1128490 - Crash [@ compartment] with use-after-free

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 940118b1adcd (build with --enable-optimize --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --enable-debug, run with --fuzzing-safe --thread-count=2 --ion-regalloc=backtracking):

for (var i = 0; i < 1000; ++i)
(function() {
  var isNotEmpty = function (obj) {
    for (var foo = 0 ; i < arguments.length; (function  (   )  {  }  )   [ 0   ]     ++) {
      var o = arguments[i];
    }
  };
  isNotEmpty([1]);
})();



Backtrace:

Program received signal SIGSEGV, Segmentation fault.
compartment (this=0x7ffff57000e0) at js/src/jit/shared/MoveEmitter-x86-shared.cpp:510
510	}
#0  compartment (this=0x7ffff57000e0) at js/src/jit/shared/MoveEmitter-x86-shared.cpp:510
#1  js::jit::AssertValidObjectPtr (cx=0x1a1cb70, obj=0x7ffff57000e0) at js/src/jit/VMFunctions.cpp:1177
#2  0x00007ffff55f2415 in ?? ()
#3  0x00007fffffffc560 in ?? ()
#4  0x00007fffffffc4f0 in ?? ()
#5  0xfffc7ffff57000e0 in ?? ()
#6  0x7ff8000000000000 in ?? ()
#7  0x3ff0000000000000 in ?? ()
#8  0x0000000000000000 in ?? ()
rax	0x2b2b2b2b2b2b2b2b	3110627432037296939
rbx	0x7ffff57000e0	140737311146208
rcx	0xfffbffffffffffff	-1125899906842625
rdx	0x0	0
rsi	0x7ffff57000e0	140737311146208
rdi	0x1a1cb70	27380592
rbp	0x7fffffffc4d0	140737488340176
rsp	0x7fffffffc4b0	140737488340144
r8	0x7ff8000000000000	9221120237041090560
r9	0x7ffff5700000	140737311145984
r10	0x7fffffffc1c0	140737488339392
r11	0x7fffffffc380	140737488339840
r12	0x1a1cb70	27380592
r13	0x1a908d8	27855064
r14	0x7ffff575f100	140737311535360
r15	0x0	0
rip	0x978baa <js::jit::AssertValidObjectPtr(JSContext*, JSObject*)+42>
=> 0x978baa <js::jit::AssertValidObjectPtr(JSContext*, JSObject*)+42>:	mov    (%rax),%rax
   0x978bad <js::jit::AssertValidObjectPtr(JSContext*, JSObject*)+45>:	mov    (%rdi),%rdi


This is likely a use-after-free according to the crash pattern (GGC nursery poison pattern).

Comment 1

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/629c8aac3ece
user:        Brian Hackett
date:        Fri Jan 23 12:42:34 2015 -0700
summary:     Bug 934502 - Remove unnecessary pushedArgumentSlots, track argument slots explicitly in safepoints, r=jandem.

This iteration took 307.626 seconds to run.

Comment 2

[Brian Hackett [Laid off!]]

Attachment: patch

If a frame uses lazy arguments then its formals are not marked as aliased (like I thought) and but Ion uses special instructions to access the frame arguments directly.  In this case marking the Ion frame needs to mark the formals as well as the actuals, and we need to be sure that the backtracking allocator doesn't spill other vregs to argument slots.

Comment 3

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/7152dc5221cb

Comment 4

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

Backed out in https://hg.mozilla.org/integration/mozilla-inbound/rev/6f42cfe37f5c for spidermonkey errors:
https://treeherder.mozilla.org/logviewer.html#?job_id=6476130&repo=mozilla-inbound

Comment 5

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

Looks like some xpcshell failures, too: https://treeherder.mozilla.org/logviewer.html#?job_id=6478295&repo=mozilla-inbound

Comment 6

[Brian Hackett [Laid off!]]

Whoops, the script for a MIR graph can be null of course.

https://hg.mozilla.org/integration/mozilla-inbound/rev/141b3ae089e9

Comment 7

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/141b3ae089e9

Comment 8

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.
JSBugMon: This bug has been automatically verified fixed on Fx38