Bug 2424231 - [abrt] firefox: js::jit::JitScript::profileString(): firefox killed by SIGSEGV
Summary: [abrt] firefox: js::jit::JitScript::profileString(): firefox killed by SIGSEGV
Keywords:
Status: NEW
Alias: None
Product: Fedora
Classification: Fedora
Component: firefox
Version: 43
Hardware: x86_64
OS: Linux
unspecified
unspecified
Target Milestone: ---
Assignee: Martin Stransky
QA Contact: Fedora Extras Quality Assurance
URL: https://retrace.fedoraproject.org/faf...
Whiteboard: abrt_hash:bbbedd4fbc9446b2c2faec3a013...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-12-21 23:34 UTC by Mr Beedell, Roke Julian Lockhart
Modified: 2025-12-21 23:36 UTC (History)
7 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Type: ---
Embargoed:


Attachments (Terms of Use)
File: proc_pid_status (1.50 KB, text/plain)
2025-12-21 23:34 UTC, Mr Beedell, Roke Julian Lockhart
no flags Details
File: maps (154.61 KB, text/plain)
2025-12-21 23:34 UTC, Mr Beedell, Roke Julian Lockhart
no flags Details
File: limits (1.29 KB, text/plain)
2025-12-21 23:34 UTC, Mr Beedell, Roke Julian Lockhart
no flags Details
File: environ (3.87 KB, text/plain)
2025-12-21 23:34 UTC, Mr Beedell, Roke Julian Lockhart
no flags Details
File: open_fds (10.03 KB, text/plain)
2025-12-21 23:34 UTC, Mr Beedell, Roke Julian Lockhart
no flags Details
File: os_info (712 bytes, text/plain)
2025-12-21 23:34 UTC, Mr Beedell, Roke Julian Lockhart
no flags Details
File: cpuinfo (3.76 KB, text/plain)
2025-12-21 23:34 UTC, Mr Beedell, Roke Julian Lockhart
no flags Details
File: core_backtrace (199.63 KB, text/plain)
2025-12-21 23:34 UTC, Mr Beedell, Roke Julian Lockhart
no flags Details
File: exploitable (81 bytes, text/plain)
2025-12-21 23:34 UTC, Mr Beedell, Roke Julian Lockhart
no flags Details
File: dso_list (10.21 KB, text/plain)
2025-12-21 23:34 UTC, Mr Beedell, Roke Julian Lockhart
no flags Details
File: backtrace (52.28 KB, text/plain)
2025-12-21 23:34 UTC, Mr Beedell, Roke Julian Lockhart
no flags Details


Links
System ID Private Priority Status Summary Last Updated
Red Hat Bugzilla 2424230 0 unspecified NEW [abrt] firefox: JS::Value::toPrivate(): firefox killed by SIGSEGV 2025-12-21 23:44:18 UTC

Description Mr Beedell, Roke Julian Lockhart 2025-12-21 23:34:30 UTC
Description of problem:
Per https://crash-stats.mozilla.org/report/index/e6252780-f26e-44c4-8cd9-a9fd00251221 and https://crash-stats.mozilla.org/report/index/d43a85be-351e-4506-8eb2-cb7e30251221, I `location.reload`'d every tab, with the performance profiler active. Because it SEGVs, probably the best profile that I am able to provide is https://share.firefox.dev/4j9ATb5.

Version-Release number of selected component:
firefox-146.0-3.fc43

Additional info:
reporter:       libreport-2.17.15
type:           CCpp
reason:         firefox killed by SIGSEGV
journald_cursor: s=c1f108f1ef4e48808a377c0a73f168fc;i=ff915b;b=5501e35729ce41878e5f237069022819;m=a448a4124;t=6467ea888fad6;x=de3f7a15a98e3254
executable:     /usr/lib64/firefox/firefox
cmdline:        $'/usr/lib64/firefox/firefox -contentproc -isForBrowser -prefsHandle 0:57427 -prefMapHandle 1:293178 -jsInitHandle 2:223356 -parentBuildID 20251211125526 -sandboxReporter 3 -chrootClient 4 -ipcHandle 5 -initialChannelId {c2daef98-4f53-4122-b2ba-49a84663700e} -parentPid 301940 -crashReporter 6 -crashHelper 7 -greomni /usr/lib64/firefox/omni.ja -appomni /usr/lib64/firefox/browser/omni.ja -appDir /usr/lib64/firefox/browser 100 tab'
cgroup:         0::/user.slice/user-1000.slice/user/app.slice/app-org.mozilla.firefox
rootdir:        /proc/328061/fdinfo
uid:            1000
mountinfo:      
kernel:         6.17.12-300.fc43.x86_64
package:        firefox-146.0-3.fc43
runlevel:       /bin/sh: line 1: runlevel: command not found
backtrace_rating: 4
crash_function: js::jit::JitScript::profileString
comment:        Per https://crash-stats.mozilla.org/report/index/e6252780-f26e-44c4-8cd9-a9fd00251221, I `location.reload`'d every tab, with the performance profiler active. Because it SEGVs, probably the best profile that I am able to provide is https://share.firefox.dev/4j9ATb5.

Truncated backtrace:
Thread no. 0 (12 frames)
 #0 js::jit::JitScript::profileString at /usr/src/debug/firefox-146.0-3.fc43.x86_64/js/src/jit/JitScript.h:420
 #1 js::jit::JSJitProfilingFrameIterator::baselineInterpreterLabel at /usr/src/debug/firefox-146.0-3.fc43.x86_64/js/src/jit/JSJitFrameIter.cpp:597
 #2 JS::ProfilingFrameIterator::getPhysicalFrameAndEntry at /usr/src/debug/firefox-146.0-3.fc43.x86_64/js/src/vm/Stack.cpp:721
 #3 JS::ProfilingFrameIterator::getPhysicalFrameWithoutLabel at /usr/src/debug/firefox-146.0-3.fc43.x86_64/js/src/vm/Stack.cpp:787
 #4 ExtractJsFrames at /usr/src/debug/firefox-146.0-3.fc43.x86_64/tools/profiler/core/platform.cpp:2301
 #5 DoSharedSample at /usr/src/debug/firefox-146.0-3.fc43.x86_64/tools/profiler/core/platform.cpp:3042
 #6 DoPeriodicSample at /usr/src/debug/firefox-146.0-3.fc43.x86_64/tools/profiler/core/platform.cpp:3119
 #7 operator() at /usr/src/debug/firefox-146.0-3.fc43.x86_64/tools/profiler/core/platform.cpp:4901
 #8 SuspendAndSampleAndResumeThread<SamplerThread::Run()::<lambda(const Registers&, const mozilla::TimeStamp&)> > at /usr/src/debug/firefox-146.0-3.fc43.x86_64/tools/profiler/core/platform-linux-android.cpp:466
 #9 SamplerThread::Run at /usr/src/debug/firefox-146.0-3.fc43.x86_64/tools/profiler/core/platform.cpp:4898
 #10 ThreadEntry at /usr/src/debug/firefox-146.0-3.fc43.x86_64/tools/profiler/core/platform-linux-android.cpp:505
 #11 set_alt_signal_stack_and_start at /usr/src/debug/firefox-146.0-3.fc43.x86_64/mozglue/interposers/pthread_create_interposer.cpp:81


Potential duplicate: bug 2395156

Comment 1 Mr Beedell, Roke Julian Lockhart 2025-12-21 23:34:34 UTC
Created attachment 2119588 [details]
File: proc_pid_status

Comment 2 Mr Beedell, Roke Julian Lockhart 2025-12-21 23:34:36 UTC
Created attachment 2119589 [details]
File: maps

Comment 3 Mr Beedell, Roke Julian Lockhart 2025-12-21 23:34:37 UTC
Created attachment 2119590 [details]
File: limits

Comment 4 Mr Beedell, Roke Julian Lockhart 2025-12-21 23:34:39 UTC
Created attachment 2119591 [details]
File: environ

Comment 5 Mr Beedell, Roke Julian Lockhart 2025-12-21 23:34:41 UTC
Created attachment 2119592 [details]
File: open_fds

Comment 6 Mr Beedell, Roke Julian Lockhart 2025-12-21 23:34:42 UTC
Created attachment 2119593 [details]
File: os_info

Comment 7 Mr Beedell, Roke Julian Lockhart 2025-12-21 23:34:43 UTC
Created attachment 2119594 [details]
File: cpuinfo

Comment 8 Mr Beedell, Roke Julian Lockhart 2025-12-21 23:34:45 UTC
Created attachment 2119595 [details]
File: core_backtrace

Comment 9 Mr Beedell, Roke Julian Lockhart 2025-12-21 23:34:46 UTC
Created attachment 2119596 [details]
File: exploitable

Comment 10 Mr Beedell, Roke Julian Lockhart 2025-12-21 23:34:47 UTC
Created attachment 2119597 [details]
File: dso_list

Comment 11 Mr Beedell, Roke Julian Lockhart 2025-12-21 23:34:49 UTC
Created attachment 2119598 [details]
File: backtrace

Comment 12 Mr Beedell, Roke Julian Lockhart 2025-12-21 23:35:34 UTC
Might vaguely relate to https://bugzilla.redhat.com/show_bug.cgi?id=2424230#c0.


Note You need to log in before you can comment on or make changes to this bug.