1977272 - Fuzzing debug builds crash on startup

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P3)

Description

[Tyson Smith [:tsmith] (Back Aug 12)]

Fuzzing debug builds crash on startup. Many of the stacks point at but are not limited to jit, gc and other js related code.

STR:

• Launch a fuzzing debug build with the following prefs js file. Non-optimized builds seem to be less or not affected.

The following prefs.js file seems to be required.

user_pref("network.proxy.autoconfig_url", "data:text/plain,function FindProxyForURL(url, host) { if (host == 'localhost' || host == '127.0.0.1') { return 'DIRECT'; } else { return 'PROXY 127.0.0.1:6'; } }");
user_pref("network.proxy.type", 2);

BAD:

Changeset: 9ccc6a2267cbf69c621fec973bd28573c2a45a1f
Build ID: 20250709215737

GOOD:

Changeset: a5500d271fe3a1fefb4d81d96fc4abd00d9eade7
Build ID: 20250709093153

Comment 1

[Tyson Smith [:tsmith] (Back Aug 12)]

Could this be due to bug 1962026?

Comment 2

[Steve Fink [:sfink] [:s:]]

Oh. Yes, almost certainly.

I only tested with the JS shell. I bet the browser is unhappy.

I knew it couldn't be that easy...

Comment 3

[Tyson Smith [:tsmith] (Back Aug 12)]

A Pernosco session is available here: https://pernos.co/debug/E-cdjR-cdAKv3efCV13xUQ/index.html

Comment 5

[Tyson Smith [:tsmith] (Back Aug 12)]

Hi Matthew can you please in crease the priority of this issue since it is a major issue for fuzzing. It is triggering start up crashes and spamming fuzzmanager with unbucketable (too many signatures to bucket) scary looking crashes.

Comment 6

[Matthew Gaudet (he/him) [:mgaudet]]

Oh I misunderstood: I thought it was only fuzzing that tested PAC, and I missed the [fuzzblocker] tag.

Comment 7

[Matthew Gaudet (he/him) [:mgaudet]]

The regressing change is being backed out, so hopefully this will return to normal once that happens.

Comment 8

[Tyson Smith [:tsmith] (Back Aug 12)]

Marking as fixed now that bug 1962026 is backed out.