so+0x347c1eb) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #10 XPCJSContext::Initialize() /builds/worker/checkouts/gecko/js/xpconnect/src/XPCJSContext.cpp:1198:32 (libxul.so+0x4184a2c) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #11 XPCJSContext::NewXPCJSContext() /builds/worker/checkouts/gecko/js/xpconnect/src/XPCJSContext.cpp:1411:23 (libxul.so+0x4185c47) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #12 nsXPConnect::InitJSContext() /builds/worker/checkouts/gecko/js/xpconnect/src/nsXPConnect.cpp:93:25 (libxul.so+0x41c9b13) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #13 xpc::InitializeJSContext() /builds/worker/checkouts/gecko/js/xpconnect/src/nsXPConnect.cpp:108:35 (libxul.so+0x41c9bdf) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #14 NS_InitXPCOM /builds/worker/checkouts/gecko/xpcom/build/XPCOMInit.cpp:519:5 (libxul.so+0x35d14e7) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #15 mozilla::dom::ContentProcess::InfallibleInit(int, char**) /builds/worker/checkouts/gecko/dom/ipc/ContentProcess.cpp:166:8 (libxul.so+0x7ed6a98) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #16 mozilla::dom::ContentProcess::Init(int, char**) /builds/worker/checkouts/gecko/dom/ipc/ContentProcess.cpp:70:3 (libxul.so+0x7ed5ea2) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #17 XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:612:21 (libxul.so+0x9577e11) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #18 mozilla::BootstrapImpl::XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/Bootstrap.cpp:63:12 (libxul.so+0x9583b72) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #19 main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:403:22 (firefox-bin+0x151f9d) (BuildId: 8591814bf6e59a85f61eb92e30e811bd8320e309)

  Thread T14 'TaskCon~ller #0' (tid=5224, running) created by main thread at:
    #0 pthread_create /builds/worker/fetches/llvm-project/compiler-rt/lib/tsan/rtl/tsan_interceptors_posix.cpp:1023:3 (firefox-bin+0xd3a6b) (BuildId: 8591814bf6e59a85f61eb92e30e811bd8320e309)
    #1 _PR_CreateThread /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:458:14 (libnspr4.so+0x4219e) (BuildId: 4d19424047847c24517bd43b12f47ea44bdff1dc)
    #2 PR_CreateThread /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:533:12 (libnspr4.so+0x374a4) (BuildId: 4d19424047847c24517bd43b12f47ea44bdff1dc)
    #3 mozilla::TaskController::InitializeThreadPool() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:282:23 (libxul.so+0x3574517) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #4 mozilla::TaskController::AddTask(already_AddRefed<mozilla::Task>&&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:406:7 (libxul.so+0x3575055) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #5 DispatchOffThreadTask(JS::HelperThreadTask*) /builds/worker/checkouts/gecko/js/xpconnect/src/XPCJSContext.cpp:1152:26 (libxul.so+0x41857fc) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #6 js::AutoHelperTaskQueue::dispatchQueuedTasks() /builds/worker/checkouts/gecko/js/src/vm/HelperThreads.cpp:677:5 (libxul.so+0x983125f) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #7 ~AutoHelperTaskQueue /builds/worker/checkouts/gecko/js/src/vm/HelperThreads.h:77:28 (libxul.so+0xa352417) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #8 js::AutoLockHelperThreadState::~AutoLockHelperThreadState() /builds/worker/checkouts/gecko/js/src/vm/HelperThreads.h:91:16 (libxul.so+0xa352417)
    #9 IonCompile /builds/worker/checkouts/gecko/js/src/jit/Ion.cpp:1761:3 (libxul.so+0xa339e91) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #10 js::jit::Compile(JSContext*, JS::Handle<JSScript*>, js::jit::BaselineFrame*, unsigned char*) /builds/worker/checkouts/gecko/js/src/jit/Ion.cpp:1921:24 (libxul.so+0xa339e91)
    #11 BaselineCanEnterAtEntry /builds/worker/checkouts/gecko/js/src/jit/Ion.cpp:2053:25 (libxul.so+0xa33a6bd) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #12 IonCompileScriptForBaseline(JSContext*, js::jit::BaselineFrame*, unsigned char*) /builds/worker/checkouts/gecko/js/src/jit/Ion.cpp:2178:12 (libxul.so+0xa33a6bd)
    #13 js::jit::IonCompileScriptForBaselineAtEntry(JSContext*, js::jit::BaselineFrame*) /builds/worker/checkouts/gecko/js/src/jit/Ion.cpp:2205:10 (libxul.so+0xa33a37b) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #14 <null> <null> ([anon:js-executable-memory]+0x40aa)
    #15 js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:449:32 (libxul.so+0x96ff198) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #16 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:613:13 (libxul.so+0x96fff80) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #17 InternalCall /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:648:10 (libxul.so+0x97009f5) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #18 js::CallFromStack(JSContext*, JS::CallArgs const&, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:653:10 (libxul.so+0x97009f5)
    #19 js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICFallbackStub*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/jit/BaselineIC.cpp:1670:10 (libxul.so+0x9ef6067) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #20 <null> <null> ([anon:js-executable-memory]+0x2973)
    #21 js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:449:32 (libxul.so+0x96ff198) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #22 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:613:13 (libxul.so+0x96fff80) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #23 InternalCall /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:648:10 (libxul.so+0x97009f5) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #24 js::CallFromStack(JSContext*, JS::CallArgs const&, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:653:10 (libxul.so+0x97009f5)
    #25 js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICFallbackStub*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/jit/BaselineIC.cpp:1670:10 (libxul.so+0x9ef6067) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #26 <null> <null> ([anon:js-executable-memory]+0x2973)
    #27 js::Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3500:40 (libxul.so+0x9711402) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #28 MaybeEnterInterpreterTrampoline /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:401:10 (libxul.so+0x96ff437) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #29 js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:459:13 (libxul.so+0x96ff437)
    #30 js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JS::Handle<JSObject*>, js::AbstractFramePtr, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:846:13 (libxul.so+0x9701c4e) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #31 js::Execute(JSContext*, JS::Handle<JSScript*>, JS::Handle<JSObject*>, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:878:10 (libxul.so+0x9701df1) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #32 js::ModuleObject::execute(JSContext*, JS::Handle<js::ModuleObject*>) /builds/worker/checkouts/gecko/js/src/builtin/ModuleObject.cpp:1439:10 (libxul.so+0x974e545) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #33 InnerModuleEvaluation(JSContext*, JS::Handle<js::ModuleObject*>, JS::MutableHandle<JS::GCVector<js::ModuleObject*, 0ul, js::SystemAllocPolicy>>, unsigned long, unsigned long*) /builds/worker/checkouts/gecko/js/src/vm/Modules.cpp:1783:10 (libxul.so+0x98e7960) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #34 ModuleEvaluate /builds/worker/checkouts/gecko/js/src/vm/Modules.cpp:1554:13 (libxul.so+0x98d6720) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #35 JS::ModuleEvaluate(JSContext*, JS::Handle<JSObject*>, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/Modules.cpp:246:10 (libxul.so+0x98d6720)
    #36 JS::loader::ModuleLoaderBase::EvaluateModuleInContext(JSContext*, JS::loader::ModuleLoadRequest*, JS::ModuleErrorBehaviour) /builds/worker/checkouts/gecko/js/loader/ModuleLoaderBase.cpp:1351:13 (libxul.so+0x411c95a) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #37 mozJSModuleLoader::ImportESModule(JSContext*, nsTSubstring<char> const&, JS::MutableHandle<JSObject*>, mozilla::loader::SkipCheckForBrokenURLOrZeroSized) /builds/worker/checkouts/gecko/js/xpconnect/loader/mozJSModuleLoader.cpp:2135:23 (libxul.so+0x413e747) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #38 mozilla::dom::ChromeUtils::ImportESModule(mozilla::dom::GlobalObject const&, nsTSubstring<char16_t> const&, mozilla::dom::ImportESModuleOptionsDictionary const&, JS::MutableHandle<JSObject*>, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/ChromeUtils.cpp:756:21 (libxul.so+0x52bc5d9) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #39 mozilla::dom::ChromeUtils_Binding::importESModule(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/obj-build/dom/bindings/./ChromeUtilsBinding.cpp:4673:3 (libxul.so+0x607b592) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #40 CallJSNative /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:487:13 (libxul.so+0x96ffe9b) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #41 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:581:12 (libxul.so+0x96ffe9b)
    #42 InternalCall /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:648:10 (libxul.so+0x97110fb) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #43 CallFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:653:10 (libxul.so+0x97110fb)
    #44 js::Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3461:16 (libxul.so+0x97110fb)
    #45 MaybeEnterInterpreterTrampoline /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:401:10 (libxul.so+0x96ff437) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #46 js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:459:13 (libxul.so+0x96ff437)
    #47 js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JS::Handle<JSObject*>, js::AbstractFramePtr, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:846:13 (libxul.so+0x9701c4e) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #48 ExecuteInExtensibleLexicalEnvironment(JSContext*, JS::Handle<JSScript*>, JS::Handle<js::ExtensibleLexicalEnvironmentObject*>) /builds/worker/checkouts/gecko/js/src/builtin/Eval.cpp:399:10 (libxul.so+0x96ddde5) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #49 js::ExecuteInFrameScriptEnvironment(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSScript*>, JS::MutableHandle<JSObject*>) /builds/worker/checkouts/gecko/js/src/builtin/Eval.cpp:434:8 (libxul.so+0x96ddb0d) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #50 nsMessageManagerScriptExecutor::LoadScriptInternal(JS::Handle<JSObject*>, nsTSubstring<char16_t> const&, bool) /builds/worker/checkouts/gecko/dom/base/nsFrameMessageManager.cpp:1207:19 (libxul.so+0x523257d) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #51 mozilla::dom::ContentProcessMessageManager::LoadScript(nsTSubstring<char16_t> const&) /builds/worker/checkouts/gecko/dom/base/ContentProcessMessageManager.cpp:120:5 (libxul.so+0x52c63f2) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #52 mozilla::dom::ContentChild::RecvLoadProcessScript(nsTString<char16_t> const&) /builds/worker/checkouts/gecko/dom/ipc/ContentChild.cpp:2357:25 (libxul.so+0x7e5d1d7) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #53 mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PContentChild.cpp:11834:80 (libxul.so+0x7fc9a82) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #54 mozilla::dom::ContentChild::OnMessageReceived(IPC::Message const&) /builds/worker/checkouts/gecko/dom/ipc/ContentChild.cpp:3663:25 (libxul.so+0x7e63310) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #55 mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1785:25 (libxul.so+0x406900f) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #56 mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message>>) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1712:9 (libxul.so+0x4067a18) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #57 mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1503:3 (libxul.so+0x406801e) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #58 mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1603:14 (libxul.so+0x40687c7) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #59 mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:618:16 (libxul.so+0x35825e2) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #60 mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:945:26 (libxul.so+0x35770b3) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #61 mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:768:15 (libxul.so+0x35758f6) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #62 mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:554:36 (libxul.so+0x3575c2f) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #63 operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:268:37 (libxul.so+0x3585424) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #64 mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548:5 (libxul.so+0x3585424)
    #65 nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1155:16 (libxul.so+0x35988bd) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #66 NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10 (libxul.so+0x359ede4) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #67 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21 (libxul.so+0x406ce3e) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #68 mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:267:30 (libxul.so+0x406d65b) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #69 RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:370:10 (libxul.so+0x3febc48) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #70 RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3 (libxul.so+0x3febc48)
    #71 MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3 (libxul.so+0x3febc48)
    #72 nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:148:27 (libxul.so+0x85c4e33) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #73 nsAppShell::Run() /builds/worker/checkouts/gecko/widget/gtk/nsAppShell.cpp:469:33 (libxul.so+0x86acc9c) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #74 XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:710:20 (libxul.so+0x95781df) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #75 mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:235:9 (libxul.so+0x406d60a) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #76 RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:370:10 (libxul.so+0x3febc48) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #77 RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3 (libxul.so+0x3febc48)
    #78 MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3 (libxul.so+0x3febc48)
    #79 XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:645:34 (libxul.so+0x9577e36) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #80 mozilla::BootstrapImpl::XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/Bootstrap.cpp:63:12 (libxul.so+0x9583b72) (BuildId: de18bb04f23cdbeeae5ef1d446c1753153afe1f7)
    #81 main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:403:22 (firefox-bin+0x151f9d) (BuildId: 8591814bf6e59a85f61eb92e30e811bd8320e309)

Tyson says this seems recent, but we don't have a range yet. Fails between the initial blank page and the redirect to the testcase.

Seen 164 times since the 9th, and not earlier.

Jonco: you recently touched decommitOneFreePage. maybe related? https://bugzilla.mozilla.org/show_bug.cgi?id=1916758

Flags: needinfo?(jcoppeard)
Keywords: regression

The prefs seem pretty aggressive so maybe a sec-moderate race, but it might come up in real life, too. Too early to see if it's maybe a sec-high signature that would show up in the wild

Verified bug as reproducible on mozilla-central 20240911214006-606085de1f6c.
The bug appears to have been introduced in the following build range:

Start: 6c3e656ff5d22f4a34e2662c8174ac8b70955f8b (20240827181008)
End: 6c3e656ff5d22f4a34e2662c8174ac8b70955f8b (20240827213859)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=6c3e656ff5d22f4a34e2662c8174ac8b70955f8b&tochange=6c3e656ff5d22f4a34e2662c8174ac8b70955f8b

Whiteboard: [bugmon:bisected,confirmed]

Regressed by bug 1850746 changeset a86443163ef8.

The testcase relies on GC zeal running heap check code that isn't present in release builds. It's possible there are other ways of triggering this race though.

Regressed by: 1850746
Assignee: nobody → jcoppeard
Flags: needinfo?(jcoppeard)

The problem is that Arena::allocated() now makes use of the arena's decommit
state, which is affected by background decommit. This only really affects
the zeal option CheckHeapAfterGC which triggers a heap check after all GCs.
Currently it does this after every major GC slice, which I don't think was
intentional. Also it runs after minor GC.

The patch changes the heap check to only run after the end of GC for major GCs
(when decommit has finished) and makes it wait for any decommit to finish when
running after minor GC.

Arena::allocated is not called in release builds therefore this is not security sensitive.

Group: javascript-core-security
Pushed by jcoppeard@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/4bcb0c4195bd Don't run verifier heap check while background decommit is running r=sfink
Severity: -- → S3
Priority: -- → P1

https://hg.mozilla.org/mozilla-central/rev/4bcb0c4195bd

Status: NEW → RESOLVED
Closed: 1 year ago
status-firefox132: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → 132 Branch

Verified bug as fixed on rev mozilla-central 20240913162656-4e8c91ef58bf.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Status: RESOLVED → VERIFIED
status-firefox132: fixed → verified
Keywords: bugmon
See Also: → 1920123
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: