1889049 - Website next.scrimba.tech crashes

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Simon Friedberger [:simonf]]

https://next.scrimba.tech/ crashes in current Nightly.
Determined that this is caused by 1729044 with moz-regression.
A crash dump from my machine is available here: https://crash-stats.mozilla.org/report/index/b1127216-635b-4b5e-aaa4-43a810240402

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1729044

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The bug is marked as tracked for firefox126 (nightly). We have limited time to fix this, the soft freeze is in 9 days. However, the bug still isn't assigned.

:gcp, could you please find an assignee for this tracked bug? Given that it is a regression and we know the cause, we could also simply backout the regressor. If you disagree with the tracking decision, please talk with the release managers.

For more information, please visit BugBot documentation.

Comment 3

[Alex Franchuk [:afranchuk]]

Bug 1729044 is almost definitely not the cause; it removed unused code.

Comment 4

[Alex Franchuk [:afranchuk]]

Also, I'm able to open the link on currently Nightly without a crash.

Comment 5

[Andrew McCreight [:mccr8]]

It also crashes for me, on MacOS. It looks like Simon is also on MacOS. What OS are you on, Alex?

Comment 6

[Andrew McCreight [:mccr8]]

I tried in mozregression, and I couldn't reproduce in a clean build there.

Comment 7

[Alex Franchuk [:afranchuk]]

I'm on linux!

Comment 8

[Alex Franchuk [:afranchuk]]

FWIW I tried both last night's and this morning's nightly.

Comment 9

[Simon Friedberger [:simonf]]

It takes a second or ten but it also crashes for me on OSX with a current local build and on Linux with current Nightly.
(Linux: https://crash-stats.mozilla.org/report/index/01f5e5f0-f1d2-4635-804c-ddb980240303 )

Comment 10

[Alex Franchuk [:afranchuk]]

So I was unable to reproduce just that site crashing (I've tried waiting, clicking around a bunch, etc), however I found that https://next.scrimba.tech/learn-javascript-c0v reliably crashes for me.

Comment 11

[Andrew McCreight [:mccr8]]

I was able to get the original URL to reproduce more reliably by spamming a bunch of tabs, but Alex's URL reproduces it much more effectively. With mozregression, I can reproduce on a 03-03 build, which predates bug 1729044, so I'll move this.

Comment 12

[Andrew McCreight [:mccr8]]

Thanks to Alex for the new test case. It reproduces a crash for me 100% of the time, in a fresh profile. mozregression says bug 1873964 is the cause here, which makes more sense.

Comment 13

[Andrew McCreight [:mccr8]]

I re-ran mozregression (with ./mach mozregression -g 2024-02-04 -b 2024-02-06) and it confirmed the regressor.

Comment 14

[BugBot [:suhaib / :marco/ :calixte]]

:alexical, since you are the author of the regressor, bug 1873964, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 15

[BugBot [:suhaib / :marco/ :calixte]]

The bug is linked to a topcrash signature, which matches the following criteria:

• Top 20 desktop browser crashes on release (startup)
• Top 20 desktop browser crashes on beta
• Top 10 desktop browser crashes on nightly
• Top 10 content process crashes on beta
• Top 10 content process crashes on release

For more information, please visit BugBot documentation.

Comment 16

[Alex Thayer [:alexical] (she/her)]

Attachment: Bug 1889049 - Avoid writing to input reg in toHashableString r?iain

Still TBD on why this is actually a problem, given that we're replacing the
input with a pointer to an atom which is valid and equivalent to the string,
but it appears to fix the crash.

Comment 17

[Alex Thayer [:alexical] (she/her)]

Comment on attachment 9394887 [details]
Bug 1889049 - Avoid writing to input reg in toHashableString r?iain

Security Approval Request

• How easily could an exploit be constructed based on the patch?: My intuition is it would be tough, but I have been unable to pin down the smoking gun here so it's possible that it's easy.
• Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?: No
• Which branches (beta, release, and/or ESR) are affected by this flaw, and do the release status flags reflect this affected/unaffected state correctly?: beta, release, yes
• If not all supported branches, which bug introduced the flaw?: Bug 1873964
• Do you have backports for the affected branches?: No
• If not, how different, hard to create, and risky will they be?: trivial
• How likely is this patch to cause regressions; how much testing does it need?: Very unlikely. It's fairly trivially correct.
• Is the patch ready to land after security approval is given?: Yes
• Is Android affected?: Yes

Comment 18

[Alex Thayer [:alexical] (she/her)]

Attachment: Bug 1889049 - Avoid writing to input reg in toHashableString r?iain

Original Revision: https://phabricator.services.mozilla.com/D206560

Comment 19

[Phabricator Automation]

beta Uplift Approval Request

• User impact if declined: Crashes, potential security hole
• Code covered by automated testing: yes
• Fix verified in Nightly: yes
• Needs manual QE test: no
• Steps to reproduce for manual QE testing: Navigate to the linked page in bug and verify it does not crash.
• Risk associated with taking this patch: Little
• Explanation of risk level: It's a small and very simple patch.
• String changes made/needed: None
• Is Android affected?: yes

Comment 20

[Daniel Veditz [:dveditz] out until Nov 10]

Comment on attachment 9394887 [details]
Bug 1889049 - Avoid writing to input reg in toHashableString r?iain

sec-approval+ = dveditz

Comment 21

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/2fa433813320
Avoid writing to input reg in toHashableString r=iain

Comment 22

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/2fa433813320

Comment 23

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-beta/rev/4fe981bfc64b