1003694 - Assertion failure: snapshot_.numAllocationsRead() == numAllocations(), at jit/JitFrameIterator.h or Crash [@ js::jit::InlineFrameIteratorMaybeGC<(js::AllowGC)1>::findNextFrame]

Status: VERIFIED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

(function() {
    function f(i) {
        var d = 3 + Math.abs()
        i ? 0 : f()
    }
    return f
}())()

asserts js debug shell on m-c changeset e19812f56952 with --ion-parallel-compile=off --ion-eager --ion-inlining=off at Assertion failure: snapshot_.numAllocationsRead() == numAllocations(), at jit/JitFrameIterator.h

My configure flags are:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --disable-tests --with-ccache --enable-threadsafe <other NSPR options>

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This is flooding jsfunfuzz results.

Comment 2

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
=== Tinderbox Build Bisection Results by autoBisect ===

The "good" changeset has the timestamp "20140429192012" and the hash "c0d658d3f739".
The "bad" changeset has the timestamp "20140429210107" and the hash "429d4d1f49e1".

Likely regression window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=c0d658d3f739&tochange=429d4d1f49e1

Comment 3

[Nicolas B. Pierron [:nbp] {away}]

I am not sure about the above regression range, but I am able to reproduce it after the landing of Bug 990106 patches, which is by the way adding this assertion.

Comment 4

[Nicolas B. Pierron [:nbp] {away}]

Attachment: Settle on first frame by skipping all allocations.

Comment 5

[Nicolas B. Pierron [:nbp] {away}]

https://hg.mozilla.org/integration/mozilla-inbound/rev/e0679448fd3b

Comment 6

[Christian Holler (:decoder)]

Looks like a security bug to me. I'm getting various crashes [@ js::jit::InlineFrameIteratorMaybeGC<(js::AllowGC)1>::findNextFrame] with bad reads.

Comment 7

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 8

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 9

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to Nicolas B. Pierron [:nbp] from comment #3)
> I am not sure about the above regression range, but I am able to reproduce
> it after the landing of Bug 990106 patches, which is by the way adding this
> assertion.

Yes, that sounds right:

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   180713:8a3e7ed0c4c1
user:        Nicolas B. Pierron
date:        Tue Apr 29 10:17:52 2014 -0700
summary:     Bug 990106 part 4 - Recover Add and DCE unused additions. r=h4writer,jandem

Comment 10

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/e0679448fd3b

Comment 11

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.

Comment 12

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed on Fx32