1124204 - Assertion failure: nativeStartAddr, at jit/JitcodeMap.h:71 or Crash [@ js::jit::JitcodeGlobalEntry::callStackAtAddr]

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 369a8f14ccf8 (build with --enable-optimize --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --target=i686-pc-linux-gnu --enable-arm-simulator --disable-debug, run with --fuzzing-safe --thread-count=2 --arm-sim-icache-checks --arm-asm-nop-fill=1 --baseline-eager min.js):

var lfcode = new Array();
lfcode.push = loadFile;
lfcode.push("1");
lfcode.push("g = newGlobal()\ng.parent = this\ng.eval(\"Debugger(parent).onExceptionUnwind=(function(){})\")\ntry {\nf(\"switch(''){default:break;}\")\n} catch(exc1) { {  }    enableSingleStepProfiling();  var g = newGlobal();      } \n");
lfcode.push("function testcase() {\r\n");
function loadFile(lfVarx) {
        if (lfVarx.substr(-3) != ".js" && lfVarx.length != 1) {
            switch (lfRunTypeId) {
                case 1: eval(lfVarx); break;
            }
        } else if (!isNaN(lfVarx)) {
            lfRunTypeId = parseInt(lfVarx);
        }
}



Backtrace:

Program received signal SIGSEGV, Segmentation fault.
js::jit::JitcodeGlobalEntry::callStackAtAddr (this=0xffffb19c, rt=0x92bd290, ptr=0x0, results=0xffffb1b0, maxResults=64) at js/src/jit/JitcodeMap.h:477
477	            MOZ_CRASH("Invalid JitcodeGlobalEntry kind.");
#0  js::jit::JitcodeGlobalEntry::callStackAtAddr (this=0xffffb19c, rt=0x92bd290, ptr=0x0, results=0xffffb1b0, maxResults=64) at js/src/jit/JitcodeMap.h:477
#1  0x084d38e2 in JS::ProfilingFrameIterator::extractStack (this=0xffffb468, frames=0xffffb328, offset=0, end=16) at js/src/vm/Stack.cpp:1898
#2  0x080583d6 in SingleStepCallback (arg=0x92bd290, sim=0x92d7dd0, pc=0x0) at js/src/shell/js.cpp:4169
#3  0x0835fddb in js::jit::Simulator::execute<false> (this=0x92d7dd0) at js/src/jit/arm/Simulator-arm.cpp:4202
#4  0x0834e09d in js::jit::Simulator::callInternal (this=this@entry=0x92d7dd0, entry=entry@entry=0xf7815e50 "\377\377\377\352\360O-\351\377\377\377\352\004\320M\342\377\377\377\352\020\212-\355\377\377\377\352\r\200\240\341\377\377\377\352h\220\235\345\377\377\377\352\r\260\240\341\377\377\377\352t\240\235\345\377\377\377", <incomplete sequence \352>) at js/src/jit/arm/Simulator-arm.cpp:4305
#5  0x0834e146 in js::jit::Simulator::call (this=0x92d7dd0, entry=0xf7815e50 "\377\377\377\352\360O-\351\377\377\377\352\004\320M\342\377\377\377\352\020\212-\355\377\377\377\352\r\200\240\341\377\377\377\352h\220\235\345\377\377\377\352\r\260\240\341\377\377\377\352t\240\235\345\377\377\377", <incomplete sequence \352>, argument_count=8) at js/src/jit/arm/Simulator-arm.cpp:4388
#6  0x0818a3ff in EnterBaseline (cx=cx@entry=0x92d8848, data=...) at js/src/jit/BaselineJIT.cpp:122
#7  0x081dda13 in js::jit::EnterBaselineMethod (cx=0x92d8848, state=...) at js/src/jit/BaselineJIT.cpp:154
#8  0x084aecc4 in js::RunScript (cx=cx@entry=0x92d8848, state=...) at js/src/vm/Interpreter.cpp:438
#9  0x084af068 in js::Invoke (cx=cx@entry=0x92d8848, args=..., construct=construct@entry=js::NO_CONSTRUCT) at js/src/vm/Interpreter.cpp:517
#10 0x084afd05 in js::Invoke (cx=0x92d8848, thisv=..., fval=..., argc=2, argv=0xffffbd18, rval=$jsval(-nan(0xfff8200000000))) at js/src/vm/Interpreter.cpp:554
#11 0x0846ca73 in js::Debugger::fireExceptionUnwind (this=this@entry=0x93ce4b8, cx=cx@entry=0x92d8848, vp=vp@entry=$jsval(-nan(0xfff8200000000))) at js/src/vm/Debugger.cpp:1201
#12 0x0846cd9b in js::Debugger::dispatchHook (cx=cx@entry=0x92d8848, vp=$jsval(-nan(0xfff8200000000)), which=which@entry=js::Debugger::OnExceptionUnwind, payload=0x0) at js/src/vm/Debugger.cpp:1290
#13 0x0846cf63 in js::Debugger::slowPathOnExceptionUnwind (cx=0x92d8848, frame=...) at js/src/vm/Debugger.cpp:746
#14 0x0823e2c2 in onExceptionUnwind (frame=..., cx=0x92d8848) at js/src/vm/Debugger-inl.h:57
#15 HandleExceptionBaseline (calledDebugEpilogue=0xffffc1fc, unwoundScopeToPc=<synthetic pointer>, rfe=0xf60fed30, frame=..., cx=0x92d8848) at js/src/jit/JitFrames.cpp:559
#16 js::jit::HandleException (rfe=0xf60fed30) at js/src/jit/JitFrames.cpp:811
#17 0x0834db17 in js::jit::Simulator::softwareInterrupt (this=0x92d7dd0, instr=0x930cfd4) at js/src/jit/arm/Simulator-arm.cpp:2147
#18 0x0834adec in js::jit::Simulator::instructionDecode (this=this@entry=0x92d7dd0, instr=instr@entry=0x930cfd4) at js/src/jit/arm/Simulator-arm.cpp:4162
#19 0x0835fd54 in js::jit::Simulator::execute<false> (this=0x92d7dd0) at js/src/jit/arm/Simulator-arm.cpp:4217
#20 0x0834e09d in js::jit::Simulator::callInternal (this=this@entry=0x92d7dd0, entry=entry@entry=0xf7815e50 "\377\377\377\352\360O-\351\377\377\377\352\004\320M\342\377\377\377\352\020\212-\355\377\377\377\352\r\200\240\341\377\377\377\352h\220\235\345\377\377\377\352\r\260\240\341\377\377\377\352t\240\235\345\377\377\377", <incomplete sequence \352>) at js/src/jit/arm/Simulator-arm.cpp:4305
#21 0x0834e146 in js::jit::Simulator::call (this=0x92d7dd0, entry=0xf7815e50 "\377\377\377\352\360O-\351\377\377\377\352\004\320M\342\377\377\377\352\020\212-\355\377\377\377\352\r\200\240\341\377\377\377\352h\220\235\345\377\377\377\352\r\260\240\341\377\377\377\352t\240\235\345\377\377\377", <incomplete sequence \352>, argument_count=8) at js/src/jit/arm/Simulator-arm.cpp:4388
#22 0x0818a3ff in EnterBaseline (cx=cx@entry=0x92d8848, data=...) at js/src/jit/BaselineJIT.cpp:122
#23 0x081dda13 in js::jit::EnterBaselineMethod (cx=0x92d8848, state=...) at js/src/jit/BaselineJIT.cpp:154
#24 0x084aecc4 in js::RunScript (cx=cx@entry=0x92d8848, state=...) at js/src/vm/Interpreter.cpp:438
#25 0x084af068 in js::Invoke (cx=cx@entry=0x92d8848, args=..., construct=construct@entry=js::NO_CONSTRUCT) at js/src/vm/Interpreter.cpp:517
#26 0x084afd05 in js::Invoke (cx=0x92d8848, thisv=..., fval=..., argc=1, argv=0xf60feed0, rval=$jsval(-nan(0xfff8200000000))) at js/src/vm/Interpreter.cpp:554
#27 0x081fdeb7 in js::jit::DoCallFallback (cx=0x92d8848, frame=frame@entry=0xf60fef00, stub_=stub_@entry=0x92ec3a8, argc=argc@entry=1, vp=vp@entry=0xf60feec0, res=$jsval(-nan(0xfff8200000000))) at js/src/jit/BaselineIC.cpp:9294
#28 0x0834da69 in js::jit::Simulator::softwareInterrupt (this=0x92d7dd0, instr=0x93356fc) at js/src/jit/arm/Simulator-arm.cpp:2187
#29 0x0834adec in js::jit::Simulator::instructionDecode (this=this@entry=0x92d7dd0, instr=instr@entry=0x93356fc) at js/src/jit/arm/Simulator-arm.cpp:4162
#30 0x0835fd54 in js::jit::Simulator::execute<false> (this=0x92d7dd0) at js/src/jit/arm/Simulator-arm.cpp:4217
#31 0x0834e09d in js::jit::Simulator::callInternal (this=this@entry=0x92d7dd0, entry=entry@entry=0xf7815e50 "\377\377\377\352\360O-\351\377\377\377\352\004\320M\342\377\377\377\352\020\212-\355\377\377\377\352\r\200\240\341\377\377\377\352h\220\235\345\377\377\377\352\r\260\240\341\377\377\377\352t\240\235\345\377\377\377", <incomplete sequence \352>) at js/src/jit/arm/Simulator-arm.cpp:4305
#32 0x0834e146 in js::jit::Simulator::call (this=0x92d7dd0, entry=0xf7815e50 "\377\377\377\352\360O-\351\377\377\377\352\004\320M\342\377\377\377\352\020\212-\355\377\377\377\352\r\200\240\341\377\377\377\352h\220\235\345\377\377\377\352\r\260\240\341\377\377\377\352t\240\235\345\377\377\377", <incomplete sequence \352>, argument_count=8) at js/src/jit/arm/Simulator-arm.cpp:4388
#33 0x0818a3ff in EnterBaseline (cx=cx@entry=0x92d8848, data=...) at js/src/jit/BaselineJIT.cpp:122
#34 0x081dda13 in js::jit::EnterBaselineMethod (cx=0x92d8848, state=...) at js/src/jit/BaselineJIT.cpp:154
#35 0x084aecc4 in js::RunScript (cx=cx@entry=0x92d8848, state=...) at js/src/vm/Interpreter.cpp:438
#36 0x084aedd2 in js::ExecuteKernel (cx=cx@entry=0x92d8848, script=script@entry=0xf5d480d0, scopeChainArg=(JSObject &) @0xf5d44040 [object global] delegate, thisv=..., type=type@entry=js::EXECUTE_GLOBAL, evalInFrame=evalInFrame@entry=..., result=result@entry=0x0) at js/src/vm/Interpreter.cpp:657
#37 0x084aef27 in js::Execute (cx=0x92d8848, script=0xf5d480d0, scopeChainArg=(JSObject &) @0xf5d44040 [object global] delegate, rval=0x0) at js/src/vm/Interpreter.cpp:694
#38 0x083ac8c9 in ExecuteScript (cx=0x92d8848, obj=..., scriptArg=0xf5d480d0, rval=0x0) at js/src/jsapi.cpp:4352
#39 0x0805a4f5 in RunFile (compileOnly=false, file=0x92eb860, filename=0xffffdbd1 "min.js", obj=..., cx=0x92d8848) at js/src/shell/js.cpp:451
#40 Process (cx=cx@entry=0x92d8848, obj_=<optimized out>, filename=0xffffdbd1 "min.js", forceTTY=forceTTY@entry=false) at js/src/shell/js.cpp:584
#41 0x0805da29 in ProcessArgs (op=0xffffd87c, obj_=<optimized out>, cx=0x92d8848) at js/src/shell/js.cpp:5496
#42 Shell (op=0xffffd87c, cx=0x92d8848, envp=<optimized out>) at js/src/shell/js.cpp:5735
#43 main (argc=7, argv=0xffffda14, envp=0xffffda34) at js/src/shell/js.cpp:6075
eax	0x0	0
ebx	0x92acff4	153800692
ecx	0x92bd290	153866896
edx	0xffffb19c	-20068
esi	0x0	0
edi	0xffffb1b0	-20048
ebp	0x40	64
esp	0xffffb140	4294947136
eip	0x85036c5 <js::jit::JitcodeGlobalEntry::callStackAtAddr(JSRuntime*, void*, char const**, unsigned int) const+101>
=> 0x85036c5 <js::jit::JitcodeGlobalEntry::callStackAtAddr(JSRuntime*, void*, char const**, unsigned int) const+101>:	movl   $0x1dd,0x0
   0x85036cf <js::jit::JitcodeGlobalEntry::callStackAtAddr(JSRuntime*, void*, char const**, unsigned int) const+111>:	call   0x804aae0 <abort@plt>

Comment 1

[Christian Holler (:decoder)]

JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

Comment 2

[Lars T Hansen [:lth]]

Can't reproduce.