<a class="header-button" href="https://bugzilla.mozilla.org/home" title="Go to home page"> Bugzilla

Assignee

Updated

•

21 years ago

Assignee: general → brendan

Flags: blocking1.7? → blocking1.7+

Keywords: js1.5

Priority: -- → P1

Target Milestone: --- → mozilla1.7final

Assignee

Updated

•

21 years ago

Status: NEW → ASSIGNED

Assignee

Comment 9

•

21 years ago

Attached file JS shell testcase — Details

Another jsregexp.c bug, looks like. Can someone show that this regressed when I landed rogerl's big rewrite (2003/10/22)? I'd appreciate any purify or valgrind help, too, although this is easily reproduced. Must fix for 1.7, in any event. /be

Daniel de Wildt

Comment 10

•

21 years ago

I found the following two windows versions in archive.mozilla.org: WFM: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5) Gecko/20031007 Crash: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6a) Gecko/20031028 Maybe someone could narrow this time window with the Linux nightlies.

Assignee

Comment 11

•

21 years ago

Naturally, I can't get valgrind working on FC1. Timeless, anyone: purify or valgrind help? /be

Andrew Schultz

Comment 12

•

21 years ago

this is the only output I get from valgrind running the testcase in JS shell. Invalid read of size 4 at 0x804F962: JS_malloc (jsapi.c:1448) by 0x80C249B: js_InflateString (jsstr.c:2786) by 0x8052907: JS_BufferIsCompilableUnit (jsapi.c:3106) by 0x8049526: Process (js.c:378) by 0x317C3637: ??? Address 0x7C32334E is not stack'd, malloc'd or (recently) free'd

Charles Fenwick

Comment 13

•

21 years ago

no crash :Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6a) Gecko/ 20031021 crash: 20031022

Andrew Schultz

Comment 14

•

21 years ago

Attached file valgrind log — Details

this is a (more useful) log from invoking the testcase from the commandline rather than pasting it into an interactive session.

Comment 15

•

21 years ago

Assertion failure: a->base <= a->avail && a->avail <= a->limit, at jsarena.c:345 + a 0x018a74d8 {next=0xcdcdcdcd {next=??? base=??? limit=??? ...} base=0xcdcdcdcd limit=0x00000001 ...} JSArena * a->avail 0xcdcdcdcd unsigned long a->base 0xcdcdcdcd unsigned long a->limit 0x00000001 unsigned long ntdll.dll!DbgBreakPoint() PURERT.DLL!_x_checks_timed_fn_entry() + 0x16a3f3 JS32$Purify_R_mozilla_js_src_WINNT5_@1__DBG_@OBJ.DLL!JS_Assert(const char * s=0x5116116c, const char * file=0x51161160, int ln=0x00000159) Line 149 + 0x19 C > JS32$Purify_R_mozilla_js_src_WINNT5_@1__DBG_@OBJ.DLL!FreeArenaList (JSArenaPool * pool=0x0013cd48, JSArena * head=0x0013cd48, int reallyFree=0x00000001) Line 345 + 0x8f C JS32$Purify_R_mozilla_js_src_WINNT5_@1__DBG_@OBJ.DLL!JS_FinishArenaPool (JSArenaPool * pool=0x0013cd48) Line 480 + 0x39 C JS32$Purify_R_mozilla_js_src_WINNT5_@1__DBG_@OBJ.DLL!js_ExecuteRegExp (JSContext * cx=0x003681b8, JSRegExp * re=0x01734930, JSString * str=0x00369bb0, unsigned int * indexp=0x0013cdd4, int test=0x00000001, long * rval=0x0013cea0) Line 3107 + 0x1b C JS32$Purify_R_mozilla_js_src_WINNT5_@1__DBG_@OBJ.DLL!match_or_replace (JSContext * cx=0x003681b8, JSObject * obj=0x00369bc8, unsigned int argc=0x00000001, long * argv=0x0170842c, int (JSContext *, long, GlobData *)* glob=0x5113e8b6, GlobData * data=0x0013ce08, long * rval=0x0013cea0) Line 1152 + 0x5d C JS32$Purify_R_mozilla_js_src_WINNT5_@1__DBG_@OBJ.DLL!str_match (JSContext * cx=0x003681b8, JSObject * obj=0x00369bc8, unsigned int argc=0x00000001, long * argv=0x0170842c, long * rval=0x0013cea0) Line 1244 + 0x7c C JS32$Purify_R_mozilla_js_src_WINNT5_@1__DBG_@OBJ.DLL!js_Invoke (JSContext * cx=0x003681b8, unsigned int argc=0x00000001, unsigned int flags=0x00000000) Line 1281 + 0x62 C JS32$Purify_R_mozilla_js_src_WINNT5_@1__DBG_@OBJ.DLL!js_Interpret (JSContext * cx=0x003681b8, long * result=0x0013d7b4) Line 3370 + 0x39 C JS32$Purify_R_mozilla_js_src_WINNT5_@1__DBG_@OBJ.DLL!js_Execute (JSContext * cx=0x003681b8, JSObject * chain=0x00369748, JSScript * script=0x0170d858, JSStackFrame * down=0x00000000, unsigned int flags=0x00000000, long * result=0x0013d7b4) Line 1507 + 0x2b C JS32$Purify_R_mozilla_js_src_WINNT5_@1__DBG_@OBJ.DLL!JS_ExecuteScript (JSContext * cx=0x003681b8, JSObject * obj=0x00369748, JSScript * script=0x0170d858, long * rval=0x0013d7b4) Line 3473 + 0x4f C js$Purify_R_mozilla_js_src_WINNT5_@1__DBG_@OBJ.exe!Load(JSContext * cx=0x003681b8, JSObject * obj=0x00369748, unsigned int argc=0x00000001, long * argv=0x017083fc, long * rval=0x0013d84c) Line 679 + 0x16 C JS32$Purify_R_mozilla_js_src_WINNT5_@1__DBG_@OBJ.DLL!js_Invoke (JSContext * cx=0x003681b8, unsigned int argc=0x00000001, unsigned int flags=0x00000000) Line 1281 + 0x62 C JS32$Purify_R_mozilla_js_src_WINNT5_@1__DBG_@OBJ.DLL!js_Interpret (JSContext * cx=0x003681b8, long * result=0x0013f168) Line 3370 + 0x39 C JS32$Purify_R_mozilla_js_src_WINNT5_@1__DBG_@OBJ.DLL!js_Execute (JSContext * cx=0x003681b8, JSObject * chain=0x00369748, JSScript * script=0x01708340, JSStackFrame * down=0x00000000, unsigned int flags=0x00000000, long * result=0x0013f168) Line 1507 + 0x2b C JS32$Purify_R_mozilla_js_src_WINNT5_@1__DBG_@OBJ.DLL!JS_ExecuteScript (JSContext * cx=0x003681b8, JSObject * obj=0x00369748, JSScript * script=0x01708340, long * rval=0x0013f168) Line 3473 + 0x4f C js$Purify_R_mozilla_js_src_WINNT5_@1__DBG_@OBJ.exe!Process(JSContext * cx=0x003681b8, JSObject * obj=0x00369748, char * filename=0x00000000) Line 390 + 0x16 C js$Purify_R_mozilla_js_src_WINNT5_@1__DBG_@OBJ.exe!ProcessArgs (JSContext * cx=0x003681b8, JSObject * obj=0x00369748, char * * argv=0x0036510c, int argc=0x00000000) Line 568 + 0x11 C js$Purify_R_mozilla_js_src_WINNT5_@1__DBG_@OBJ.exe!main(int argc=0x00000000, char * * argv=0x0036510c, char * * envp=0x003631f0) Line 2426 + 0x15 C js$Purify_R_mozilla_js_src_WINNT5_@1__DBG_@OBJ.exe!mainCRTStartup() Line 400 + 0xe C PURERT.DLL!_x_checks_timed_fn_entry() + 0x1eb5 js$Purify_R_mozilla_js_src_WINNT5_@1__DBG_@OBJ.exe!00408059() js$Purify_R_mozilla_js_src_WINNT5_@1__DBG_@OBJ.exe!0040804a() kernel32.dll!GetCurrentDirectoryW() + 0x44 ntdll.dll!RtlGetFullPathName_U() + 0x1ee

Comment 16

•

21 years ago

fwiw 0xcdcdcdcd is crt: clean land (new, uninitd objects) so the first assert was: JS_ASSERT(a->base <= a->avail && a->avail <= a->limit); then one line executed: a->avail = a->base; then another assert: Assertion failure: (a)->avail <= (a)->limit, at jsarena.c:347 JS_CLEAR_UNUSED(a);

Comment 17

•

21 years ago

Attached file purify log — Details

note that the JS_Asserts correspond to [I] Starting thread 0xe30

Updated

•

21 years ago

Attachment #148783 - Attachment is patch: false

Comment 18

•

21 years ago

Just the ABW for people who don't like reading long purify logs: [E] ABW: Array bounds write in memcpy {1 occurrence} Writing 16060 bytes to 0x018a3644 (81 bytes at 0x018a74af illegal) Address 0x018a3644 is 44 bytes into a 16023 byte block at 0x018a3618 Address 0x018a3644 points to a HeapAlloc'd block in heap 0x00360000 Thread ID: 0x3c8 Error location memcpy+0xc [R:\mozilla\js\src\WINNT5.1_DBG.OBJ\js32.dll ip=0x511547cf] PushBackTrackState+0x350 [r:\mozilla\js\src\jsregexp.c:1766 ip=0x511166cf] result = (REBackTrackData *) ((char *)gData- >backTrackStack + offset); } gData->backTrackSP = result; result->sz = gData->cursz; gData->cursz = sz; result->backtrack_op = op; result->backtrack_pc = target; result->cp = cp; result->parenCount = parenCount; result->precedingStateTop = gData->stateStackTop; JS_ASSERT(gData->stateStackTop); memcpy(result + 1, gData->stateStack, => sizeof(REProgState) * result->precedingStateTop); if (parenCount != -1) { result->parenIndex = parenIndex; memcpy((char *)(result + 1) + sizeof(REProgState) * result->precedingStateTop, &x->parens[parenIndex], sizeof(RECapture) * parenCount); for (i = 0; i < parenCount; i++) x->parens[parenIndex + i].index = -1; } return result; } ExecuteREBytecode+0xafe [r:\mozilla\js\src\jsregexp.c:2450 ip=0x51113e76] MatchRegExp+0x146 [r:\mozilla\js\src\jsregexp.c:2832 ip=0x51113296] js_ExecuteRegExp+0x3ff [r:\mozilla\js\src\jsregexp.c:2931 ip=0x51112097] match_or_replace+0x7c6 [r:\mozilla\js\src\jsstr.c:1152 ip=0x5113e2d0] str_match+0xe1 [r:\mozilla\js\src\jsstr.c:1244 ip=0x5113da84] js_Invoke+0x19f7 [r:\mozilla\js\src\jsinterp.c:1281 ip=0x5108eb08] js_Interpret+0x1d5a3 [r:\mozilla\js\src\jsinterp.c:3370 ip=0x510ae6d8] js_Execute+0x7b8 [r:\mozilla\js\src\jsinterp.c:1507 ip=0x510907fe] JS_ExecuteScript+0x5e [r:\mozilla\js\src\jsapi.c:3473 ip=0x51017e80] Load+0xec [r:\mozilla\js\src\js.c:679 ip=0x00401341] js_Invoke+0x19f7 [r:\mozilla\js\src\jsinterp.c:1281 ip=0x5108eb08] js_Interpret+0x1d5a3 [r:\mozilla\js\src\jsinterp.c:3370 ip=0x510ae6d8] js_Execute+0x7b8 [r:\mozilla\js\src\jsinterp.c:1507 ip=0x510907fe] JS_ExecuteScript+0x5e [r:\mozilla\js\src\jsapi.c:3473 ip=0x51017e80] Process+0x2a1 [r:\mozilla\js\src\js.c:390 ip=0x00403f5e] ProcessArgs+0x42b [r:\mozilla\js\src\js.c:568 ip=0x00403c35] main+0x1eb [r:\mozilla\js\src\js.c:2426 ip=0x004037dd] mainCRTStartup+0x143 [f:\vs70builds\9466 \vc\crtbld\crt\src\crtexe.c:400 ip=0x00404367] _except_list+0x59 [R:\mozilla\js\src\WINNT5.1_DBG.OBJ\js.exe ip=0x00408059]

Comment 19

•

21 years ago

Attached file my local diffs to jsarena.c/jsarena.h — Details

My tree is mostly current, File: jsregexp.c Status: Needs Patch Working revision: 3.82 is one rev out of date (a patch brendan made recently), the diffs attached don't affect program control (it's essentially #if 0), but they do affect line numbers (sorry). my jsconfig.h also defines a 151 version which is basically 150 + JS_HAS_XDR_FREEZE_THAW. This jsshell was built with that version. It should not affect anything.

Comment 20

•

21 years ago

From the ABW: - gData->stateStack 0x018a74ec {continue_pc=0xcdcdcdcd <Bad Ptr> continue_op=0xcd 'Í' index=0xcdcd ...} REProgState * |+ continue_pc 0xcdcdcdcd <Bad Ptr> unsigned char * | continue_op 0xcd 'Í' unsigned char | index 0xcdcd unsigned short | parenSoFar 0x00000001 unsigned int \- u {quantifier={min=0xcdcd max=0xcdcd } assertion={top=0xcdcdcdcd sz=0xcdcdcdcd } } __unnamed |+ quantifier {min=0xcdcd max=0xcdcd } __unnamed \+ assertion {top=0xcdcdcdcd sz=0xcdcdcdcd } __unnamed - gData 0x0013cd14 {cx=0x003681b8 {links={next=0x00365380 {next=0x003681b8 prev=0x003681b8 } prev=0x00365380 {next=0x003681b8 prev=0x003681b8 } } interpLevel=0x00000002 stackLimit=0x00000000 ...} regexp=0x01734930 {nrefs=0x00000001 flags=0x0002 cloneIndex=0x0000 ...} ok=0x00000001 ...} REGlobalData * |+ cx 0x003681b8 {links={next=0x00365380 {next=0x003681b8 {next=0x00365380 prev=0x00365380 } prev=0x003681b8 {next=0x00365380 prev=0x00365380 } } prev=0x00365380 {next=0x003681b8 {next=0x00365380 prev=0x00365380 } prev=0x003681b8 {next=0x00365380 prev=0x00365380 } } } interpLevel=0x00000002 stackLimit=0x00000000 ...} JSContext * |+ regexp 0x01734930 {nrefs=0x00000001 flags=0x0002 cloneIndex=0x0000 ...} JSRegExp * | ok 0x00000001 int | start 0x0000015e unsigned int | skipped 0x00000000 int |+ cpbegin 0x0170c2d0 "-+16-+59-+66-+67-+80-+82-+143-+170-+176-+189-+308- +363-+364-+365-+377-+393-+404-+405-+419-+430-+641-+732-+754-+783-+786-+972-+977- +980-+982-+1010-+1011-+1027-+1028-+1039-+1040-+1074-+1084-+1086-+1098-+1267- +1296-+1305-+1367-+1371-+1379-+1480-+1481-+1482-+1484-+1510-+1526-+1565-+1568- +1574-+1577-+1604-+1632-+1638-+1643-+1657-+1708-+1722-+1941-+1948-+1955-+1965- +1966-+2027-+2039-+2040-+2041-+2048-+2054-+2059-+2090-+2091-+2092-+2105-+2118-+" const unsigned short * |+ cpend 0x0170c642 "" const unsigned short * |+ stateStack 0x018a74ec {continue_pc=0xcdcdcdcd <Bad Ptr> continue_op=0xcd 'Í' index=0xcdcd ...} REProgState * | stateStackTop 0x0323 unsigned short | maxStateStack 0x0640 unsigned short |+ backTrackStack 0x018a362c {sz=0x00000000 backtrack_pc=0x01736bbf "" backtrack_op=0x01 '␁' ...} REBackTrackData * |+ backTrackSP 0x018a362c {sz=0x00000000 backtrack_pc=0x01736bbf "" backtrack_op=0x01 '␁' ...} REBackTrackData * | maxBackTrack 0x00003e80 unsigned int | cursz 0x00003ed4 unsigned int \+ pool {first={next=0x0189d678 {next=0x0189f658 {next=0x018a1638 base=0x0189f668 limit=0x018a160b ...} base=0x0189d688 limit=0x0189f62b ...} base=0x0013cd58 limit=0x0013cd58 ...} current=0x018a3618 {next=0x00000000 {next=??? base=??? limit=??? ...} base=0x018a362c limit=0x018a74af ...} arenasize=0x00001fa0 ...} JSArenaPool

Assignee

Comment 21

•

21 years ago

Attached patch proposed fix (non-minimal) — Details — Splinter Review

This code is ugly, with misnomers and cybercrud names all over. The essential fix is to avoid assuming in PushBackTrackState that doubling the backtrack stack size will suffice to hold the new result. /be

Assignee

Comment 22

•

21 years ago

Comment on attachment 148787 [details] [diff] [review] proposed fix (non-minimal) Want to get this into 1.8a tonight. /be

Attachment #148787 - Flags: review?(shaver)

Mike Shaver (:shaver emeritus)

Assignee

Comment 23

•

21 years ago

Thanks to timeless for the ABW info in comment 20. /be

Comment 24

•

21 years ago

Comment on attachment 148787 [details] [diff] [review] proposed fix (non-minimal) r=shaver

Attachment #148787 - Flags: review?(shaver) → review+

Assignee

Comment 25

•

21 years ago

Comment on attachment 148787 [details] [diff] [review] proposed fix (non-minimal) This should go in for 1.7 also. I don't think it needs baking on the trunk; it passes the JS testsuite and this bug's regression test. /be

Attachment #148787 - Flags: approval1.7?

Asa Dotzler [:asa]

Comment 26

•

21 years ago

Comment on attachment 148787 [details] [diff] [review] proposed fix (non-minimal) a=asa (on behalf of drivers) for checkin to 1.7

Attachment #148787 - Flags: approval1.7? → approval1.7+

Assignee

Comment 27

•

21 years ago

Fixed on 1.7 branch and trunk. Yet another fix for the aviary branch to pick up. /be

Status: ASSIGNED → RESOLVED

Closed: 21 years ago

Keywords: fixed1.7

Resolution: --- → FIXED

Benjamin Smedberg

Updated

•

21 years ago

Whiteboard: fixed-aviary1.0

Karen Huang

Comment 28

•

21 years ago

Verified as fix on latest 1.7 branch Win 06-24,Mac 06-30 & Linux 0629 builds. Changing keywords from fixed1.7 to verified1.7. Leave this bug status "as is" until this bug be verified on trunk again...

Keywords: fixed1.7 → verified1.7

Comment 29

•

20 years ago

Attached file js1_5/Regress/regress-243174.js — Details

thanks to be.

Comment 30

•

20 years ago

js1_5/Regress/regress-243174.js checked in.

Updated

•

20 years ago

Flags: testcase+