Crash [@ js::types::TypeSet::unknownObject] with OOM

RESOLVED WORKSFORME

Status

()

Core
JavaScript Engine
--
critical
RESOLVED WORKSFORME
3 years ago
2 years ago

People

(Reporter: decoder, Unassigned)

Tracking

(Blocks: 2 bugs, {crash, testcase})

Trunk
x86
Linux
crash, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox33 affected)

Details

(Whiteboard: [jsbugmon:], crash signature)

Attachments

(1 attachment)

(Reporter)

Description

3 years ago
The following testcase crashes on mozilla-central revision f19ca5123d6a (run with --fuzzing-safe):


var Test = function (foo) {
    var a = [];
};
oomAfterAllocations(74);
new Test();
(Reporter)

Comment 1

3 years ago
Crash trace:


==20269==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000 (pc 0x08e28fb4 sp 0xff8c6e20 bp 0xff8c6f38 T0)
    #0 0x8e28fb3 in js::types::TypeSet::unknownObject() const js/src/jsinfer.h:544
    #1 0x8e28fb3 in js::types::TemporaryTypeSet::convertDoubleElements(js::types::CompilerConstraintList*) js/src/jsinfer.cpp:1807
    #2 0x8849c01 in js::jit::IonBuilder::jsop_newarray(unsigned int) js/src/jit/IonBuilder.cpp:5509
    #3 0x88347be in js::jit::IonBuilder::inspectOpcode(JSOp) js/src/jit/IonBuilder.cpp:1547
    #4 0x8828596 in js::jit::IonBuilder::traverseBytecode() js/src/jit/IonBuilder.cpp:1285
    #5 0x8819ce4 in js::jit::IonBuilder::build() js/src/jit/IonBuilder.cpp:753
    #6 0x8813db4 in js::jit::AnalyzeNewScriptProperties(JSContext*, JSFunction*, js::types::TypeObject*, JS::Handle<JSObject*>, js::Vector<js::types::TypeNewScript::Initializer, 0u, js::TempAllocPolicy>*) js/src/jit/IonAnalysis.cpp:2222
    #7 0x8e48a89 in js::ThreadSafeContext::asJSContext() const js/src/jsinfer.cpp:3427
    #8 0x8e48a89 in js::ExclusiveContext::getNewType(js::Class const*, js::TaggedProto, JSFunction*) js/src/jsinfer.cpp:3942
    #9 0x8ea069f in js::CreateThisForFunctionWithProto(JSContext*, JS::Handle<JSObject*>, JSObject*, js::NewObjectKind) js/src/jsobj.cpp:1704
    #10 0x8ea3003 in js::CreateThisForFunction(JSContext*, JS::Handle<JSObject*>, js::NewObjectKind) js/src/jsobj.cpp:1734



Needinfo from Jason because he asked for some OOM bugs to fix :)
Blocks: 912928
status-firefox33: --- → affected
Flags: needinfo?(jorendorff)
Whiteboard: [jsbugmon:update,bisect]
(Reporter)

Comment 2

3 years ago
Created attachment 8441333 [details]
[crash-signature] Machine-readable crash signature
(Reporter)

Updated

3 years ago
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
(Assignee)

Updated

3 years ago
Assignee: general → nobody
(Reporter)

Updated

3 years ago
Whiteboard: [jsbugmon:update] → [jsbugmon:update,ignore]
(Reporter)

Comment 3

3 years ago
JSBugMon: The testcase found in this bug no longer reproduces (tried revision acbdce59da2f).
(Reporter)

Updated

3 years ago
Whiteboard: [jsbugmon:update,ignore] → [jsbugmon:bisectfix]
(Reporter)

Updated

3 years ago
Whiteboard: [jsbugmon:bisectfix] → [jsbugmon:]
(Reporter)

Comment 4

3 years ago
JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/a1b25f21fe08
user:        Brian Hackett
date:        Tue Sep 02 13:47:34 2014 -0600
summary:     Bug 1041688 - Add acquired properties analysis, r=jandem.

This iteration took 582.251 seconds to run.
Decoder doesn't see this anymore. And I couldn't reproduce in the older version either, besides producing unhandlable ooms.
Status: NEW → RESOLVED
Last Resolved: 2 years ago
Resolution: --- → WORKSFORME
Flags: needinfo?(jorendorff)
You need to log in before you can comment on or make changes to this bug.