[Bug 271081] firefox crashes on arm64 with ASLR enabled

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=271081

            Bug ID: 271081
           Summary: firefox crashes on arm64 with ASLR enabled
           Product: Base System
           Version: CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: kern
          Assignee: bugs@FreeBSD.org
          Reporter: markj@FreeBSD.org

firefox crashes very readily on arm64 whereas it seems to be fine on amd64. 
The backtrace looks like this, we appear to be segfaulting in
js::gc::MapAlignedPages():

(gdb) bt
#0  thr_kill () at thr_kill.S:4
#1  0x00005c284cb2cbc8 in __raise (s=11) at
/root/freebsd/lib/libc/gen/raise.c:52
#2  0x00005c2884a6e2b4 in nsProfileLock::FatalSignalHandler(int, __siginfo*,
void*) () at /usr/local/lib/firefox/libxul.so
#3  0x00005c288536b408 in WasmTrapHandler(int, __siginfo*, void*) () at
/usr/local/lib/firefox/libxul.so
#4  0x00005c284d6397e8 in handle_signal (actp=actp@entry=0x5c295553a460,
sig=sig@entry=11, info=info@entry=0x5c295553a4d0, ucp=ucp@entry=0x5c295553a520)
at /root/freebsd/lib/libthr/thread/thr_sig.c:301
#5  0x00005c284d638f14 in thr_sighandler (sig=11, info=0x5c295553a4d0,
_ucp=0x5c295553a520) at /root/freebsd/lib/libthr/thread/thr_sig.c:246
#6  0x00005c28490ad1a8 in <signal handler called> ()
#7  0x00005c2884f3e27c in js::gc::MapAlignedPages(unsigned long, unsigned long)
() at /usr/local/lib/firefox/libxul.so
#8  0x00005c2884f18f28 in
js::gc::GCRuntime::getOrAllocChunk(js::AutoLockGCBgAlloc&) () at
/usr/local/lib/firefox/libxul.so
#9  0x00005c2884f45a04 in js::Nursery::initFirstChunk(js::AutoLockGCBgAlloc&)
() at /usr/local/lib/firefox/libxul.so
#10 0x00005c2884f22d78 in js::gc::GCRuntime::init(unsigned int) () at
/usr/local/lib/firefox/libxul.so
#11 0x00005c2884c9e4f8 in JSRuntime::init(JSContext*, unsigned int) () at
/usr/local/lib/firefox/libxul.so
#12 0x00005c2884c01764 in js::NewContext(unsigned int, JSRuntime*) () at
/usr/local/lib/firefox/libxul.so
#13 0x00005c2880f67d08 in
mozilla::CycleCollectedJSContext::Initialize(JSRuntime*, unsigned int) () at
/usr/local/lib/firefox/libxul.so
#14 0x00005c288386bb24 in mozilla::dom::workerinternals::(anonymous
namespace)::WorkerThreadPrimaryRunnable::Run() () at
/usr/local/lib/firefox/libxul.so
#15 0x00005c28810105d8 in nsThread::ProcessNextEvent(bool, bool*) () at
/usr/local/lib/firefox/libxul.so
#16 0x00005c2881014cac in NS_ProcessNextEvent(nsIThread*, bool) () at
/usr/local/lib/firefox/libxul.so
#17 0x00005c288156a6b8 in
mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*)
() at /usr/local/lib/firefox/libxul.so
#18 0x00005c288152029c in MessageLoop::Run() () at
/usr/local/lib/firefox/libxul.so
#19 0x00005c288100df98 in nsThread::ThreadFunc(void*) () at
/usr/local/lib/firefox/libxul.so
#20 0x00005c2889bd5dd8 in  () at /usr/local/lib/libnspr4.so
#21 0x00005c284d62f5ec in thread_start (curthread=0x5c2941fced00) at
/root/freebsd/lib/libthr/thread/thr_create.c:292
#22 0x00005c284d62f148 in _pthread_create (thread=0x5c2848f3c2a8,
attr=<optimized out>, start_routine=<optimized out>, arg=<optimized out>) at
/root/freebsd/lib/libthr/thread/thr_create.c:187

-- 
You are receiving this mail because:
You are the assignee for the bug.