1054241 - Crash [@ js::jit::JitFrameIterator::operator++] with setObjectMetadataCallback

Status: VERIFIED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision c9f8cc9ce89c (run with --no-threads --fuzzing-safe --ion-eager):


setObjectMetadataCallback(true);
(function(){
for(;;) {
  try{
    var a = new Array(5);
    throw 1;
  } catch(e) {}	
}
})();

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

Opt-crash trace:

Program received signal SIGSEGV, Segmentation fault.
js::jit::JitFrameIterator::operator++ (this=0x7fffffffb238) at js/src/jit/IonFrames.cpp:313
313         frameSize_ = prevFrameLocalSize();
#0  js::jit::JitFrameIterator::operator++ (this=0x7fffffffb238) at js/src/jit/IonFrames.cpp:313
#1  0x00000000008b2be0 in js::FrameIter::settleOnActivation (this=0x7fffffffb1e0) at js/src/vm/Stack.cpp:573
#2  0x000000000044ecf2 in ScriptFrameIter (this=0x7fffffffb1e0, savedOption=js::FrameIter::STOP_AT_SAVED, cx=0x1670a40) at js/src/vm/Stack.h:1688
#3  NonBuiltinScriptFrameIter (opt=js::FrameIter::STOP_AT_SAVED, cx=0x1670a40, this=0x7fffffffb1e0) at js/src/vm/Stack.h:1780
#4  ShellObjectMetadataCallback (cx=0x1670a40, pmetadata=0x7fffffffb730) at js/src/builtin/TestingFunctions.cpp:1174
#5  0x0000000000985c57 in callObjectMetadataCallback (obj=0x7fffffffb730, cx=0x1670a40, this=<optimized out>) at js/src/jscompartment.h:355
#6  NewObjectMetadata (pmetadata=0x7fffffffb730, cxArg=0x1670a40) at js/src/jsobjinlines.h:1064
#7  NewArray<true> (protoArg=<optimized out>, newKind=js::GenericObject, length=5, cxArg=0x1670a40) at js/src/jsarray.cpp:3209
r12     0xba1   2977
=> 0x617db9 <js::jit::JitFrameIterator::operator++()+25>:       mov    0x8(%r12),%rbp



Crash doesn't look like a null-deref, marking s-s based on that until triaged.

Comment 3

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/9bdc7649cc78
user:        Nicolas B. Pierron
date:        Mon Aug 04 07:18:40 2014 -0700
summary:     Bug 1040027 part 2 - IonMonkey: Recover MNewArray. r=jandem

This iteration took 648.176 seconds to run.

Comment 4

[Christian Holler (:decoder)]

Needinfo from nbp based on comment 3 :)

Comment 5

[Nicolas B. Pierron [:nbp]]

This is the same issue as Bug 1006899, apparently I forgot to add it back in this patch when I fixed it in the tree.

Comment 6

[Nicolas B. Pierron [:nbp]]

Attachment: Use AutoEnterAnalysis to avoid iterating the stack under RNewArray allocations.

Comment 7

[Nicolas B. Pierron [:nbp]]

This issue is caused by Bug 1040027 which is adding this code as part of changeset 9bdc7649cc78.

Comment 8

[Nicolas B. Pierron [:nbp]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/fb294a66c8ac

Comment 9

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/fb294a66c8ac

Comment 10

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.