Bug 1779082

Summary: Firefox 71.0 crashes when build with PGO
Product: [Fedora] Fedora Reporter: Martin Stransky <stransky>
Component: firefoxAssignee: Martin Stransky <stransky>
Status: CLOSED DUPLICATE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 31CC: 0xalen+redhat, anto.trande, balay, gecko-bugs-nobody, guillaume, jayjayjazz, jhorak, john.j5live, kengert, mihai, mildred-bug.redhat, pjasicek, rhughes, rstrode, sandmann, tsmetana, tstellar
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-12-10 09:27:41 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Martin Stransky 2019-12-03 09:14:25 UTC 
Description of problem:
Firefox 71.0 crashes when build with PGO

Version-Release number of selected component (if applicable):
71.0

Seems to be 71.0 issue only, 70.0 works ok. Both are built with gcc-9.2.1-1.fc31 so it does not look like a gcc regression.

backtrace:
(gdb) bt
#0  NS_ABORT_OOM(unsigned long) (aSize=3661620918) at /usr/src/debug/firefox-71.0-7.fc31.x86_64/xpcom/base/nsDebugImpl.cpp:604
#1  0x00007ffff03ee48c in nsTSubstring<char>::AllocFailed(unsigned long) (aLength=<optimized out>, this=0x7fffda3fe800)
    at /usr/src/debug/firefox-71.0-7.fc31.x86_64/xpcom/string/nsTSubstring.h:1105
#2  nsTSubstring<char>::Assign(nsTSubstringTuple<char> const&) (this=0x7fffda3fe800, aTuple=...) at /usr/src/debug/firefox-71.0-7.fc31.x86_64/xpcom/string/nsTSubstring.cpp:547
#3  0x00007ffff2f05618 in nsTAutoStringN<char, 64ul>::nsTAutoStringN(nsTSubstringTuple<char> const&) (aTuple=..., this=0x7fffda3fe800, this=<optimized out>, aTuple=...)
    at /usr/src/debug/firefox-71.0-7.fc31.x86_64/objdir/dist/include/nsTSubstring.h:1349
#4  mozilla::dom::indexedDB::(anonymous namespace)::Cursor::OpenOp::DoIndexKeyDatabaseWork(mozilla::dom::indexedDB::(anonymous namespace)::DatabaseConnection*)
    (this=0x7fffd7d13760, aConnection=0x7fffd8532100) at /usr/src/debug/firefox-71.0-7.fc31.x86_64/dom/indexedDB/ActorsParent.cpp:26222
#5  0x00007ffff2f05299 in mozilla::dom::indexedDB::(anonymous namespace)::Cursor::OpenOp::DoDatabaseWork(mozilla::dom::indexedDB::(anonymous namespace)::DatabaseConnection*)
    (this=0x7fffd7d13760, aConnection=0x7fffd8532100) at /usr/src/debug/firefox-71.0-7.fc31.x86_64/dom/indexedDB/ActorsParent.cpp:26326
#6  0x00007ffff2ef3d27 in mozilla::dom::indexedDB::(anonymous namespace)::TransactionDatabaseOperationBase::RunOnConnectionThread() (this=0x7fffd7d13760)
    at /usr/src/debug/firefox-71.0-7.fc31.x86_64/dom/indexedDB/ActorsParent.cpp:21971
#7  0x00007ffff2ef38ee in mozilla::dom::indexedDB::(anonymous namespace)::TransactionDatabaseOperationBase::Run() (this=0x7fffd7d13760)
    at /usr/src/debug/firefox-71.0-7.fc31.x86_64/dom/indexedDB/ActorsParent.cpp:22136
#8  0x00007ffff25a067d in nsThread::ProcessNextEvent(bool, bool*) (this=0x7fffd947d280, aMayWait=<optimized out>, aResult=<optimized out>)
    at /usr/src/debug/firefox-71.0-7.fc31.x86_64/xpcom/threads/nsThread.cpp:1225
#9  0x00007ffff259f4e0 in NS_ProcessNextEvent(nsIThread*, bool) (aThread=<optimized out>, aMayWait=<optimized out>)
    at /usr/src/debug/firefox-71.0-7.fc31.x86_64/xpcom/threads/nsThreadUtils.cpp:486
#10 0x00007ffff2ef385a in mozilla::SpinEventLoopUntil<> (aThread=0x0, aPredicate=...) at /usr/src/debug/firefox-71.0-7.fc31.x86_64/objdir/dist/include/mozilla/ThreadLocal.h:201
#11 mozilla::dom::indexedDB::(anonymous namespace)::ConnectionPool::ThreadRunnable::Run (this=0x7fffd944d1a0)
    at /usr/src/debug/firefox-71.0-7.fc31.x86_64/dom/indexedDB/ActorsParent.cpp:12003
#12 mozilla::dom::indexedDB::(anonymous namespace)::ConnectionPool::ThreadRunnable::Run() (this=0x7fffd944d1a0)
    at /usr/src/debug/firefox-71.0-7.fc31.x86_64/dom/indexedDB/ActorsParent.cpp:11965
#13 0x00007ffff25a067d in nsThread::ProcessNextEvent(bool, bool*) (this=0x7fffd947d280, aMayWait=<optimized out>, aResult=<optimized out>)
    at /usr/src/debug/firefox-71.0-7.fc31.x86_64/xpcom/threads/nsThread.cpp:1225
#14 0x00007ffff259ebce in NS_ProcessNextEvent(nsIThread*, bool) (aMayWait=true, aThread=0x7fffd947d280) at /usr/src/debug/firefox-71.0-7.fc31.x86_64/xpcom/threads/nsThreadUtils.cpp:486
#15 mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) (this=0x7fffd9564cc0, aDelegate=0x7fffd944e740)
    at /usr/src/debug/firefox-71.0-7.fc31.x86_64/ipc/glue/MessagePump.cpp:333
#16 0x00007ffff252f3c5 in MessageLoop::RunInternal() (this=<optimized out>) at /usr/src/debug/firefox-71.0-7.fc31.x86_64/objdir/dist/include/mozilla/RefPtr.h:305
#17 MessageLoop::RunHandler() (this=<optimized out>) at /usr/src/debug/firefox-71.0-7.fc31.x86_64/ipc/chromium/src/base/message_loop.cc:308
#18 MessageLoop::Run() (this=<optimized out>) at /usr/src/debug/firefox-71.0-7.fc31.x86_64/ipc/chromium/src/base/message_loop.cc:290
#19 0x00007ffff259c427 in nsThread::ThreadFunc(void*) (aArg=<optimized out>) at /usr/src/debug/firefox-71.0-7.fc31.x86_64/xpcom/threads/nsThread.cpp:458
#20 0x00007ffff77e8b34 in _pt_root () at /lib64/libnspr4.so
#21 0x00007ffff7f824e2 in start_thread () at /lib64/libpthread.so.0
#22 0x00007ffff7b50693 in clone () at /lib64/libc.so.6
Comment 1 JayJayJazz 2019-12-03 10:48:49 UTC 
Confirmed for Fedora 31:
firefox-71.0-7.fc31.x86_64: Crashes on Startup
firefox-71.0-8.npgo.fc31.x86_64: Works fine.

Used Kernel: 5.3.13-300.fc31.x86_64
NSPR: 4.23
NSS: 3.47.1
Comment 2 Mildred 2019-12-10 08:44:10 UTC 
Note: this bug also seems to cause problems with some extensions as evidenced by the following bug reports that links to this one:

- https://bugzilla.mozilla.org/show_bug.cgi?id=1601424
- https://github.com/passff/passff/issues/427
Comment 3 Martin Stransky 2019-12-10 09:27:41 UTC 
This is a dupe of Bug 1779570:

*** This bug has been marked as a duplicate of bug 1779570 ***
Comment 4 Martin Stransky 2019-12-10 09:28:28 UTC 
Fixed builds are here:

https://koji.fedoraproject.org/koji/buildinfo?buildID=1420745
https://koji.fedoraproject.org/koji/buildinfo?buildID=1420744

Bodhi updates can't be submitted due to https://github.com/fedora-infra/bodhi/issues/3843
Comment 5 Jens Petersen 2019-12-11 06:02:17 UTC 
BTW I think you can paste the nvr's manually into Bodhi web.
Comment 6 Martin Stransky 2019-12-11 07:37:06 UTC 
(In reply to Jens Petersen from comment #5)
> BTW I think you can paste the nvr's manually into Bodhi web.

That doesn't work for me, the same result (build not found).