2018030 - Crash in [@ mozilla::Vector<T>::empty | JS::GCVector<T>::empty]

Status: RESOLVED DUPLICATE of bug 2018023

(Core :: JavaScript Engine, defect)

Description

[Alex Franchuk [:afranchuk]]

Crash report: https://crash-stats.mozilla.org/report/index/732c1f25-b547-4e61-9202-a3c320260218

Reason:

EXC_BAD_ACCESS / KERN_INVALID_ADDRESS

Top 10 frames:

0  XUL  mozilla::Vector<js::MicroTaskQueueElement, (unsigned long)0, js::TempAllocPol...  mfbt/Vector.h:560
0  XUL  JS::GCVector<js::MicroTaskQueueElement, (unsigned long)0, js::TempAllocPolicy...  js/public/GCVector.h:63
0  XUL  js::Fifo<js::MicroTaskQueueElement, (unsigned long)0, js::TempAllocPolicy, JS...  js/src/ds/Fifo.h:83
0  XUL  js::MicroTaskQueueSet::empty()  js/src/vm/JSContext.h:199
0  XUL  JS::HasAnyMicroTasks(JSContext*)  js/src/vm/JSContext.cpp:1153
0  XUL  mozilla::CycleCollectedJSContext::PerformMicroTaskCheckPoint(bool)  xpcom/base/CycleCollectedJSContext.cpp:1155
1  XUL  mozilla::CycleCollectedJSContext::BeforeProcessTask(bool)  xpcom/base/CycleCollectedJSContext.cpp:725
2  XUL  nsThread::ProcessNextEvent(bool, bool*)  xpcom/threads/nsThread.cpp:1096
2  XUL  NS_ProcessNextEvent(nsIThread*, bool)  xpcom/threads/nsThreadUtils.cpp:461
3  XUL  mozilla::SpinEventLoopUntil<(mozilla::ProcessFailureBehavior)1, nsThread::Shu...  xpcom/threads/SpinEventLoopUntil.h:176

This is very underrepresented in crash reports (there are only 2 reports!), but it is currently the top crasher for the Mac content process in release: https://crash-pings.mozilla.org/#NJ9Vir.

I see that bug 1995409 claims to have fixed a crash with this signature in 146. All of these crashes are in 147. They are also only on arm64.

Comment 1

[Jan de Mooij [:jandem]]

This looks like it's the same issue as bug 2018023.

Comment 2

[Matthew Gaudet (he/him) [:mgaudet]]

Yep; the trick is the LllamaStreamSource in the stack.