1646257 - Crash in [@ js::ReportMagicWordFailure]

Status: RESOLVED FIXED

(Core :: JavaScript: GC, defect, P3)

Description

[Ryan VanderMeulen [:RyanVM]]

This bug is for crash report bp-22770f42-3894-41d3-9c17-766090200616.

Looks like this started spiking in the 20200601214228 Nightly build. Pushlog range:
https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=702ad0fa1586&tochange=bc973d369db58faf254ddcef201089dc28e6d3be

Top 10 frames of crashing thread:

0 xul.dll js::ReportMagicWordFailure js/src/vm/TypeInference.cpp:2699
1 xul.dll js::GCMarker::processMarkStackTop js/src/gc/Marking.cpp:1915
2 xul.dll js::GCMarker::markUntilBudgetExhausted js/src/gc/Marking.cpp:1780
3 xul.dll js::gc::GCRuntime::incrementalSlice js/src/gc/GC.cpp:6629
4 xul.dll js::gc::GCRuntime::gcCycle js/src/gc/GC.cpp:7086
5 xul.dll js::gc::GCRuntime::collect js/src/gc/GC.cpp:7296
6 xul.dll js::gc::GCRuntime::gcSlice js/src/gc/GC.cpp:7388
7 xul.dll static nsJSContext::GarbageCollectNow dom/base/nsJSEnvironment.cpp:1173
8 xul.dll InterSliceGCRunnerFired dom/base/nsJSEnvironment.cpp:1743
9 xul.dll std::_Func_impl_no_alloc<`lambda at /builds/worker/checkouts/gecko/dom/base/nsJSEnvironment.cpp:1791:7', bool, mozilla::TimeStamp>::_Do_call 

Comment 1

[Andrew McCreight [:mccr8]]

"Got 0xa1a2b3b4c546d7da expected magic word 0xa1a2b3b4c5c6d7da flags 0x20002 objectSet 0x0"

Comment 2

[Andrew McCreight [:mccr8]]

Hiding because I assume a crash in this function means some kind of memory corruption.

Comment 3

[Jon Coppeard (:jonco)]

Looks like corruption of TI data. Most of these are single bit flips.

Comment 4

[Daniel Veditz [:dveditz]]

I don't really see much of a "spike" -- seems noisy but fairly constant over the last 6 months. End of May looks a little quiet. Some of the crashes are null but most are bit flips -- do we have that many nightly users running crappy machines?

Comment 5

[Daniel Veditz [:dveditz]]

A small percentage of the crashes have Multi-bit ECC (see Memory Error Correction field on the "Metadata" tab or add a column).

Comment 6

[Nicolas B. Pierron [:nbp]]

I tried to look at the caller js::GCMarker::processMarkStackTop, if the same issue appeared in release versions of Firefox.

However, filtering by crash addresses does not yields similar crash addresses as this bug, which hint that this bug might only exists on Nightly.
Thus setting a lower severity.

Comment 7

[Daniel Veditz [:dveditz]]

Do we only run this check in Nightly? If so we were worried about this case and might not be "low".

Comment 8

[Nicolas B. Pierron [:nbp]]

(In reply to Daniel Veditz [:dveditz] from comment #7)

Do we only run this check in Nightly? If so we were worried about this case and might not be "low".

I will forward the question to Jon.

One of the thing I noted, is that the above signature seems to only report nightly issues, so I expected it to have been inlined in the caller. Which is why I looked for js::GCMarker::processMarkStackTop.

Comment 9

[Jon Coppeard (:jonco)]

ReportMagicWordFailure #ifdeffed on JS_CRASH_DIAGNOSTICS, so this signature only affects nightly.

In release builds this kind of problem causes the crashes tracked in bug 1112741.

Comment 10

[Ted Campbell [:tcampbell]]

TI was removed and this code is gone.

Comment 11

[BugBot [:suhaib / :marco/ :calixte]]

Since the bug is closed, the stalled keyword is now meaningless.
For more information, please visit auto_nag documentation.