1133143 - Crash [@ js::jit::AssemblerBufferWithConstantPools] involving oomAfterAllocations

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

try {
    f()
} catch (e) {
    +e
}
try {
    Function(" \
        for (var j = 0; j < 9; ++j) { \
            try { \
                undefined() \
            } catch (e) { \
                +e \
            } \
        } \
        oomAfterAllocations(27); \
        neuter(x, ""); \
    ")()
} catch (e) {
    +e
}

crashes js debug shell on m-c changeset 81f979b17fbd with --fuzzing-safe --no-threads --ion-eager at js::jit::AssemblerBufferWithConstantPools.

Debug configure options:

LD=ld CROSS_COMPILE=1 CC="clang -Qunused-arguments -msse2 -mfpmath=sse -arch i386" RANLIB=ranlib CXX="clang++ -Qunused-arguments -msse2 -mfpmath=sse -arch i386" AS=$CC AR=ar STRIP="strip -x -S" HOST_CC="clang -Qunused-arguments -msse2 -mfpmath=sse" AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 HOST_CXX="clang++ -Qunused-arguments -msse2 -mfpmath=sse" sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=i386-apple-darwin9.2.0 --enable-macos-target=10.5 --enable-arm-simulator --enable-debug --enable-optimize --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

python -u ~/fuzzing/js/compileShell.py -b "--enable-debug --enable-optimize --enable-more-deterministic --enable-nspr-build --32 --enable-arm-simulator -R ~/trees/mozilla-central" -r 81f979b17fbd

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/364dae502747
user:        Jeff Walden
date:        Wed Jul 17 12:14:39 2013 -0700
summary:     Bug 894653 - Self-host Error.prototype.toString, and fix an edge-case bug in the current implementation.  r=till

Waldo, is bug 894653 a likely regressor?

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

(lldb) bt 5
* thread #1: tid = 0x909ad, 0x986de1c7 libsystem_platform.dylib`_platform_memmove$VARIANT$sse42 + 215, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0)
  * frame #0: 0x986de1c7 libsystem_platform.dylib`_platform_memmove$VARIANT$sse42 + 215
    frame #1: 0x006ae7e2 js-dbg-32-dm-nsprBuild-armSim-darwin-81f979b17fbd`js::jit::AssemblerBufferWithConstantPools<1024ul, 4ul, js::jit::Instruction, js::jit::Assembler>::finishPool() [inlined] void mozilla::PodAssign<js::jit::Pool>(aDst=<unavailable>, aSrc=0xbfffd934) + 50 at PodOperations.h:87
    frame #2: 0x006ae7b0 js-dbg-32-dm-nsprBuild-armSim-darwin-81f979b17fbd`js::jit::AssemblerBufferWithConstantPools<1024ul, 4ul, js::jit::Instruction, js::jit::Assembler>::finishPool() [inlined] void mozilla::PodCopy<js::jit::Pool>(aDst=0x00000430, aNElem=<unavailable>) at PodOperations.h:107
    frame #3: 0x006ae7b0 js-dbg-32-dm-nsprBuild-armSim-darwin-81f979b17fbd`js::jit::AssemblerBufferWithConstantPools<1024ul, 4ul, js::jit::Instruction, js::jit::Assembler>::finishPool(this=<unavailable>) + 1184 at IonAssemblerBufferWithConstantPools.h:689
    frame #4: 0x0063de8f js-dbg-32-dm-nsprBuild-armSim-darwin-81f979b17fbd`js::jit::Assembler::finish() [inlined] js::jit::AssemblerBufferWithConstantPools<1024ul, 4ul, js::jit::Instruction, js::jit::Assembler>::flushPool(this=0xbfffd4b4) + 40 at IonAssemblerBufferWithConstantPools.h:703
(lldb)

Comment 2

[Jeff Walden [:Waldo]]

It might have caused things to break, but I suspect only because the self-hosted version perturbs allocations just enough to cause a failure.  Calling a JSNative version of the method wouldn't have those allocations.  Nothing in my patch seems likely to be intrinsically responsible for the problem here, so I'm punting this back.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Forwarding to Marty due to this being related to the ARM simulator.

Comment 4

[Christian Holler (:decoder)]

JSBugMon: Cannot process bug: Error: Failed to isolate test from comment

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Bouncing to Jan - Marty is no longer paid staff with Mozilla. Maybe this is related to bug 1130672?

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I can no longer reproduce this with m-c rev caf25344f73e.

Comment 7

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

For archival purposes, there likely was a mistake in the testcase in comment 0, the real one is:

try {
    f()
} catch (e) {
    +e
}
try {
    Function(" \
        for (var j = 0; j < 9; ++j) { \
            try { \
                undefined() \
            } catch (e) { \
                +e \
            } \
        } \
        oomAfterAllocations(2); \
        neuter(x, \"\"); \
    ")()
} catch (e) {
    +e
}


I've rechecked that both testcases WFM per comment 6.