Date: Wed, 15 Nov 2023 20:19:32 +0000 From: bugzilla-noreply@freebsd.org To: gecko@FreeBSD.org Subject: [Bug 271081] www/firefox: crashes on arm64 with ASLR enabled Message-ID: <bug-271081-21738-PfGA4FSG7m@https.bugs.freebsd.org/bugzilla/> In-Reply-To: <bug-271081-21738@https.bugs.freebsd.org/bugzilla/> References: <bug-271081-21738@https.bugs.freebsd.org/bugzilla/>
next in thread | previous in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D271081 Jesper Schmitz Mouridsen <jsm@FreeBSD.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jsm@FreeBSD.org --- Comment #6 from Jesper Schmitz Mouridsen <jsm@FreeBSD.org> --- (In reply to Nuno Teixeira from comment #5) lldb attached to tab proccess (use MOZ_DEBUG_CHILD_PROCESS=3D20) the number= is seconds.. output also in [1]=20 frame #0: 0x000008a54e146010 -> 0x8a54e146010: sub sp, x28, #0x8 0x8a54e146014: str x30, [x28, #-0x8]! 0x8a54e146018: sub sp, x28, #0x8 0x8a54e14601c: str x29, [x28, #-0x8]! (lldb) bt * thread #1, name =3D 'WebExtensions', stop reason =3D signal SIGILL: illeg= al trap * frame #0: 0x000008a54e146010 frame #1: 0x000008a54e1167a0 frame #2: 0x000000004a0b6db4 libxul.so`js::jit::MaybeEnterJit(JSContext= *, js::RunState&) + 576 frame #3: 0x0000000049a0e4c4 libxul.so`js::RunScript(JSContext*, js::RunState&) + 604 frame #4: 0x0000000049a0e8e4 libxul.so`js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) + 1036 frame #5: 0x0000000049a0ed80 libxul.so`js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) + 212 frame #6: 0x0000000049a698a0 libxul.so`JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) + 236 frame #7: 0x0000000046f8f254 libxul.so`mozilla::dom::MessageListener::ReceiveMessage(mozilla::dom::Bindi= ngCallContext&, JS::Handle<JS::Value>, mozilla::dom::ReceiveMessageArgument const&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) + 788 frame #8: 0x000000004874d3fc libxul.so`mozilla::dom::JSActor::CallReceiveMessage(JSContext*, mozilla::dom::JSActorMessageMeta const&, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) + 496 frame #9: 0x000000004874d688 libxul.so`mozilla::dom::JSActor::ReceiveMessage(JSContext*, mozilla::dom::JSActorMessageMeta const&, JS::Handle<JS::Value>, mozilla::ErrorResult&) + 252 frame #10: 0x000000004874fb50 libxul.so`mozilla::dom::JSActorManager::ReceiveRawMessage(mozilla::dom::JSA= ctorMessageMeta const&, mozilla::Maybe<mozilla::dom::ipc::StructuredCloneData>&&, mozilla::Maybe<mozilla::dom::ipc::StructuredCloneData>&&) + 704 frame #11: 0x0000000048652e00 libxul.so`mozilla::dom::WindowGlobalChild::RecvRawMessage(mozilla::dom::JSA= ctorMessageMeta const&, mozilla::Maybe<mozilla::dom::ClonedMessageData> const&, mozilla::Maybe<mozilla::dom::ClonedMessageData> const&) + 368 frame #12: 0x000000004873d910 libxul.so`mozilla::dom::PWindowGlobalChild::OnMessageReceived(IPC::Message const&) + 4140 frame #13: 0x00000000486bfaa0 libxul.so`mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const= &) + 700 frame #14: 0x00000000464cdf50 libxul.so`mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::= ActorLifecycleProxy*, IPC::Message const&) + 200 frame #15: 0x00000000464cd090 libxul.so`mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::Actor= LifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message>>) + 3= 24 frame #16: 0x00000000464cd408 libxul.so`mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifec= ycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) + 264 frame #17: 0x00000000464cd8fc libxul.so`mozilla::ipc::MessageChannel::MessageTask::Run() + 148 frame #18: 0x0000000045f607f4 libxul.so`mozilla::RunnableTask::Run() + = 32 frame #19: 0x0000000045f5dc14 libxul.so`mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(= mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) + 1600 frame #20: 0x0000000045f5cc20 libxul.so`mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mo= zilla::detail::BaseAutoLock<mozilla::Mutex&> const&) + 52 frame #21: 0x0000000045f5ced0 libxul.so`mozilla::TaskController::ProcessPendingMTTask(bool) + 80 frame #22: 0x0000000045f62dc8 libxul.so`mozilla::detail::RunnableFunction<mozilla::TaskController::TaskCo= ntroller()::$_4>::Run() + 24 frame #23: 0x0000000045f7060c libxul.so`nsThread::ProcessNextEvent(bool, bool*) + 968 frame #24: 0x0000000045f74d2c libxul.so`NS_ProcessNextEvent(nsIThread*, bool) + 92 frame #25: 0x00000000464d092c libxul.so`mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) + 232 frame #26: 0x00000000464874d8 libxul.so`MessageLoop::Run() + 92 frame #27: 0x0000000048ab4aa8 libxul.so`nsBaseAppShell::Run() + 48 frame #28: 0x0000000049941c64 libxul.so`XRE_RunAppShell() + 100 frame #29: 0x00000000464874d8 libxul.so`MessageLoop::Run() + 92 frame #30: 0x0000000049941a20 libxul.so`XRE_InitChildProcess(int, char*= *, XREChildData const*) + 1184 frame #31: 0x0000000000132574 firefox-bin`main + 780 frame #32: 0x0000000040500578 libc.so.7`__libc_start1(argc=3D22, argv=3D0x0000ffffffffe5d8, env=3D0x0000ffffffffe690, cleanup=3D<unavailable= >, mainX=3D(firefox-bin`main)) at libc_start1.c:157:7 frame #33: 0x0000000000132134 firefox-bin`_start at crt1_s.S:60 [1] https://gist.github.com/jsm222/e6199a03142f5716921c82c3d2f3ddc5 --=20 You are receiving this mail because: You are on the CC list for the bug. You are the assignee for the bug.=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-271081-21738-PfGA4FSG7m>