Bug 2196705 - firefox-113.0-1.fc39 crashes on startup [@ core::sync::atomic::atomic_load<usize>]
Summary: firefox-113.0-1.fc39 crashes on startup [@ core::sync::atomic::atomic_load<us...
Keywords:
Status: CLOSED RAWHIDE
Alias: None
Product: Fedora
Classification: Fedora
Component: firefox
Version: rawhide
Hardware: x86_64
OS: Linux
unspecified
urgent
Target Milestone: ---
Assignee: Gecko Maintainer
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: openqa
: 2203248 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2023-05-09 23:44 UTC by Adam Williamson
Modified: 2023-05-31 01:11 UTC (History)
15 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2023-05-31 01:11:45 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)
backtrace of the crash (crashing thread only, gdb fails to generate an all thread bt) (38.66 KB, text/plain)
2023-05-09 23:45 UTC, Adam Williamson
no flags Details


Links
System ID Private Priority Status Summary Last Updated
Github rust-lang rust issues 111229 0 None open mutable_transmutes lint should catch transmutes from a type without interior mutability to one with 2023-05-15 16:01:08 UTC
Github rust-lang rust issues 111507 0 None open Building rust 1.69.0 with LLVM 16, then using that to build firefox 113, results in a crash on startup 2023-05-15 16:01:08 UTC
Mozilla Foundation 1831242 0 -- NEW [rust 1.70] browser/extensions/formautofill/test/unit/heuristics/test_autocomplete_off_on_inputs.js | application crashe... 2023-05-15 16:01:08 UTC

Description Adam Williamson 2023-05-09 23:44:59 UTC
The new build of Firefox (firefox-113.0-1.fc39) crashes immediately on startup, on GNOME and KDE and directly on top of with `startx`, in openQA and in local testing on my laptop.

Reproducible: Always

Steps to Reproduce:
1. Update to firefox-113.0-1.fc39
2. Launch Firefox
Actual Results:  
The window never appears, Firefox crashes immediately.

Expected Results:  
Firefox should run.

See attached backtrace.

Comment 1 Adam Williamson 2023-05-09 23:45:38 UTC
Created attachment 1963636 [details]
backtrace of the crash (crashing thread only, gdb fails to generate an all thread bt)

Comment 2 Adam Williamson 2023-05-09 23:47:50 UTC
Requested it be untagged from f39 for now: https://pagure.io/releng/issue/11421

Comment 3 Martin Stransky 2023-05-10 07:09:13 UTC
Crashes in Rust code.

Comment 4 Matt Fagnani 2023-05-11 02:24:16 UTC
I saw firefox-113.0-1.fc39 crash when starting in Fedora-KDE-Live-x86_64-Rawhide-20230509.n.0.iso with the same kind of trace. rust-1.69.0-3.fc39 looks to have been rebuilt with llvm-16.0.2-1.fc39 by https://src.fedoraproject.org/rpms/rust/c/777115da9e2892eb47502c8afcbe2b7742b14879?branch=rawhide Since the crash doesn't happen with firefox-113.0-1.fc38 where rust-1.69.0-2.fc38 was rebuilt with llvm 15.0.7 and the crash involved Rust, there might be some problem with rust-1.69.0-3.fc39 and llvm 16.0.2.

Comment 5 Martin Stransky 2023-05-11 06:39:16 UTC
Tentatively moving to Rust to get compiler people in touch.

Comment 6 Josh Stone 2023-05-11 20:39:00 UTC
This doesn't narrow down much, but according the backtrace, the atomic_load is getting a bogus pointer 0x1:

#5  core::sync::atomic::atomic_load<usize> (dst=0x1, order=core::sync::atomic::Ordering::Relaxed) at /builddir/build/BUILD/rustc-1.69.0-src/library/core/src/sync/atomic.rs:3160
No locals.
#6  core::sync::atomic::AtomicUsize::load (self=0x1, order=core::sync::atomic::Ordering::Relaxed) at /builddir/build/BUILD/rustc-1.69.0-src/library/core/src/sync/atomic.rs:2263
No locals.
#7  servo_arc::{impl#10}::clone<indexmap::map::IndexMap<style::gecko_string_cache::Atom, servo_arc::Arc<style::custom_properties::VariableValue>, core::hash::BuildHasherDefault<style::selector_map::PrecomputedHasher>>> (self=0x7fa1840bc950) at servo/components/servo_arc/lib.rs:402
        old_size = <optimized out>

That &self (&Arc) looks plausible, but then that should contains a pointer to the heap-allocated `ArcInner`, which starts with the atomic counter in question.

Comment 7 Fabio Valentini 2023-05-11 21:28:30 UTC
Note that this isn't a standard Arc but a custom fork of the one from the standard library ... Which is also separately packaged for Fedora as "rust-servo_arc": https://github.com/servo/servo/tree/master/components/servo_arc (not sure if this is still the same one used by Firefox)

Comment 8 Martin Stransky 2023-05-12 06:44:40 UTC
*** Bug 2203248 has been marked as a duplicate of this bug. ***

Comment 9 Adam Williamson 2023-05-15 15:32:32 UTC
Same with 113.0.1, I will need to get that untagged too. Can we maybe set Firefox to build with LLVM 15 for now on Rawhide, if that will fix this, so its Firefox doesn't get really old?

Comment 10 Josh Stone 2023-05-15 16:01:09 UTC
Linked a few bugs -- the two Rust bugs provide context, but per the Mozilla bug this is really a Firefox issue. It looks like there are a few fixes available, so perhaps you can backport those?

Comment 11 Martin Stransky 2023-05-15 19:19:21 UTC
Thanks, will look at it.

Comment 12 Adam Williamson 2023-05-16 16:40:04 UTC
firefox-113.0.1-2.fc39 is still broken, looks like it was built by someone else who maybe wasn't aware of this. jgrulich, please don't build Firefox for Rawhide until this is addressed somehow - every time it gets built ATM we have to untag it because it doesn't work.

Comment 13 Josh Stone 2023-05-31 00:59:18 UTC
Is this resolved in firefox-113.0.1-4.fc39? I see that it has survived almost a week without getting untagged...

(Rust 1.70 comes out this week, and I would like to let f38 go back to llvm-16 as well in the new builds.)

Comment 14 Adam Williamson 2023-05-31 01:11:45 UTC
ah, yes, it seems to be. The changelog indicates it:

- Added patches from 113.0.2
- Added Rust fix for Rawhide (mzbz#1831242).

and openQA tests are passing. Martin did apply the same patches to f38 Firefox, it seems, so it should be OK to put llvm-16 in f38 too.


Note You need to log in before you can comment on or make changes to this bug.