814826 - js-ctypes crash when using callbacks

Status: NEW

(Core :: js-ctypes, defect)

Description

[Albert [:albert]]

I tryed to use callback to js function from native library and always crash:

F/libc    (  441): Fatal signal 11 (SIGSEGV) at 0x4a83d240 (code=2)
I/DEBUG   (  442): debuggerd committing suicide to free the zombie!

It can be reproduced with the following code:

Components.utils.import("resource://gre/modules/ctypes.jsm");
var fnptr_t = ctypes.FunctionType(ctypes.default_abi, ctypes.int, []).ptr;
fnptr_t(function() {})();

It works fine in Firefox but crash in B2G

Comment 1

[Bobby Holley (:bholley)]

(In reply to Albert from comment #0)
> I tryed to use callback to js function from native library and always crash:
> 
> F/libc    (  441): Fatal signal 11 (SIGSEGV) at 0x4a83d240 (code=2)
> I/DEBUG   (  442): debuggerd committing suicide to free the zombie!
> 
> It can be reproduced with the following code:
> 
> Components.utils.import("resource://gre/modules/ctypes.jsm");
> var fnptr_t = ctypes.FunctionType(ctypes.default_abi, ctypes.int, []).ptr;
> fnptr_t(function() {})();

You need to keep your function alive. js-ctypes has no way of tracing function pointers, so if you use a pointer to a GC-ed function you'll crash. My guess is that's what's happening here.

Try:

> Components.utils.import("resource://gre/modules/ctypes.jsm");
> var fnptr_t = ctypes.FunctionType(ctypes.default_abi, ctypes.int, []).ptr;
> var fun = function() {};
> fnptr_t(fun)();

Comment 2

[Albert [:albert]]

(In reply to Bobby Holley (:bholley) (on vacation though Dec 4) from comment #1)

> Try:
> 
> > Components.utils.import("resource://gre/modules/ctypes.jsm");
> > var fnptr_t = ctypes.FunctionType(ctypes.default_abi, ctypes.int, []).ptr;
> > var fun = function() {};
> > fnptr_t(fun)();

Same crash happens.

curiously when debugging with gdb in single-process mode (./run-gdb.sh) it works fine, but when gdb is attached to a running b2g process (./run-gdb attach pid) it crashes.

However, disabling the out of process feature in settings developer options, the crash happens also.

Comment 3

[Bobby Holley (:bholley)]

Yoric, I'm on PTO for a while. Can you look into this?

Comment 4

[David Teller [:Yoric] - still alive but not very active]

As mentioned by Albert, I can't reproduce it on FF (at least desktop) and I do not have access to a Gonk device. I will see if I can reproduce it on Fennec.

Comment 5

[Josh Matthews [:jdm]]

You could also try desktop B2G.

Comment 6

[Albert [:albert]]

It works in B2G desktop. It only crash in otoro and unagi devices.

Comment 7

[David Teller [:Yoric] - still alive but not very active]

In that case, there isn't much I can do to reproduce the error. I can't take that bug, sorry.

Comment 8

[Takanori MATSUURA]

Target OS seems to be obsoleted.