Bug 2390798

Summary:

[abrt] firefox: JS::Value::toPrivate(): firefox killed by SIGSEGV

Product:

[Fedora] Fedora

Reporter:

Mr Beedell, Roke Julian Lockhart <8ru2u4gz>

Component:

firefox

Assignee:

Gecko Maintainer <gecko-bugs-nobody>

Status:

NEW ---

QA Contact:

Fedora Extras Quality Assurance <extras-qa>

Severity:

unspecified

Docs Contact:

Priority:

unspecified

Version:

CC:

8ru2u4gz, gecko-bugs-nobody, jhorak, klaas, rstrode, suraj.ghimire7

Target Milestone:

---

Target Release:

---

Hardware:

x86_64

OS:

Linux

URL:

https://retrace.fedoraproject.org/faf/reports/bthash/8244652c7771edc39ede47ae4ac8947e885fe5c

Whiteboard:

abrt_hash:733c116641959701d6a130d933679bfbbb630f45;VARIANT_ID=kde;

Fixed In Version:

Doc Type:

---

Doc Text:

Story Points:

---

Clone Of:

Environment:

Last Closed:

Type:

---

Regression:

---

Mount Type:

---

Documentation:

---

CRM:

Verified Versions:

Category:

---

oVirt Team:

---

RHEL 7.3 requirements from Atomic Host:

Cloudforms Team:

---

Target Upstream Version:

Embargoed:

Attachments:

Description	Flags
File: proc_pid_status	none
File: maps	none
File: limits	none
File: environ	none
File: open_fds	none
File: mountinfo	none
File: os_info	none
File: cpuinfo	none
File: core_backtrace	none
File: exploitable	none
File: dso_list	none
File: backtrace	none

Description Mr Beedell, Roke Julian Lockhart 2025-08-25 15:08:46 UTC

Description of problem:
Per https://crash-stats.mozilla.org/report/index/9d1f5381-0b46-4c4a-b3cb-1b46e0250825, this occurred when:

1. After leaving `firefox --safe-mode` open (to diagnose https://github.com/orgs/community/discussions/145060#discussioncomment-14211524), it began to seriously slow.

2. I'd, consequently, invoked the performance profiler, to debug it.

This caused restored tabs to crash. Soon thereafter, when switching between them, the browser itself crashed, per this report. In the shell, I saw:

> ~~~
> RokeJulianLockhart@Beedell:~$ firefox --safe-mode
> [GFX1-]: RenderCompositorSWGL failed mapping default framebuffer, no dt
> [15682] Sandbox: attempt to open unexpected file /sys/fs/cgroup/cpuset/chrome
> [15682] Sandbox: attempt to open unexpected file /sys/fs/cgroup/schedtune/chrome
> [Parent 14609, IPC I/O Parent] WARNING: process 17621 exited on signal 11: file /builddir/build/BUILD/firefox-142.0-build/firefox-142.0/ipc/chromium/src/chrome/common/process_watcher_posix_sigchld.cc:134
> ExceptionHandler::GenerateDump attempting to generate:/home/RokeJulianLockhart/.mozilla/firefox/rop4k06n.default-release/minidumps/02837ae7-a7f9-a77c-ecc8-ee495da3915b.dmp
> ExceptionHandler::GenerateDump cloned child 17861
> ExceptionHandler::SendContinueSignalToChild sent continue signal to child
> ExceptionHandler::WaitForContinueSignal waiting for continue signal...
> ExceptionHandler::GenerateDump minidump generation succeeded
> Exiting due to channel error.
> Exiting due to channel error.
> Exiting due to channel error.
> Exiting due to channel error.
> Exiting due to channel error.
> Exiting due to channel error.
> Exiting due to channel error.
> Exiting due to channel error.
> Exiting due to channel error.
> Exiting due to channel error.
> Exiting due to channel error.
> Exiting due to channel error.
> Exiting due to channel error.
> Exiting due to channel error.
> Exiting due to channel error.
> Exiting due to channel error.
> Exiting due to channel error.
> Exiting due to channel error.
> Exiting due to channel error.
> Exiting due to channel error.
> Exiting due to channel error.
> ~~~

Those logs are similar to those from https://bugzilla.mozilla.org/show_bug.cgi?id=1984438#c0. The profile that caused it to crash was, obviously, lost. However, another is available at https://share.firefox.dev/47Nd1q5 that demonstrates the problem, because it always recurs after a little time, with `--safe-mode` active.

Considering that it crashed with a `SIGSEGV`, is this a memory leak?

Version-Release number of selected component:
firefox-142.0-1.fc42

Additional info:
reporter:       libreport-2.17.15
type:           CCpp
reason:         firefox killed by SIGSEGV
journald_cursor: s=a2d6d580caa24cf3a9483be7f85033e4;i=25bc83;b=f391f02e28b2479ba8ac367a12640530;m=916554f5;t=63d3192dfc9cf;x=4acbc19e1930c15f
executable:     /usr/lib64/firefox/firefox
cmdline:        $'/usr/lib64/firefox/firefox -contentproc -isForBrowser -prefsHandle 0:49203 -prefMapHandle 1:281132 -safeMode -parentBuildID 20250818081258 -sandboxReporter 2 -chrootClient 3 -ipcHandle 4 -initialChannelId {0a210ce2-cdbe-4dd3-abb1-3a82bdcca5a3} -parentPid 14609 -crashReporter 5 -crashHelper 6 -greomni /usr/lib64/firefox/omni.ja -appomni /usr/lib64/firefox/browser/omni.ja -appDir /usr/lib64/firefox/browser 42 tab'
cgroup:         0::/user.slice/user-1000.slice/user/app.slice/app-org.kde.konsole
rootdir:        /
uid:            1000
kernel:         6.15.10-200.fc42.x86_64
package:        firefox-142.0-1.fc42
runlevel:       N 5
backtrace_rating: 4
crash_function: JS::Value::toPrivate

Truncated backtrace:
Thread no. 1 (19 frames)
 #0 JS::Value::toPrivate at /usr/src/debug/firefox-142.0-1.fc42.x86_64/objdir/dist/include/js/Value.h:1001
 #1 JSFunction::nativeJitInfoOrInterpretedScript at /usr/src/debug/firefox-142.0-1.fc42.x86_64/js/src/vm/JSFunction.h:521
 #2 JSFunction::baseScript at /usr/src/debug/firefox-142.0-1.fc42.x86_64/js/src/vm/JSFunction.h:554
 #3 JSFunction::nonLazyScript at /usr/src/debug/firefox-142.0-1.fc42.x86_64/js/src/vm/JSFunction.h:542
 #4 ScriptFromCalleeToken at /usr/src/debug/firefox-142.0-1.fc42.x86_64/js/src/jit/ScriptFromCalleeToken.h:24
 #5 js::jit::JSJitProfilingFrameIterator::frameScript at /usr/src/debug/firefox-142.0-1.fc42.x86_64/js/src/jit/JSJitFrameIter-inl.h:41
 #6 js::jit::JSJitProfilingFrameIterator::tryInitWithPC at /usr/src/debug/firefox-142.0-1.fc42.x86_64/js/src/jit/JSJitFrameIter.cpp:503
 #7 js::jit::JSJitProfilingFrameIterator::JSJitProfilingFrameIterator at /usr/src/debug/firefox-142.0-1.fc42.x86_64/js/src/jit/JSJitFrameIter.cpp:448
 #8 JS::ProfilingFrameIterator::iteratorConstruct at /usr/src/debug/firefox-142.0-1.fc42.x86_64/js/src/vm/Stack.cpp:571
 #9 JS::ProfilingFrameIterator::ProfilingFrameIterator at /usr/src/debug/firefox-142.0-1.fc42.x86_64/js/src/vm/Stack.cpp:489
 #10 ExtractJsFrames at /usr/src/debug/firefox-142.0-1.fc42.x86_64/tools/profiler/core/platform.cpp:2244
 #11 DoSharedSample at /usr/src/debug/firefox-142.0-1.fc42.x86_64/tools/profiler/core/platform.cpp:2995
 #12 DoPeriodicSample at /usr/src/debug/firefox-142.0-1.fc42.x86_64/tools/profiler/core/platform.cpp:3072
 #13 operator() at /usr/src/debug/firefox-142.0-1.fc42.x86_64/tools/profiler/core/platform.cpp:4841
 #14 SuspendAndSampleAndResumeThread<SamplerThread::Run()::<lambda(const Registers&, const mozilla::TimeStamp&)> > at /usr/src/debug/firefox-142.0-1.fc42.x86_64/tools/profiler/core/platform-linux-android.cpp:467
 #15 SamplerThread::Run at /usr/src/debug/firefox-142.0-1.fc42.x86_64/tools/profiler/core/platform.cpp:4838
 #16 ThreadEntry at /usr/src/debug/firefox-142.0-1.fc42.x86_64/tools/profiler/core/platform-linux-android.cpp:506
 #17 set_alt_signal_stack_and_start at /usr/src/debug/firefox-142.0-1.fc42.x86_64/mozglue/interposers/pthread_create_interposer.cpp:81
 #19 __clone3 at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78


Potential duplicate: bug 2312360

Comment 1 Mr Beedell, Roke Julian Lockhart 2025-08-25 15:08:50 UTC

Created attachment 2104676 [details]
File: proc_pid_status

Comment 2 Mr Beedell, Roke Julian Lockhart 2025-08-25 15:08:52 UTC

Created attachment 2104677 [details]
File: maps

Comment 3 Mr Beedell, Roke Julian Lockhart 2025-08-25 15:08:53 UTC

Created attachment 2104678 [details]
File: limits

Comment 4 Mr Beedell, Roke Julian Lockhart 2025-08-25 15:08:54 UTC

Created attachment 2104679 [details]
File: environ

Comment 5 Mr Beedell, Roke Julian Lockhart 2025-08-25 15:08:55 UTC

Created attachment 2104680 [details]
File: open_fds

Comment 6 Mr Beedell, Roke Julian Lockhart 2025-08-25 15:08:57 UTC

Created attachment 2104681 [details]
File: mountinfo

Comment 7 Mr Beedell, Roke Julian Lockhart 2025-08-25 15:08:58 UTC

Created attachment 2104682 [details]
File: os_info

Comment 8 Mr Beedell, Roke Julian Lockhart 2025-08-25 15:08:59 UTC

Created attachment 2104683 [details]
File: cpuinfo

Comment 9 Mr Beedell, Roke Julian Lockhart 2025-08-25 15:09:01 UTC

Created attachment 2104684 [details]
File: core_backtrace

Comment 10 Mr Beedell, Roke Julian Lockhart 2025-08-25 15:09:03 UTC

Created attachment 2104685 [details]
File: exploitable

Comment 11 Mr Beedell, Roke Julian Lockhart 2025-08-25 15:09:04 UTC

Created attachment 2104686 [details]
File: dso_list

Comment 12 Mr Beedell, Roke Julian Lockhart 2025-08-25 15:09:06 UTC

Created attachment 2104687 [details]
File: backtrace

Comment 13 Mr Beedell, Roke Julian Lockhart 2025-08-27 23:39:52 UTC

See https://bugzilla.mozilla.org/show_bug.cgi?id=1985672#c0.

Comment 14 Fedora Release Engineering 2026-05-06 13:54:01 UTC

This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this bug will be closed as EOL if it remains open with a
'version' of '42'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, change the 'version' 
to a later Fedora Linux version. Note that the version field may be hidden.
Click the "Show advanced fields" button if you do not see it.

Thank you for reporting this issue and we are sorry that we were not 
able to fix it before Fedora Linux 42 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora Linux, you are encouraged to change the 'version' to a later version
prior to this bug being closed.

Comment 15 Mr Beedell, Roke Julian Lockhart 2026-05-06 20:41:11 UTC

As in https://bugzilla.redhat.com/show_bug.cgi?id=2391475#c14.