Open Bug 2008381 Opened 6 months ago Updated 4 months ago

Hit MOZ_CRASH(explicit panic) at gfx/wr/webrender/src/render_task.rs:45

Categories

(Core :: Graphics: WebRender, defect)

Product:
Core
Component:
Graphics: WebRender
Platform:
x86_64
Linux
Type:
defect

Tracking

()

Tracking Flags:
Tracking Status
firefox-esr115 --- unaffected
firefox-esr140 --- unaffected
firefox146 --- wontfix
firefox147 --- wontfix
firefox148 --- wontfix

People

(Reporter: jkratzer, Unassigned)

References

(Blocks 1 open bug, Regression)

Details

(Keywords: regression, testcase, Whiteboard: [bugmon:bisected,confirmed])

Attachments

(1 file)

Testcase
674 bytes, text/html
Details

Testcase found while fuzzing mozilla-central rev bb84913df076 (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework pipx --upgrade
$ python -m pipx ensurepath
$ fuzzfetch --build bb84913df076 --debug --fuzzing  -n firefox
$ grizzly-replay-bugzilla ./firefox/firefox <bugid>

Hit MOZ_CRASH(explicit panic) at gfx/wr/webrender/src/render_task.rs:45

    =================================================================
    ==2566107==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000001 (pc 0x721115def0d3 bp 0x720fd9ced450 sp 0x720fd9ced440 T126)
    ==2566107==The signal is caused by a WRITE memory access.
    ==2566107==Hint: address points to the zero page.
        #0 0x721115def0d3 in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:237:3
        #1 0x721115def0d3 in MOZ_Crash /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:375:3
        #2 0x721115def0d3 in RustMozCrash /mozglue/static/rust/wrappers.cpp:18:3
        #3 0x721115ded947 in mozglue_static::panic_hook::h2298c71906531a19 /mozglue/static/rust/lib.rs:99:9
        #4 0x721115ded947 in core::ops::function::Fn::call::h8434278a2bb7a156 /builds/worker/fetches/rust/library/core/src/ops/function.rs:79:5
        #5 0x721119aa7cde in std::panicking::rust_panic_with_hook::h6a589c4c9de2920f std.2a3dc06a763027ab-cgu.07:0:0
        #6 0x7211142be63d in std::panicking::begin_panic::_$u7b$$u7b$closure$u7d$$u7d$::h0c62dc043e1ea200 /builds/worker/fetches/rust/library/std/src/panicking.rs:738:9
        #7 0x7211142af835 in std::sys::backtrace::__rust_end_short_backtrace::h339bebe9d3f1338d /builds/worker/fetches/rust/library/std/src/sys/backtrace.rs:170:18
        #8 0x7211142be4c0 in std::panicking::begin_panic::h282b256015690f5b /builds/worker/fetches/rust/library/std/src/panicking.rs:737:5
        #9 0x721114d2793a in webrender::render_task::render_task_sanity_check::h11e9d72c0064ff9d /gfx/wr/webrender/src/render_task.rs:45:9
        #10 0x721114d2793a in webrender::render_task::RenderTask::new::ha07fe2f52e91e6d3 /gfx/wr/webrender/src/render_task.rs:987:9
        #11 0x721114d27f17 in webrender::render_task::RenderTask::new_dynamic::h37a9500b0ce2f9ef /gfx/wr/webrender/src/render_task.rs:1007:9
        #12 0x721114c34623 in webrender::prepare::prepare_interned_prim_for_render::ha816f036075593f1 /gfx/wr/webrender/src/prepare.rs:1114:74
        #13 0x721114c34623 in webrender::prepare::prepare_prim_for_render::hc3f8ec78740ff383 /gfx/wr/webrender/src/prepare.rs:324:5
        #14 0x721114c2112c in webrender::prepare::prepare_primitives::h35dd363931dde109 /gfx/wr/webrender/src/prepare.rs:141:17
        #15 0x721114c2112c in webrender::prepare::prepare_picture::h134152f4a0fe75aa /gfx/wr/webrender/src/prepare.rs:80:5
        #16 0x721114b8a308 in webrender::frame_builder::FrameBuilder::build_layer_screen_rects_and_cull_layers::h0227537659271dfc /gfx/wr/webrender/src/frame_builder.rs:595:13
        #17 0x721114b8a308 in webrender::frame_builder::FrameBuilder::build::hdeabb19edf602fba /gfx/wr/webrender/src/frame_builder.rs:690:9
        #18 0x721114c99c7a in webrender::render_backend::Document::build_frame::h8039ba56b5295d88 /gfx/wr/webrender/src/render_backend.rs:530:25
        #19 0x721114cc252d in webrender::render_backend::RenderBackend::update_document::h0a70ae172d51d420 /gfx/wr/webrender/src/render_backend.rs:1600:41
        #20 0x721114ca43f2 in webrender::render_backend::RenderBackend::prepare_transactions::hb7aa039939457896 /gfx/wr/webrender/src/render_backend.rs:1429:28
        #21 0x721114ca43f2 in webrender::render_backend::RenderBackend::process_api_msg::h7fe861a92c6ae184 /gfx/wr/webrender/src/render_backend.rs:1288:17
        #22 0x7211142b50dd in webrender::render_backend::RenderBackend::run::h739ddb47d40c2088 /gfx/wr/webrender/src/render_backend.rs:861:21
        #23 0x7211142b50dd in webrender::renderer::init::create_webrender_instance::_$u7b$$u7b$closure$u7d$$u7d$::h312c499d846a9e61 /gfx/wr/webrender/src/renderer/init.rs:735:9
        #24 0x7211142b50dd in std::sys::backtrace::__rust_begin_short_backtrace::h6fd7b60bbda0a059 /builds/worker/fetches/rust/library/std/src/sys/backtrace.rs:154:18
        #25 0x7211142d5da1 in std::thread::Builder::spawn_unchecked_::_$u7b$$u7b$closure$u7d$$u7d$::_$u7b$$u7b$closure$u7d$$u7d$::h967b8f939a27364f /builds/worker/fetches/rust/library/std/src/thread/mod.rs:538:17
        #26 0x7211142d5da1 in _$LT$core..panic..unwind_safe..AssertUnwindSafe$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$$LP$$RP$$GT$$GT$::call_once::hf1b528c2cb6c242f /builds/worker/fetches/rust/library/core/src/panic/unwind_safe.rs:272:9
        #27 0x7211142d5da1 in std::panicking::try::do_call::hb372e306811653ef /builds/worker/fetches/rust/library/std/src/panicking.rs:557:40
        #28 0x7211142d5da1 in std::panicking::try::h071ada472f4de69c /builds/worker/fetches/rust/library/std/src/panicking.rs:520:19
        #29 0x7211142d5da1 in std::panic::catch_unwind::hee224bc8b60154c8 /builds/worker/fetches/rust/library/std/src/panic.rs:358:14
        #30 0x7211142d5da1 in std::thread::Builder::spawn_unchecked_::_$u7b$$u7b$closure$u7d$$u7d$::h4ac9062fb183f6fa /builds/worker/fetches/rust/library/std/src/thread/mod.rs:537:30
        #31 0x7211142d5da1 in core::ops::function::FnOnce::call_once$u7b$$u7b$vtable.shim$u7d$$u7d$::h968b4ca3955cffb2 /builds/worker/fetches/rust/library/core/src/ops/function.rs:250:5
        #32 0x721119abae3a in std::sys::pal::unix::thread::Thread::new::thread_start::h25f5e17a1ec3dfc2 std.2a3dc06a763027ab-cgu.12:0:0
        #33 0x6457d54bca46 in asan_thread_start(void*) _asan_rtl_:28
        #34 0x76112728aaa3 in start_thread ./nptl/pthread_create.c:447:8
        #35 0x761127317c6b in clone3 ./misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78:0
    
    ==2566107==Register values:
    rax = 0x000000000000002d  rbx = 0x000000000000002d  rcx = 0x0000000000000001  rdx = 0x0000000000000000
    rdi = 0x00006457d5642790  rsi = 0x0000720fd9ced3f8  rbp = 0x0000720fd9ced450  rsp = 0x0000720fd9ced440
     r8 = 0x0000000000000000   r9 = 0xffffff0000000000  r10 = 0xefffffffffffffff  r11 = 0x4000000000000000
    r12 = 0x00000e427b13b000  r13 = 0x000000000000002d  r14 = 0x0000720fd8a182b4  r15 = 0x0000720fd8a18024
    AddressSanitizer can not provide additional info.
    SUMMARY: AddressSanitizer: SEGV (/home/jkratzer/builds/m-c-20260102083805-fuzzing-asan-opt/libxul.so+0x1b0540d3) (BuildId: 0c27b87a63122cce0359dafec298c255d7d86a7e)
    Thread T126 created by T49 here:
        #0 0x6457d54a4cf1 in ___interceptor_pthread_create _asan_rtl_:3
        #1 0x721119abac71 in std::sys::pal::unix::thread::Thread::new::h9b5befd65da6000d std.2a3dc06a763027ab-cgu.12:0:0
        #2 0x721114d660ca in std::thread::Builder::spawn_unchecked_::hc809103f1b2795f8 /builds/worker/fetches/rust/library/std/src/thread/mod.rs:577:30
        #3 0x721114d660ca in std::thread::Builder::spawn_unchecked::h25a297dc40ed8813 /builds/worker/fetches/rust/library/std/src/thread/mod.rs:447:32
        #4 0x721114d660ca in std::thread::Builder::spawn::h242ed0afece1fd2e /builds/worker/fetches/rust/library/std/src/thread/mod.rs:380:18
        #5 0x721114d660ca in webrender::renderer::init::create_webrender_instance::h1b116dcf8209ea92 /gfx/wr/webrender/src/renderer/init.rs:689:57
        #6 0x72111413d213 in wr_window_new /gfx/webrender_bindings/src/bindings.rs:2200:36
        #7 0x721105272373 in mozilla::wr::NewRenderer::Run(mozilla::wr::RenderThread&, mozilla::wr::WrWindowId) /gfx/webrender_bindings/WebRenderAPI.cpp:147:10
        #8 0x721105237085 in mozilla::wr::RenderThread::RunEvent(mozilla::wr::WrWindowId, std::unique_ptr<mozilla::wr::RendererEvent, std::default_delete<mozilla::wr::RendererEvent>>, bool) /gfx/webrender_bindings/RenderThread.cpp:751:11
        #9 0x721105253678 in operator()<StoreCopyPassByConstLRef<mozilla::wr::WrWindowId> &, StoreCopyPassByRRef<std::unique_ptr<mozilla::wr::RendererEvent, std::default_delete<mozilla::wr::RendererEvent> > > &, StoreCopyPassByConstLRef<bool> &> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1083:18
        #10 0x721105253678 in __invoke_impl<void, (lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1082:9), StoreCopyPassByConstLRef<mozilla::wr::WrWindowId> &, StoreCopyPassByRRef<std::unique_ptr<mozilla::wr::RendererEvent, std::default_delete<mozilla::wr::RendererEvent> > > &, StoreCopyPassByConstLRef<bool> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/invoke.h:60:14
        #11 0x721105253678 in __invoke<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1082:9), StoreCopyPassByConstLRef<mozilla::wr::WrWindowId> &, StoreCopyPassByRRef<std::unique_ptr<mozilla::wr::RendererEvent, std::default_delete<mozilla::wr::RendererEvent> > > &, StoreCopyPassByConstLRef<bool> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/invoke.h:95:14
        #12 0x721105253678 in __apply_impl<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1082:9), std::tuple<StoreCopyPassByConstLRef<mozilla::wr::WrWindowId>, StoreCopyPassByRRef<std::unique_ptr<mozilla::wr::RendererEvent, std::default_delete<mozilla::wr::RendererEvent> > >, StoreCopyPassByConstLRef<bool> > &, 0UL, 1UL, 2UL> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/tuple:1740:14
        #13 0x721105253678 in apply<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1082:9), std::tuple<StoreCopyPassByConstLRef<mozilla::wr::WrWindowId>, StoreCopyPassByRRef<std::unique_ptr<mozilla::wr::RendererEvent, std::default_delete<mozilla::wr::RendererEvent> > >, StoreCopyPassByConstLRef<bool> > &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/tuple:1751:14
        #14 0x721105253678 in apply<mozilla::wr::RenderThread, void (mozilla::wr::RenderThread::*)(mozilla::wr::WrWindowId, std::unique_ptr<mozilla::wr::RendererEvent, std::default_delete<mozilla::wr::RendererEvent> >, bool)> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1081:12
        #15 0x721105253678 in mozilla::detail::RunnableMethodImpl<mozilla::wr::RenderThread*, void (mozilla::wr::RenderThread::*)(mozilla::wr::WrWindowId, std::unique_ptr<mozilla::wr::RendererEvent, std::default_delete<mozilla::wr::RendererEvent>>, bool), true, (mozilla::RunnableKind)0, mozilla::wr::WrWindowId, std::unique_ptr<mozilla::wr::RendererEvent, std::default_delete<mozilla::wr::RendererEvent>>&&, bool>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1132:13
        #16 0x721101e318f0 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1158:16
        #17 0x721101e3c418 in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:461:10
        #18 0x721103571b5c in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:329:5
        #19 0x721103450ce4 in RunInternal /ipc/chromium/src/base/message_loop.cc:368:10
        #20 0x721103450ce4 in RunHandler /ipc/chromium/src/base/message_loop.cc:361:3
        #21 0x721103450ce4 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:343:3
        #22 0x721101e2a740 in nsThread::ThreadFunc(void*) /xpcom/threads/nsThread.cpp:373:10
        #23 0x761126bebaff in _pt_root /nsprpub/pr/src/pthreads/ptthread.c:191:3
        #24 0x6457d54bca46 in asan_thread_start(void*) _asan_rtl_:28
    
    Thread T49 created by T0 here:
        #0 0x6457d54a4cf1 in ___interceptor_pthread_create _asan_rtl_:3
        #1 0x761126bdc5f9 in _PR_CreateThread /nsprpub/pr/src/pthreads/ptthread.c:429:10
        #2 0x761126bca8be in PR_CreateThread /nsprpub/pr/src/pthreads/ptthread.c:496:10
        #3 0x721101e2d1d1 in nsThread::Init(nsTSubstring<char> const&) /xpcom/threads/nsThread.cpp:622:20
        #4 0x721101e3ad52 in nsThreadManager::NewNamedThread(nsTSubstring<char> const&, nsIThreadManager::ThreadCreationOptions, nsIThread**) /xpcom/threads/nsThreadManager.cpp:625:22
        #5 0x721101e46409 in NS_NewNamedThread(nsTSubstring<char> const&, nsIThread**, already_AddRefed<nsIRunnable>, nsIThreadManager::ThreadCreationOptions) /xpcom/threads/nsThreadUtils.cpp:175:57
        #6 0x721105231a3f in NS_NewNamedThread<9UL> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:76:10
        #7 0x721105231a3f in mozilla::wr::RenderThread::Start(unsigned int) /gfx/webrender_bindings/RenderThread.cpp:141:17
        #8 0x721104eab3c9 in gfxPlatform::InitLayersIPC() /gfx/thebes/gfxPlatform.cpp:1353:7
        #9 0x721104ea3dda in gfxPlatform::Init() /gfx/thebes/gfxPlatform.cpp:994:3
        #10 0x72110cd571a6 in GetPlatform /builds/worker/workspace/obj-build/dist/include/gfxPlatform.h:185:7
        #11 0x72110cd571a6 in mozilla::widget::GfxInfoBase::GetContentBackend(nsTSubstring<char16_t>&) /widget/GfxInfoBase.cpp:1908:25
        #12 0x721101e7b1fd in NS_InvokeByIndex /xpcom/reflect/xptcall/md/unix/xptcinvoke_asm_x86_64_unix.S:101:0
        #13 0x72110383d160 in Invoke /js/xpconnect/src/XPCWrappedNative.cpp:1619:10
        #14 0x72110383d160 in Call /js/xpconnect/src/XPCWrappedNative.cpp:1173:19
        #15 0x72110383d160 in XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) /js/xpconnect/src/XPCWrappedNative.cpp:1119:23
        #16 0x721103841e6e in GetAttribute /js/xpconnect/src/xpcprivate.h:1449:12
        #17 0x721103841e6e in XPC_WN_GetterSetter(JSContext*, unsigned int, JS::Value*) /js/xpconnect/src/XPCWrappedNativeJSOps.cpp:1006:10
        #18 0x721110bb1dcd in CallJSNative /js/src/vm/Interpreter.cpp:490:13
        #19 0x721110bb1dcd in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:586:12
        #20 0x721110bb3a54 in InternalCall /js/src/vm/Interpreter.cpp:653:10
        #21 0x721110bb3a54 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /js/src/vm/Interpreter.cpp:685:8
        #22 0x721110bb568a in js::CallGetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>) /js/src/vm/Interpreter.cpp:807:10
        #23 0x721111122e0a in CallGetter(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::Value>, JS::Handle<JS::PropertyKey>, js::PropertyInfoBase<unsigned int>, JS::MutableHandle<JS::Value>) /js/src/vm/NativeObject.cpp:2139:12
        #24 0x7211110f67e4 in GetExistingProperty<(js::AllowGC)1> /js/src/vm/NativeObject.cpp:2167:12
        #25 0x7211110f67e4 in NativeGetPropertyInline<(js::AllowGC)1> /js/src/vm/NativeObject.cpp:2310:14
        #26 0x7211110f67e4 in js::NativeGetProperty(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::Value>, JS::Handle<JS::PropertyKey>, JS::MutableHandle<JS::Value>) /js/src/vm/NativeObject.cpp:2340:10
        #27 0x72110fde8f2e in GetProperty /js/src/vm/ObjectOperations-inl.h:113:10
        #28 0x72110fde8f2e in GetObjectElementOperation /js/src/vm/Interpreter-inl.h:394:10
        #29 0x72110fde8f2e in GetElementOperationWithStackIndex /js/src/vm/Interpreter-inl.h:477:10
        #30 0x72110fde8f2e in GetElementOperation /js/src/vm/Interpreter-inl.h:485:10
        #31 0x72110fde8f2e in js::jit::DoGetElemFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICFallbackStub*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>) /js/src/jit/BaselineIC.cpp:724:8
        #32 0x721060ff8a83  ([anon:js-executable-memory]+0x2a83)
        #33 0x72106129f931  ([anon:js-executable-memory]+0x9931)
        #34 0x721060ff63dc  ([anon:js-executable-memory]+0x3dc)
        #35 0x721110909393 in EnterJit /js/src/jit/Jit.cpp:107:5
        #36 0x721110909393 in js::jit::MaybeEnterJit(JSContext*, js::RunState&) /js/src/jit/Jit.cpp:255:10
        #37 0x721110bb0967 in js::RunScript(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:450:32
        #38 0x721110bb1f47 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:618:13
        #39 0x72110fe000b0 in js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICFallbackStub*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) /js/src/jit/BaselineIC.cpp:1698:10
        #40 0x721060ff88d3  ([anon:js-executable-memory]+0x28d3)
        #41 0x721060ffe5e5  ([anon:js-executable-memory]+0x85e5)
        #42 0x72106129e065  ([anon:js-executable-memory]+0x8065)
        #43 0x721060ff63dc  ([anon:js-executable-memory]+0x3dc)
        #44 0x721110909393 in EnterJit /js/src/jit/Jit.cpp:107:5
        #45 0x721110909393 in js::jit::MaybeEnterJit(JSContext*, js::RunState&) /js/src/jit/Jit.cpp:255:10
        #46 0x721110bb0967 in js::RunScript(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:450:32
        #47 0x721110bb1f47 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:618:13
        #48 0x72110fe000b0 in js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICFallbackStub*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) /js/src/jit/BaselineIC.cpp:1698:10
        #49 0x721060ff88d3  ([anon:js-executable-memory]+0x28d3)
        #50 0x721060ffe5e5  ([anon:js-executable-memory]+0x85e5)
        #51 0x7210612b4a6b  ([anon:js-executable-memory]+0xea6b)
        #52 0x721060ff63dc  ([anon:js-executable-memory]+0x3dc)
        #53 0x721110909393 in EnterJit /js/src/jit/Jit.cpp:107:5
        #54 0x721110909393 in js::jit::MaybeEnterJit(JSContext*, js::RunState&) /js/src/jit/Jit.cpp:255:10
        #55 0x721110bb0967 in js::RunScript(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:450:32
        #56 0x721110bb1f47 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:618:13
        #57 0x72110fe000b0 in js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICFallbackStub*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) /js/src/jit/BaselineIC.cpp:1698:10
        #58 0x721060ff88d3  ([anon:js-executable-memory]+0x28d3)
        #59 0x721060ffe5e5  ([anon:js-executable-memory]+0x85e5)
        #60 0x7210612b29c1  ([anon:js-executable-memory]+0xc9c1)
        #61 0x721060ff63dc  ([anon:js-executable-memory]+0x3dc)
        #62 0x721110909393 in EnterJit /js/src/jit/Jit.cpp:107:5
        #63 0x721110909393 in js::jit::MaybeEnterJit(JSContext*, js::RunState&) /js/src/jit/Jit.cpp:255:10
        #64 0x721110bb0967 in js::RunScript(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:450:32
        #65 0x721110bb1f47 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:618:13
        #66 0x721110bb42ee in InternalConstruct(JSContext*, js::AnyConstructArgs const&, js::CallReason) /js/src/vm/Interpreter.cpp:717:10
        #67 0x72110fdffcc4 in js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICFallbackStub*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) /js/src/jit/BaselineIC.cpp:1677:10
        #68 0x721060ff88d3  ([anon:js-executable-memory]+0x28d3)
        #69 0x721060ffe658  ([anon:js-executable-memory]+0x8658)
        #70 0x7210612b21d0  ([anon:js-executable-memory]+0xc1d0)
        #71 0x721060ff63dc  ([anon:js-executable-memory]+0x3dc)
        #72 0x721110909393 in EnterJit /js/src/jit/Jit.cpp:107:5
        #73 0x721110909393 in js::jit::MaybeEnterJit(JSContext*, js::RunState&) /js/src/jit/Jit.cpp:255:10
        #74 0x721110bb0967 in js::RunScript(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:450:32
        #75 0x721110bb1f47 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:618:13
        #76 0x72110fe000b0 in js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICFallbackStub*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) /js/src/jit/BaselineIC.cpp:1698:10
        #77 0x721060ff88d3  ([anon:js-executable-memory]+0x28d3)
        #78 0x721060ffe5e5  ([anon:js-executable-memory]+0x85e5)
        #79 0x7210612b2042  ([anon:js-executable-memory]+0xc042)
        #80 0x721060ff63dc  ([anon:js-executable-memory]+0x3dc)
        #81 0x721110909393 in EnterJit /js/src/jit/Jit.cpp:107:5
        #82 0x721110909393 in js::jit::MaybeEnterJit(JSContext*, js::RunState&) /js/src/jit/Jit.cpp:255:10
        #83 0x721110bb0967 in js::RunScript(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:450:32
        #84 0x721110bb1f47 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:618:13
        #85 0x721110bb3a54 in InternalCall /js/src/vm/Interpreter.cpp:653:10
        #86 0x721110bb3a54 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /js/src/vm/Interpreter.cpp:685:8
        #87 0x721110bb568a in js::CallGetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>) /js/src/vm/Interpreter.cpp:807:10
        #88 0x721111122e0a in CallGetter(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::Value>, JS::Handle<JS::PropertyKey>, js::PropertyInfoBase<unsigned int>, JS::MutableHandle<JS::Value>) /js/src/vm/NativeObject.cpp:2139:12
        #89 0x7211110f67e4 in GetExistingProperty<(js::AllowGC)1> /js/src/vm/NativeObject.cpp:2167:12
        #90 0x7211110f67e4 in NativeGetPropertyInline<(js::AllowGC)1> /js/src/vm/NativeObject.cpp:2310:14
        #91 0x7211110f67e4 in js::NativeGetProperty(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::Value>, JS::Handle<JS::PropertyKey>, JS::MutableHandle<JS::Value>) /js/src/vm/NativeObject.cpp:2340:10
        #92 0x721110be3301 in GetProperty /js/src/vm/ObjectOperations-inl.h:113:10
        #93 0x721110be3301 in GetProperty /js/src/vm/ObjectOperations-inl.h:120:10
        #94 0x721110be3301 in js::GetProperty(JSContext*, JS::Handle<JS::Value>, JS::Handle<js::PropertyName*>, JS::MutableHandle<JS::Value>) /js/src/vm/Interpreter.cpp:4617:10
        #95 0x72110fdf9108 in js::jit::DoGetPropFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICFallbackStub*, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>) /js/src/jit/BaselineIC.cpp:1318:8
        #96 0x721060ff8c5f  ([anon:js-executable-memory]+0x2c5f)
        #97 0x721061299dc5  ([anon:js-executable-memory]+0x3dc5)
        #98 0x721060ff63dc  ([anon:js-executable-memory]+0x3dc)
        #99 0x721110909393 in EnterJit /js/src/jit/Jit.cpp:107:5
        #100 0x721110909393 in js::jit::MaybeEnterJit(JSContext*, js::RunState&) /js/src/jit/Jit.cpp:255:10
        #101 0x721110bb0967 in js::RunScript(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:450:32
        #102 0x721110bb1f47 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:618:13
        #103 0x72110fe000b0 in js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICFallbackStub*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) /js/src/jit/BaselineIC.cpp:1698:10
        #104 0x721060ff88d3  ([anon:js-executable-memory]+0x28d3)
        #105 0x721060ffe5e5  ([anon:js-executable-memory]+0x85e5)
        #106 0x72106127e993  ([anon:js-executable-memory]+0x8993)
        #107 0x721060ff63dc  ([anon:js-executable-memory]+0x3dc)
        #108 0x721110909393 in EnterJit /js/src/jit/Jit.cpp:107:5
        #109 0x721110909393 in js::jit::MaybeEnterJit(JSContext*, js::RunState&) /js/src/jit/Jit.cpp:255:10
        #110 0x721110bb0967 in js::RunScript(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:450:32
        #111 0x721110bb1f47 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:618:13
        #112 0x721110bb3a54 in InternalCall /js/src/vm/Interpreter.cpp:653:10
        #113 0x721110bb3a54 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /js/src/vm/Interpreter.cpp:685:8
        #114 0x721110f01215 in JS_CallFunctionValue(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /js/src/vm/CallAndConstruct.cpp:55:10
        #115 0x72110383181d in nsXPCWrappedJS::CallMethod(unsigned short, nsXPTMethodInfo const*, nsXPTCMiniVariant*) /js/xpconnect/src/XPCWrappedJSClass.cpp:918:17
        #116 0x721101e7ca8b in PrepareAndDispatch /xpcom/reflect/xptcall/md/unix/xptcstubs_x86_64_linux.cpp:115:37
        #117 0x721101e7b92e in SharedStub xptcstubs_x86_64_linux.cpp:0:0
        #118 0x721101dcee2c in NS_CreateServicesFromCategory(char const*, nsISupports*, char const*, char16_t const*) /xpcom/components/nsCategoryManager.cpp:680:19
        #119 0x72110f09267c in nsXREDirProvider::DoStartup() /toolkit/xre/nsXREDirProvider.cpp:693:11
        #120 0x72110f0705e5 in XREMain::XRE_mainRun() /toolkit/xre/nsAppRunner.cpp:5698:18
        #121 0x72110f072632 in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /toolkit/xre/nsAppRunner.cpp:6177:8
        #122 0x72110f0736e3 in XRE_main(int, char**, mozilla::BootstrapConfig const&) /toolkit/xre/nsAppRunner.cpp:6250:21
        #123 0x6457d550577a in do_main /browser/app/nsBrowserApp.cpp:268:22
        #124 0x6457d550577a in main /browser/app/nsBrowserApp.cpp:532:16
        #125 0x7611272181c9 in __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
        #126 0x76112721828a in __libc_start_main ./csu/../csu/libc-start.c:360:3
        #127 0x6457d541f4b8 in _start ??:0:0
    
    ==2566107==ABORTING
Attached file Testcase —

Verified bug as reproducible on mozilla-central 20260103085132-791d47406d61.
The bug appears to have been introduced in the following build range:

Start: 5247753a8464e0caa7e6d497d8a37f2edccabcb6 (20251023072710)
End: 1399959495555fb57bb8be9c83f2822aaf3368a5 (20251023083313)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=5247753a8464e0caa7e6d497d8a37f2edccabcb6&tochange=1399959495555fb57bb8be9c83f2822aaf3368a5

Keywords: regression
Whiteboard: [bugmon:confirm] → [bugmon:bisected,confirmed]

This bug has been marked as a regression. Setting status flag for Nightly to affected.

status-firefox148: --- → affected
Severity: -- → S3
See Also: → 2011700

Testcase crashes using the initial build (mozilla-central 20260102083805-bb84913df076) but not with tip (mozilla-central 20260213212122-0d74a4189e30.)

The bug appears to have been fixed in the following build range:

Start: 7b462e5f87f8288cd64022cca2ff5144ad46f780 (20260201221415)
End: 102025d1bcfca4f5b92c97e11fb614d0254a42bc (20260202005614)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=7b462e5f87f8288cd64022cca2ff5144ad46f780&tochange=102025d1bcfca4f5b92c97e11fb614d0254a42bc

jkratzer, can you confirm that the above bisection range is responsible for fixing this issue?
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Flags: needinfo?(jkratzer)
Keywords: bugmon

:gw, was this fixed via bug 2013094?

Flags: needinfo?(jkratzer) → needinfo?(mozilla)

I wouldn't expect it to have fixed it, but it's certainly plausible given the code involved, yes.

Flags: needinfo?(mozilla)
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: