Open Bug 1973625 Opened 3 days ago Updated 2 days ago

Intermittent application crashed [@ JS::Heap<JSObject*>::exposeToActiveJS] | single tracking bug

Categories

(Core :: DOM: Navigation, defect)

Product:
Core
Component:
DOM: Navigation
Type:
defect

Tracking

()

People

(Reporter: intermittent-bug-filer, Unassigned)

Details

(Keywords: crash, intermittent-failure, intermittent-testcase, Whiteboard: [confirmed_failure])

Crash Data

Filed by: smolnar [at] mozilla.com
Parsed log: https://treeherder.mozilla.org/logviewer?job_id=514435802&repo=autoland
Full log: https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/YTGGYqNARTCyZIwJO9-Wug/runs/0/artifacts/public/logs/live_backing.log

mozcrash Saved app info as /opt/worker/tasks/task_175072412838836/build/blobber_upload_dir/364DC149-FAD0-4816-8380-91AE01424C62.extra
[task 2025-06-24T01:06:57.851+00:00] 01:06:57     INFO - PROCESS-CRASH | application crashed [@ JS::Heap<JSObject*>::exposeToActiveJS] | /navigation-api/currententrychange-event/navigation-reload-intercept.html 
[task 2025-06-24T01:06:57.851+00:00] 01:06:57     INFO - Process type: content
[task 2025-06-24T01:06:57.851+00:00] 01:06:57     INFO - Process pid: 8273
[task 2025-06-24T01:06:57.851+00:00] 01:06:57     INFO - Crash dump filename: /var/folders/nt/c7qtkzrx14b8v5gf81qqzsr00000jb/T/tmp_vi2rsf_/minidumps/364DC149-FAD0-4816-8380-91AE01424C62.dmp
[task 2025-06-24T01:06:57.851+00:00] 01:06:57     INFO - Operating system: Mac OS X
[task 2025-06-24T01:06:57.851+00:00] 01:06:57     INFO -                   14.7.5 23H527
[task 2025-06-24T01:06:57.851+00:00] 01:06:57     INFO - CPU: amd64
[task 2025-06-24T01:06:57.851+00:00] 01:06:57     INFO -      family 6 model 158 stepping 10
[task 2025-06-24T01:06:57.852+00:00] 01:06:57     INFO -      12 CPUs
[task 2025-06-24T01:06:57.852+00:00] 01:06:57     INFO - 
[task 2025-06-24T01:06:57.852+00:00] 01:06:57     INFO - Crash reason:  EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
[task 2025-06-24T01:06:57.852+00:00] 01:06:57     INFO - Crash address: 0x0000000000000028 **
[task 2025-06-24T01:06:57.852+00:00] 01:06:57     INFO -     ** Null pointer detected with offset: 0x0000000000000028
[task 2025-06-24T01:06:57.852+00:00] 01:06:57     INFO - Crashing instruction: `mov rdi, qword [rdi + 0x28]`
[task 2025-06-24T01:06:57.852+00:00] 01:06:57     INFO - Memory accessed by instruction:
[task 2025-06-24T01:06:57.852+00:00] 01:06:57     INFO -   0. Address: 0x0000000000000028
[task 2025-06-24T01:06:57.852+00:00] 01:06:57     INFO -      Size: 8
[task 2025-06-24T01:06:57.852+00:00] 01:06:57     INFO -      Access type: Read
[task 2025-06-24T01:06:57.852+00:00] 01:06:57     INFO - No instruction pointer update by instruction
[task 2025-06-24T01:06:57.852+00:00] 01:06:57     INFO - Mac Crash Info:
[task 2025-06-24T01:06:57.852+00:00] 01:06:57     INFO -   Record 0
[task 2025-06-24T01:06:57.852+00:00] 01:06:57     INFO -     module: /usr/lib/dyld
[task 2025-06-24T01:06:57.852+00:00] 01:06:57     INFO -     message2: dyld config: DYLD_LIBRARY_PATH=/opt/worker/tasks/task_175072412838836/build/application/Firefox Nightly.app/Contents/MacOS 
[task 2025-06-24T01:06:57.852+00:00] 01:06:57     INFO - 
[task 2025-06-24T01:06:57.852+00:00] 01:06:57     INFO - Mac Boot Args: 
[task 2025-06-24T01:06:57.852+00:00] 01:06:57     INFO - 
[task 2025-06-24T01:06:57.852+00:00] 01:06:57     INFO - Process uptime: 48 seconds
[task 2025-06-24T01:06:57.852+00:00] 01:06:57     INFO - 
[task 2025-06-24T01:06:57.852+00:00] 01:06:57     INFO - Thread 0 MainThread (crashed) - tid: 3587
[task 2025-06-24T01:06:57.852+00:00] 01:06:57     INFO -  0  XUL!JS::Heap<JSObject*>::exposeToActiveJS() const [RootingAPI.h:a548a42c9818b33ab6e4df2879ac165f470934dc : 337]
[task 2025-06-24T01:06:57.852+00:00] 01:06:57     INFO -     Found by: inlining
[task 2025-06-24T01:06:57.852+00:00] 01:06:57     INFO -  1  XUL!JS::Heap<JSObject*>::get() const [RootingAPI.h:a548a42c9818b33ab6e4df2879ac165f470934dc : 340]
[task 2025-06-24T01:06:57.852+00:00] 01:06:57     INFO -     Found by: inlining
[task 2025-06-24T01:06:57.852+00:00] 01:06:57     INFO -  2  XUL!JS::Heap<JSObject*>::operator JSObject* const&() const [RootingAPI.h:a548a42c9818b33ab6e4df2879ac165f470934dc : 334]
[task 2025-06-24T01:06:57.852+00:00] 01:06:57     INFO -     Found by: inlining
[task 2025-06-24T01:06:57.852+00:00] 01:06:57     INFO -  3  XUL!mozilla::dom::Promise::PromiseObj() const [Promise.h:a548a42c9818b33ab6e4df2879ac165f470934dc : 347]
[task 2025-06-24T01:06:57.852+00:00] 01:06:57     INFO -     Found by: inlining
[task 2025-06-24T01:06:57.852+00:00] 01:06:57     INFO -  4  XUL!mozilla::dom::Promise::MaybeSomething<RefPtr<mozilla::dom::NavigationHistoryEntry>&>(RefPtr<mozilla::dom::NavigationHistoryEntry>&, void (mozilla::dom::Promise::*)(JSContext*, JS::Handle<JS::Value>)) [Promise.h:a548a42c9818b33ab6e4df2879ac165f470934dc : 440]
[task 2025-06-24T01:06:57.852+00:00] 01:06:57     INFO -     Found by: inlining
[task 2025-06-24T01:06:57.852+00:00] 01:06:57     INFO -  5  XUL!mozilla::dom::Promise::MaybeResolve<RefPtr<mozilla::dom::NavigationHistoryEntry>&>(RefPtr<mozilla::dom::NavigationHistoryEntry>&) [Promise.h:a548a42c9818b33ab6e4df2879ac165f470934dc : 95 + 0x0]
[task 2025-06-24T01:06:57.852+00:00] 01:06:57     INFO -      rax = 0x6ce9226d8f2e0034    rdx = 0x000000010e80cd80
[task 2025-06-24T01:06:57.852+00:00] 01:06:57     INFO -      rcx = 0x0000000000000007    rbx = 0x0000000000000000
[task 2025-06-24T01:06:57.853+00:00] 01:06:57     INFO -      rsi = 0x000000011c6c6560    rdi = 0x0000000000000000
[task 2025-06-24T01:06:57.853+00:00] 01:06:57     INFO -      rbp = 0x00007ff7be98ef70    rsp = 0x00007ff7be98ee80
[task 2025-06-24T01:06:57.853+00:00] 01:06:57     INFO -       r8 = 0x0000000000000000     r9 = 0x000000000000e000
[task 2025-06-24T01:06:57.853+00:00] 01:06:57     INFO -      r10 = 0x0000000000000000    r11 = 0x0000000000000000
[task 2025-06-24T01:06:57.853+00:00] 01:06:57     INFO -      r12 = 0x0000000101df6300    r13 = 0x000000010e81e660
[task 2025-06-24T01:06:57.853+00:00] 01:06:57     INFO -      r14 = 0x000000010e80cd60    r15 = 0x000000011c6c6560
[task 2025-06-24T01:06:57.853+00:00] 01:06:57     INFO -      rip = 0x0000000112e55ad6
[task 2025-06-24T01:06:57.853+00:00] 01:06:57     INFO -     Found by: given as instruction pointer in context
[task 2025-06-24T01:06:57.853+00:00] 01:06:57     INFO -  6  XUL!mozilla::dom::NavigationAPIMethodTracker::ResolveFinishedPromise() [Navigation.cpp:a548a42c9818b33ab6e4df2879ac165f470934dc : 88]
[task 2025-06-24T01:06:57.853+00:00] 01:06:57     INFO -     Found by: inlining
[task 2025-06-24T01:06:57.853+00:00] 01:06:57     INFO -  7  XUL!mozilla::dom::Navigation::InnerFireNavigateEvent(JSContext*, mozilla::dom::NavigationType, mozilla::dom::NavigationDestination*, mozilla::dom::UserNavigationInvolvement, mozilla::dom::Element*, already_AddRefed<mozilla::dom::FormData>, nsIStructuredCloneContainer*, nsTSubstring<char16_t> const&)::$_2::operator()(mozilla::Span<JS::Heap<JS::Value>, (unsigned long)18446744073709551615> const&) const [Navigation.cpp:a548a42c9818b33ab6e4df2879ac165f470934dc : 999]
[task 2025-06-24T01:06:57.853+00:00] 01:06:57     INFO -     Found by: inlining
[task 2025-06-24T01:06:57.853+00:00] 01:06:57     INFO -  8  XUL!std::__1::__invoke[abi:nn190102]<mozilla::dom::Navigation::InnerFireNavigateEvent(JSContext*, mozilla::NavigationType, mozilla::NavigationDestination*, mozilla::UserNavigationInvolvement, mozilla::Element*, already_AddRefed<mozilla::FormData>, nsIStructuredCloneContainer*, nsTSubstring<char16_t> const&)::$_2&, std::__1::__invoke[abi:nn190102]::Span<JS::Heap<std::__1::__invoke[abi:nn190102]::Span::Value>, (unsigned long)18446744073709551615> const&>(std::__1::__invoke[abi:nn190102]::Span<JS::Heap<std::__1::__invoke[abi:nn190102]::Span::Value>, (unsigned long)18446744073709551615> const&, mozilla::dom::Navigation::InnerFireNavigateEvent(JSContext*, mozilla::NavigationType, mozilla::NavigationDestination*, mozilla::UserNavigationInvolvement, mozilla::Element*, already_AddRefed<mozilla::FormData>, nsIStructuredCloneContainer*, nsTSubstring<char16_t> const&)::$_2&) [invoke.h : 149]
[task 2025-06-24T01:06:57.853+00:00] 01:06:57     INFO -     Found by: inlining

this failed in confirm failure mode (run 4x in the same session). This indicates one of 2 things:

  1. this failure is easier to reproduce/debug and could become more frequent
  2. this test doesn't work well when run multiple times in a row (if so should be annotated with skip-if = ["verify"])
Whiteboard: [collect_confirm_failure] → [confirmed_failure]
You need to log in before you can comment on or make changes to this bug.