Bugzilla

Assignee

Updated

•

20 years ago

Assignee: general → brendan

Flags: blocking1.7? → blocking1.7+

Keywords: js1.5

Priority: -- → P1

Target Milestone: --- → mozilla1.7final

Assignee

Updated

•

20 years ago

Status: NEW → ASSIGNED

Assignee

Comment 9

•

20 years ago

Attached file JS shell testcase — Details

Another jsregexp.c bug, looks like.  Can someone show that this regressed when
I landed rogerl's big rewrite (2003/10/22)?  I'd appreciate any purify or
valgrind help, too, although this is easily reproduced.  Must fix for 1.7, in
any event.

/be

Daniel de Wildt

Comment 10

•

20 years ago

I found the following two windows versions in archive.mozilla.org:

WFM: 	Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5) Gecko/20031007
Crash:	Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6a) Gecko/20031028

Maybe someone could narrow this time window with the Linux nightlies.

Assignee

Comment 11

•

20 years ago

Naturally, I can't get valgrind working on FC1.

Timeless, anyone: purify or valgrind help?

/be

Andrew Schultz

Comment 12

•

20 years ago

this is the only output I get from valgrind running the testcase in JS shell.

Invalid read of size 4
   at 0x804F962: JS_malloc (jsapi.c:1448)
   by 0x80C249B: js_InflateString (jsstr.c:2786)
   by 0x8052907: JS_BufferIsCompilableUnit (jsapi.c:3106)
   by 0x8049526: Process (js.c:378)
   by 0x317C3637: ???
 Address 0x7C32334E is not stack'd, malloc'd or (recently) free'd

Charles Fenwick

Comment 13

•

20 years ago

no crash :Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6a) Gecko/ 20031021
crash: 20031022

Andrew Schultz

Comment 14

•

20 years ago

Attached file valgrind log — Details

this is a (more useful) log from invoking the testcase from the commandline
rather than pasting it into an interactive session.

Comment 15

•

20 years ago

Assertion failure: a->base <= a->avail && a->avail <= a->limit, at jsarena.c:345

+	a	0x018a74d8 {next=0xcdcdcdcd {next=??? base=??? limit=??? ...} 
base=0xcdcdcdcd limit=0x00000001 ...}	JSArena *
	a->avail	0xcdcdcdcd	unsigned long
	a->base	0xcdcdcdcd	unsigned long
	a->limit	0x00000001	unsigned long

 	ntdll.dll!DbgBreakPoint() 	
 	PURERT.DLL!_x_checks_timed_fn_entry()  + 0x16a3f3	
 	JS32$Purify_R_mozilla_js_src_WINNT5_@1__DBG_@OBJ.DLL!JS_Assert(const 
char * s=0x5116116c, const char * file=0x51161160, int ln=0x00000159)  Line 149 
+ 0x19	C
>	JS32$Purify_R_mozilla_js_src_WINNT5_@1__DBG_@OBJ.DLL!FreeArenaList
(JSArenaPool * pool=0x0013cd48, JSArena * head=0x0013cd48, int 
reallyFree=0x00000001)  Line 345 + 0x8f	C
 	JS32$Purify_R_mozilla_js_src_WINNT5_@1__DBG_@OBJ.DLL!JS_FinishArenaPool
(JSArenaPool * pool=0x0013cd48)  Line 480 + 0x39	C
 	JS32$Purify_R_mozilla_js_src_WINNT5_@1__DBG_@OBJ.DLL!js_ExecuteRegExp
(JSContext * cx=0x003681b8, JSRegExp * re=0x01734930, JSString * 
str=0x00369bb0, unsigned int * indexp=0x0013cdd4, int test=0x00000001, long * 
rval=0x0013cea0)  Line 3107 + 0x1b	C
 	JS32$Purify_R_mozilla_js_src_WINNT5_@1__DBG_@OBJ.DLL!match_or_replace
(JSContext * cx=0x003681b8, JSObject * obj=0x00369bc8, unsigned int 
argc=0x00000001, long * argv=0x0170842c, int (JSContext *, long, GlobData *)* 
glob=0x5113e8b6, GlobData * data=0x0013ce08, long * rval=0x0013cea0)  Line 1152 
+ 0x5d	C
 	JS32$Purify_R_mozilla_js_src_WINNT5_@1__DBG_@OBJ.DLL!str_match
(JSContext * cx=0x003681b8, JSObject * obj=0x00369bc8, unsigned int 
argc=0x00000001, long * argv=0x0170842c, long * rval=0x0013cea0)  Line 1244 + 
0x7c	C
 	JS32$Purify_R_mozilla_js_src_WINNT5_@1__DBG_@OBJ.DLL!js_Invoke
(JSContext * cx=0x003681b8, unsigned int argc=0x00000001, unsigned int 
flags=0x00000000)  Line 1281 + 0x62	C
 	JS32$Purify_R_mozilla_js_src_WINNT5_@1__DBG_@OBJ.DLL!js_Interpret
(JSContext * cx=0x003681b8, long * result=0x0013d7b4)  Line 3370 + 0x39	C
 	JS32$Purify_R_mozilla_js_src_WINNT5_@1__DBG_@OBJ.DLL!js_Execute
(JSContext * cx=0x003681b8, JSObject * chain=0x00369748, JSScript * 
script=0x0170d858, JSStackFrame * down=0x00000000, unsigned int 
flags=0x00000000, long * result=0x0013d7b4)  Line 1507 + 0x2b	C
 	JS32$Purify_R_mozilla_js_src_WINNT5_@1__DBG_@OBJ.DLL!JS_ExecuteScript
(JSContext * cx=0x003681b8, JSObject * obj=0x00369748, JSScript * 
script=0x0170d858, long * rval=0x0013d7b4)  Line 3473 + 0x4f	C
 	js$Purify_R_mozilla_js_src_WINNT5_@1__DBG_@OBJ.exe!Load(JSContext * 
cx=0x003681b8, JSObject * obj=0x00369748, unsigned int argc=0x00000001, long * 
argv=0x017083fc, long * rval=0x0013d84c)  Line 679 + 0x16	C
 	JS32$Purify_R_mozilla_js_src_WINNT5_@1__DBG_@OBJ.DLL!js_Invoke
(JSContext * cx=0x003681b8, unsigned int argc=0x00000001, unsigned int 
flags=0x00000000)  Line 1281 + 0x62	C
 	JS32$Purify_R_mozilla_js_src_WINNT5_@1__DBG_@OBJ.DLL!js_Interpret
(JSContext * cx=0x003681b8, long * result=0x0013f168)  Line 3370 + 0x39	C
 	JS32$Purify_R_mozilla_js_src_WINNT5_@1__DBG_@OBJ.DLL!js_Execute
(JSContext * cx=0x003681b8, JSObject * chain=0x00369748, JSScript * 
script=0x01708340, JSStackFrame * down=0x00000000, unsigned int 
flags=0x00000000, long * result=0x0013f168)  Line 1507 + 0x2b	C
 	JS32$Purify_R_mozilla_js_src_WINNT5_@1__DBG_@OBJ.DLL!JS_ExecuteScript
(JSContext * cx=0x003681b8, JSObject * obj=0x00369748, JSScript * 
script=0x01708340, long * rval=0x0013f168)  Line 3473 + 0x4f	C
 	js$Purify_R_mozilla_js_src_WINNT5_@1__DBG_@OBJ.exe!Process(JSContext * 
cx=0x003681b8, JSObject * obj=0x00369748, char * filename=0x00000000)  Line 390 
+ 0x16	C
 	js$Purify_R_mozilla_js_src_WINNT5_@1__DBG_@OBJ.exe!ProcessArgs
(JSContext * cx=0x003681b8, JSObject * obj=0x00369748, char * * 
argv=0x0036510c, int argc=0x00000000)  Line 568 + 0x11	C
 	js$Purify_R_mozilla_js_src_WINNT5_@1__DBG_@OBJ.exe!main(int 
argc=0x00000000, char * * argv=0x0036510c, char * * envp=0x003631f0)  Line 2426 
+ 0x15	C
 	js$Purify_R_mozilla_js_src_WINNT5_@1__DBG_@OBJ.exe!mainCRTStartup()  
Line 400 + 0xe	C
 	PURERT.DLL!_x_checks_timed_fn_entry()  + 0x1eb5	
 	js$Purify_R_mozilla_js_src_WINNT5_@1__DBG_@OBJ.exe!00408059() 	
 	js$Purify_R_mozilla_js_src_WINNT5_@1__DBG_@OBJ.exe!0040804a() 	
 	kernel32.dll!GetCurrentDirectoryW()  + 0x44	
 	ntdll.dll!RtlGetFullPathName_U()  + 0x1ee

Comment 16

•

20 years ago

fwiw 0xcdcdcdcd is crt: clean land (new, uninitd objects)

so the first assert was:
	JS_ASSERT(a->base <= a->avail && a->avail <= a->limit);
then one line executed:
	a->avail = a->base;
then another assert:
Assertion failure: (a)->avail <= (a)->limit, at jsarena.c:347
	JS_CLEAR_UNUSED(a);

Comment 17

•

20 years ago

Attached file purify log — Details

note that the JS_Asserts correspond to [I] Starting thread 0xe30

Updated

•

20 years ago

Attachment #148783 - Attachment is patch: false

Comment 18

•

20 years ago

Just the ABW for people who don't like reading long purify logs:

[E] ABW: Array bounds write in memcpy {1 occurrence}
        Writing 16060 bytes to 0x018a3644 (81 bytes at 0x018a74af illegal)
        Address 0x018a3644 is 44 bytes into a 16023 byte block at 0x018a3618
        Address 0x018a3644 points to a HeapAlloc'd block in heap 0x00360000
        Thread ID: 0x3c8
        Error location
            memcpy+0xc           [R:\mozilla\js\src\WINNT5.1_DBG.OBJ\js32.dll 
ip=0x511547cf]
            PushBackTrackState+0x350 [r:\mozilla\js\src\jsregexp.c:1766 
ip=0x511166cf]
                        result = (REBackTrackData *) ((char *)gData-
>backTrackStack + offset);
                    }
                    gData->backTrackSP = result;
                    result->sz = gData->cursz;
                    gData->cursz = sz;
                
                    result->backtrack_op = op;
                    result->backtrack_pc = target;
                    result->cp = cp;
                    result->parenCount = parenCount;
                
                    result->precedingStateTop = gData->stateStackTop;
                    JS_ASSERT(gData->stateStackTop);
                    memcpy(result + 1, gData->stateStack,
             =>            sizeof(REProgState) * result->precedingStateTop);
                
                    if (parenCount != -1) {
                        result->parenIndex = parenIndex;
                        memcpy((char *)(result + 1) +
                               sizeof(REProgState) * result->precedingStateTop,
                               &x->parens[parenIndex],
                               sizeof(RECapture) * parenCount);
                        for (i = 0; i < parenCount; i++)
                            x->parens[parenIndex + i].index = -1;
                    }
                
                    return result;
                }
                
            ExecuteREBytecode+0xafe [r:\mozilla\js\src\jsregexp.c:2450 
ip=0x51113e76]
            MatchRegExp+0x146    [r:\mozilla\js\src\jsregexp.c:2832 
ip=0x51113296]
            js_ExecuteRegExp+0x3ff [r:\mozilla\js\src\jsregexp.c:2931 
ip=0x51112097]
            match_or_replace+0x7c6 [r:\mozilla\js\src\jsstr.c:1152 
ip=0x5113e2d0]
            str_match+0xe1       [r:\mozilla\js\src\jsstr.c:1244 ip=0x5113da84]
            js_Invoke+0x19f7     [r:\mozilla\js\src\jsinterp.c:1281 
ip=0x5108eb08]
            js_Interpret+0x1d5a3 [r:\mozilla\js\src\jsinterp.c:3370 
ip=0x510ae6d8]
            js_Execute+0x7b8     [r:\mozilla\js\src\jsinterp.c:1507 
ip=0x510907fe]
            JS_ExecuteScript+0x5e [r:\mozilla\js\src\jsapi.c:3473 ip=0x51017e80]
            Load+0xec            [r:\mozilla\js\src\js.c:679 ip=0x00401341]
            js_Invoke+0x19f7     [r:\mozilla\js\src\jsinterp.c:1281 
ip=0x5108eb08]
            js_Interpret+0x1d5a3 [r:\mozilla\js\src\jsinterp.c:3370 
ip=0x510ae6d8]
            js_Execute+0x7b8     [r:\mozilla\js\src\jsinterp.c:1507 
ip=0x510907fe]
            JS_ExecuteScript+0x5e [r:\mozilla\js\src\jsapi.c:3473 ip=0x51017e80]
            Process+0x2a1        [r:\mozilla\js\src\js.c:390 ip=0x00403f5e]
            ProcessArgs+0x42b    [r:\mozilla\js\src\js.c:568 ip=0x00403c35]
            main+0x1eb           [r:\mozilla\js\src\js.c:2426 ip=0x004037dd]
            mainCRTStartup+0x143 [f:\vs70builds\9466
\vc\crtbld\crt\src\crtexe.c:400 ip=0x00404367]
            _except_list+0x59    [R:\mozilla\js\src\WINNT5.1_DBG.OBJ\js.exe 
ip=0x00408059]

Comment 19

•

20 years ago

Attached file my local diffs to jsarena.c/jsarena.h — Details

My tree is mostly current,
File: jsregexp.c	Status: Needs Patch

   Working revision:	3.82
is one rev out of date (a patch brendan made recently), the diffs attached
don't affect program control (it's essentially #if 0), but they do affect line
numbers (sorry). my jsconfig.h also defines a 151 version which is basically
150 + JS_HAS_XDR_FREEZE_THAW. This jsshell was built with that version. It
should not affect anything.

Comment 20

•

20 years ago

From the ABW:
-	gData->stateStack	0x018a74ec {continue_pc=0xcdcdcdcd <Bad Ptr> 
continue_op=0xcd 'Í' index=0xcdcd ...}	REProgState *
|+	continue_pc	0xcdcdcdcd <Bad Ptr>	unsigned char *
|	continue_op	0xcd 'Í'	unsigned char
|	index	0xcdcd	unsigned short
|	parenSoFar	0x00000001	unsigned int
\-	u	{quantifier={min=0xcdcd max=0xcdcd } assertion={top=0xcdcdcdcd 
sz=0xcdcdcdcd } }	__unnamed
 |+	quantifier	{min=0xcdcd max=0xcdcd }	__unnamed
 \+	assertion	{top=0xcdcdcdcd sz=0xcdcdcdcd }	__unnamed

-	gData	0x0013cd14 {cx=0x003681b8 {links={next=0x00365380 
{next=0x003681b8 prev=0x003681b8 } prev=0x00365380 {next=0x003681b8 
prev=0x003681b8 } } interpLevel=0x00000002 stackLimit=0x00000000 ...} 
regexp=0x01734930 {nrefs=0x00000001 flags=0x0002 cloneIndex=0x0000 ...} 
ok=0x00000001 ...}	REGlobalData *
|+	cx	0x003681b8 {links={next=0x00365380 {next=0x003681b8 
{next=0x00365380 prev=0x00365380 } prev=0x003681b8 {next=0x00365380 
prev=0x00365380 } } prev=0x00365380 {next=0x003681b8 {next=0x00365380 
prev=0x00365380 } prev=0x003681b8 {next=0x00365380 prev=0x00365380 } } } 
interpLevel=0x00000002 stackLimit=0x00000000 ...}	JSContext *
|+	regexp	0x01734930 {nrefs=0x00000001 flags=0x0002 cloneIndex=0x0000 ...}
	JSRegExp *
|	ok	0x00000001	int
|	start	0x0000015e	unsigned int
|	skipped	0x00000000	int
|+	cpbegin	0x0170c2d0 "-+16-+59-+66-+67-+80-+82-+143-+170-+176-+189-+308-
+363-+364-+365-+377-+393-+404-+405-+419-+430-+641-+732-+754-+783-+786-+972-+977-
+980-+982-+1010-+1011-+1027-+1028-+1039-+1040-+1074-+1084-+1086-+1098-+1267-
+1296-+1305-+1367-+1371-+1379-+1480-+1481-+1482-+1484-+1510-+1526-+1565-+1568-
+1574-+1577-+1604-+1632-+1638-+1643-+1657-+1708-+1722-+1941-+1948-+1955-+1965-
+1966-+2027-+2039-+2040-+2041-+2048-+2054-+2059-+2090-+2091-+2092-+2105-+2118-+"
	const unsigned short *
|+	cpend	0x0170c642 ""	const unsigned short *
|+	stateStack	0x018a74ec {continue_pc=0xcdcdcdcd <Bad Ptr> 
continue_op=0xcd 'Í' index=0xcdcd ...}	REProgState *
|	stateStackTop	0x0323	unsigned short
|	maxStateStack	0x0640	unsigned short
|+	backTrackStack	0x018a362c {sz=0x00000000 backtrack_pc=0x01736bbf "" 
backtrack_op=0x01 '&#9217;' ...}	REBackTrackData *
|+	backTrackSP	0x018a362c {sz=0x00000000 backtrack_pc=0x01736bbf "" 
backtrack_op=0x01 '&#9217;' ...}	REBackTrackData *
|	maxBackTrack	0x00003e80	unsigned int
|	cursz	0x00003ed4	unsigned int
\+	pool	{first={next=0x0189d678 {next=0x0189f658 {next=0x018a1638 
base=0x0189f668 limit=0x018a160b ...} base=0x0189d688 limit=0x0189f62b ...} 
base=0x0013cd58 limit=0x0013cd58 ...} current=0x018a3618 {next=0x00000000 
{next=??? base=??? limit=??? ...} base=0x018a362c limit=0x018a74af ...} 
arenasize=0x00001fa0 ...}	JSArenaPool

Assignee

Comment 21

•

20 years ago

Attached patch proposed fix (non-minimal) — Details — Splinter Review

This code is ugly, with misnomers and cybercrud names all over.

The essential fix is to avoid assuming in PushBackTrackState that doubling the
backtrack stack size will suffice to hold the new result.

/be

Assignee

Comment 22

•

20 years ago

Comment on attachment 148787 [details] [diff] [review]
proposed fix (non-minimal)

Want to get this into 1.8a tonight.

/be

Attachment #148787 - Flags: review?(shaver)

Mike Shaver (:shaver -- probably not reading bugmail closely)

Assignee

Comment 23

•

20 years ago

Thanks to timeless for the ABW info in comment 20.

/be

Comment 24

•

20 years ago

Comment on attachment 148787 [details] [diff] [review]
proposed fix (non-minimal)

r=shaver

Attachment #148787 - Flags: review?(shaver) → review+

Assignee

Comment 25

•

20 years ago

Comment on attachment 148787 [details] [diff] [review]
proposed fix (non-minimal)

This should go in for 1.7 also.  I don't think it needs baking on the trunk; it
passes the JS testsuite and this bug's regression test.

/be

Attachment #148787 - Flags: approval1.7?

Asa Dotzler [:asa]

Comment 26

•

20 years ago

Comment on attachment 148787 [details] [diff] [review]
proposed fix (non-minimal)

a=asa (on behalf of drivers) for checkin to 1.7

Attachment #148787 - Flags: approval1.7? → approval1.7+

Assignee

Comment 27

•

20 years ago

Fixed on 1.7 branch and trunk.  Yet another fix for the aviary branch to pick up.

/be

Status: ASSIGNED → RESOLVED

Closed: 20 years ago

Keywords: fixed1.7

Resolution: --- → FIXED

Benjamin Smedberg

Updated

•

20 years ago

Whiteboard: fixed-aviary1.0

Karen Huang

Comment 28

•

20 years ago

Verified as fix on latest 1.7 branch Win 06-24,Mac 06-30 & Linux 0629 builds.
Changing keywords from fixed1.7 to verified1.7.
Leave this bug status "as is" until this bug be verified on trunk again...

Keywords: fixed1.7 → verified1.7

Comment 29

•

19 years ago

Attached file js1_5/Regress/regress-243174.js — Details

thanks to be.

Comment 30

•

19 years ago

js1_5/Regress/regress-243174.js checked in.

Updated

•

19 years ago

Flags: testcase+