934639 - Aurora segfault in js::jit::PatchJump(js::jit::CodeLocationJump, js::jit::CodeLocationLabel)

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine: JIT, defect)

Description

[hallfaer]

To reproduce: Start Aurora 27.0a2 from around 4 November 2013.
Not possible to reproduce with 100% accuracy, but signing in to GMail gives better than 90% odds on average that the segfault occurs.

GDB output:
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff415b7e1 in js::jit::PatchJump(js::jit::CodeLocationJump, js::jit::CodeLocationLabel) () from /usr/lib/firefox/firefox/libxul.so

Comment:
I assume there's a javascript compiler-ish thingy here. The only thing I could think of when I read PatchJump was my University course where we had to build a compiler. So I'm guessing some Javascript is compiled, and the jump patcher causes a segfault to occur.
I can think of various things that can go wrong in a jump patch subroutine that can cause a segfault. My main guess would be writing to memory locations that lie outside array bounds.

Comment 1

[hallfaer]

Uname output for system:
Linux [CENSORED] 3.5.0-18-generic #29-Ubuntu SMP Thu Oct 25 07:26:14 UTC 2012 x86_64 x86_64 x86_64 GNU/Linux

Note: This is GNU/Linux Mint, even though uname says it is Ubuntu.

Comment 2

[Loic]

Could you paste the full stack trace from GBD, please.

Comment 3

[hallfaer]

(In reply to Loic from comment #2)
> Could you paste the full stack trace from GBD, please.

That was all of the stacktrace GDB gave me. It was however my first time using GDB, so maybe I missed some arcanery required to find more stacktrace.

I tried to reproduce the bug in GDB (which went great of course) but I don't get GDB itself. It says:

Starting program: /usr/lib/firefox/firefox/firefox-bin
Running global cleanup code from study base classes.
During startup program terminated with signal SIGSEGV, Segmentation fault.

It seems GDB itself hangs during startup, and doesn't properly attach (or something like that). That's just a wild guess.

Comment 4

[hallfaer]

The bug seems not to occur in Aurora 27.0a2 (2013-11-05) I don't know whether it was intentionally fixed, or accidentally disabled.

Comment 5

[hallfaer]

The bug is back in Aurora 27.0a2 (2013-11-08)
Stacktrace from GDB works again and gives:
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff415b8b1 in js::jit::PatchJump(js::jit::CodeLocationJump, js::jit::CodeLocationLabel) () from /usr/lib/firefox/firefox/libxul.so

Comment 6

[Kartik Mohta]

Maybe a slightly better stacktrace:

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff4149d21 in js::jit::PatchJump(js::jit::CodeLocationJump, js::jit::CodeLocationLabel) () from /home/kartikmohta/apps/firefox/libxul.so
(gdb) bt
#0  0x00007ffff4149d21 in js::jit::PatchJump(js::jit::CodeLocationJump, js::jit::CodeLocationLabel) () from /home/kartikmohta/apps/firefox/libxul.so
#1  0x00007ffff414a3b6 in js::jit::JitRuntime::patchIonBackedges(JSRuntime*, js::jit::JitRuntime::BackedgeTarget) () from /home/kartikmohta/apps/firefox/libxul.so
#2  0x00007ffff41c34d5 in js::jit::InterruptCheck(JSContext*) () from /home/kartikmohta/apps/firefox/libxul.so
#3  0x00007ffff7e0d17a in ?? ()
#4  0x00007ffffffe7670 in ?? ()
#5  0x00007ffffffe7098 in ?? ()
#6  0x0000000000000000 in ?? ()


I'm running the Aurora binary version from mozilla.org.

Application Basics
------------------
Name: Firefox
Version: 27.0a2
User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:27.0) Gecko/20100101 Firefox/27.0

browser.startup.homepage_override.buildID: 20131119004000
browser.startup.homepage_override.mstone: 27.0a2

Comment 7

[hallfaer]

The bug is still very present, in version 28. If nothing is done about this, it will soon be present in STABLE releases.
Certain websites are nigh unusable with this bug present. Sending an e-mail through Gmail requires about 30 Aurora restarts because it segfaults either when the login page loads, during login, during mail interface loading, or randomly when using the mail interface.

Personal login to bugzilla through Google is nigh impossible for similar reasons. Most of the time the Aurora will segfault and CTD instead of logging in.

Comment 8

[Till Schneidereit [:till]]

Given that we haven't received a single crash report for this signature in the last 30 days[1], it's highly likely that there's something wrong with your setup.

Can you try starting Firefox with a clean profile as a test? Just doing something like "firefox -profile /tmp/temp_profile" should do, without affecting your main profile.

If the crashes go away with that, I'd recommend using the "Reset Aurora..." button in about:support to clean up your profile.

If the crashes still persist, there might be a bigger issue with your system's setup.


https://crash-stats.mozilla.com/query/?product=Firefox&version=ALL%3AALL&range_value=30&range_unit=days&date=01%2F15%2F2014+15%3A00%3A00&query_search=signature&query_type=contains&query=CodeLocationJump&reason=&release_channels=&build_id=&process_type=any&hang_type=any

Comment 9

[hallfaer]

I have closed the issue, since I have not had the problem occur for almost a month, whatever the original cause may have been.