1988655 - Crash in [@ JS::loader::ModuleLoaderBase::FinishLoadingImportedModule]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P3)

Description

[BugBot [:suhaib / :marco]]

Crash report: https://crash-stats.mozilla.org/report/index/9b2a297b-df11-4a36-b3ba-cc5570250915

MOZ_CRASH Reason: MOZ_CRASH(JS::FinishLoadingImportedModule(aCx, referrer, moduleReqObj, payload, module, usePromise))

Top 10 frames of crashing thread:

0  XUL  MOZ_CrashSequence  mfbt/Assertions.h:253
0  XUL  JS::loader::ModuleLoaderBase::FinishLoadingImportedModule  js/loader/ModuleLoaderBase.cpp:329
1  XUL  JS::loader::ModuleLoaderBase::ProcessDynamicImport  js/loader/ModuleLoaderBase.cpp:1531
2  XUL  JS::loader::ModuleLoadRequest::ProcessDynamicImport  js/loader/ModuleLoadRequest.h:113
2  XUL  mozilla::dom::ScriptLoader::ProcessRequest  dom/script/ScriptLoader.cpp:2396
3  XUL  mozilla::dom::ScriptLoader::ProcessPendingRequests  dom/script/ScriptLoader.cpp
4  XUL  mozilla::dom::ScriptLoader::DeferCheckpointReached  dom/script/ScriptLoader.cpp:4582
4  XUL  nsContentSink::DidBuildModelImpl  dom/base/nsContentSink.cpp:838
5  XUL  nsHtml5TreeOpExecutor::DidBuildModel  parser/html/nsHtml5TreeOpExecutor.cpp:190
6  XUL  nsHtml5TreeOpExecutor::RunFlushLoop  parser/html/nsHtml5TreeOpExecutor.cpp:692

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2025-08-13
• Process type: Content
• Is startup crash: No
• Has user comments: No
• Is null crash: Yes - 3 out of 4 crashes happened on null or near null memory address

Comment 1

[BugBot [:suhaib / :marco]]

The Bugbug bot thinks this bug should belong to the 'Core::JavaScript Engine' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[Matthew Gaudet (he/him) [:mgaudet]]

Sort of awkward because I think this will also crash like this on OOM.

Comment 3

[Jon Coppeard (:jonco)]

Regressed by bug 1980126 which added MOZ_ALWAYS_TRUE() instead of ignoring the return value.

Comment 4

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 1980126

Comment 5

[Jon Coppeard (:jonco)]

This is probably OOM and it's not clear the best way to handle it here.

Comment 6

[Jon Coppeard (:jonco)]

Attachment: WIP: Bug 1988655 - Attempt to handle failure calling JS::FinishLoadingImportedModule

The test case causes JS::FinishLoadingImportedModule to fail at iteration 85.

Currently this prevents the promise from being fulfilled and the test case hangs.

Comment 7

[Jon Coppeard (:jonco)]

The Gecko policy to to crash on OOM. Therefore we should call mozalloc_handle_oom or mozalloc_abort here to crash and report the failure as OOM.

Comment 8

[Yoshi Cheng-Hao Huang [:allstars.chh][:allstarschh][:yoshi]]

Attachment: Bug 1988655 - Handle OOM and uncatchable exception in FinishLoadingImportedModule. r?jonco!

Call mozalloc_handle_oom in case of OOM.

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/73d0052f66b8
https://hg.mozilla.org/integration/autoland/rev/5f1075f3a895
Handle OOM and uncatchable exception in FinishLoadingImportedModule. r=jonco

Comment 10

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/5f1075f3a895