Closed Bug 2018023 Opened 6 months ago Closed 4 months ago

Crash in [@ js::MicroTaskQueueSet::empty]

Categories

(Core :: Machine Learning: On Device, defect)

Product:
Core
Component:
Machine Learning: On Device
Version:
Firefox 147
Platform:
x86_64
macOS
Type:
defect

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1996263

People

(Reporter: afranchuk, Unassigned)

References

Details

(Keywords: crash)

Crash Data

Crash report: https://crash-stats.mozilla.org/report/index/2946356c-dd7c-49bd-ba5a-3bb270260219

Reason:

SIGSEGV / SEGV_MAPERR

Top 10 frames:

0  libxul.so  js::MicroTaskQueueSet::empty()  /builddir/build/BUILD/firefox-147.0.2-build/firefox-147.0.2/js/src/vm/JSContext.h:199
0  libxul.so  JS::HasAnyMicroTasks(JSContext*)  /builddir/build/BUILD/firefox-147.0.2-build/firefox-147.0.2/js/src/vm/JSContext.cpp:1153
0  libxul.so  mozilla::CycleCollectedJSContext::PerformMicroTaskCheckPoint(bool)  /builddir/build/BUILD/firefox-147.0.2-build/firefox-147.0.2/xpcom/base/CycleCollectedJSContext.cpp:1155
1  libxul.so  mozilla::CycleCollectedJSContext::BeforeProcessTask(bool)  /builddir/build/BUILD/firefox-147.0.2-build/firefox-147.0.2/xpcom/base/CycleCollectedJSContext.cpp:725
2  libxul.so  nsThread::ProcessNextEvent(bool, bool*)  /builddir/build/BUILD/firefox-147.0.2-build/firefox-147.0.2/xpcom/threads/nsThread.cpp:1096
3  libxul.so  NS_ProcessNextEvent(nsIThread*, bool)  /builddir/build/BUILD/firefox-147.0.2-build/firefox-147.0.2/xpcom/threads/nsThreadUtils.cpp:461
4  libxul.so  SpinEventLoopUntil<>  /builddir/build/BUILD/firefox-147.0.2-build/firefox-147.0.2/xpcom/threads/SpinEventLoopUntil.h:176
4  libxul.so  nsThread::Shutdown()  /builddir/build/BUILD/firefox-147.0.2-build/firefox-147.0.2/xpcom/threads/nsThread.cpp:908
5  libxul.so  mozilla::dom::LlamaStreamSource::~LlamaStreamSource()  /builddir/build/BUILD/firefox-147.0.2-build/firefox-147.0.2/toolkit/components/ml/backends/llama/LlamaRunner.cpp:473
6  libxul.so  mozilla::dom::LlamaStreamSource::~LlamaStreamSource()  /builddir/build/BUILD/firefox-147.0.2-build/firefox-147.0.2/toolkit/components/ml/backends/llama/LlamaRunner.cpp:476

This is a new crash in 147, which I'll call a "near-top-crasher" for macos content processes in release (ranked 11th in crash pings): https://crash-pings.mozilla.org/#a0RUdL.

This is far underrepresented in crash reports: there's only 1 report!

Of note is that this is only occurring on x86_64, not arm64 macs.

This may be contributing to an overall increasing trend of crashes on macOS that we're seeing.

This crash was addressed in Bug 1996263 which wasn't uplifted -- moving to appropriate component for retriage tho.

Component: JavaScript Engine → Machine Learning: On Device
Duplicate of this bug: 2018030

Copying crash signatures from duplicate bugs.

Crash Signature: [@ js::MicroTaskQueueSet::empty] → [@ js::MicroTaskQueueSet::empty] [@ mozilla::Vector<T>::empty | JS::GCVector<T>::empty]

We're in rc week, isn't it too late?

Crash Signature: [@ js::MicroTaskQueueSet::empty] [@ mozilla::Vector<T>::empty | JS::GCVector<T>::empty] → [@ js::MicroTaskQueueSet::empty] [@ mozilla::Vector<T>::empty | JS::GCVector<T>::empty]
Flags: needinfo?(dmeehan)

:padenot, IIUC, this is a dup of bug 1996263 (the reason it was not seen was that there was no associated crash signature on that bug).

It's too late for Fx148, but I added a comment on Bug 1996263 about a release uplift request for a dot release.

Flags: needinfo?(dmeehan)
Status: NEW → RESOLVED
Closed: 4 months ago
Duplicate of bug: 1996263
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.