1199952 - Crash [@ js::TypeSet::GetValueType] with Debugger

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 7db14bebae91 (build with --enable-optimize --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --enable-debug, run with --fuzzing-safe --thread-count=2 --ion-extra-checks --ion-eager):

var g = newGlobal();
g.parent = this;
g.eval(`
  var dbg = new Debugger();
  var parentw = dbg.addDebuggee(parent);
  dbg.onIonCompilation = function (graph) {};
`);
gczeal(7,1);
var findNearestDateBefore = function(start, predicate) {
    var current = start;
    var month = 1000 * 60 * 60 * 24 * 30;
    for (var step = month; step > 0; step = Math.floor(step / 3)) {
        !predicate(current);
        current = new Date(current.getTime() + step);
    }
};
var juneDate = new Date(2000, 5, 20, 0, 0, 0, 0);
var decemberDate = new Date(2000, 11, 20, 0, 0, 0, 0);
var juneOffset = juneDate.getTimezoneOffset();
var decemberOffset = decemberDate.getTimezoneOffset();
var isSouthernHemisphere = (juneOffset > decemberOffset);
var winterTime = isSouthernHemisphere ? juneDate : decemberDate;
var dstStart = findNearestDateBefore(winterTime, function (date) {})();



Backtrace:

Program received signal SIGSEGV, Segmentation fault.
js::TypeSet::GetValueType (val=...) at js/src/vm/ObjectGroup.h:200
#0  js::TypeSet::GetValueType (val=...) at js/src/vm/ObjectGroup.h:200
#1  0x00000000008f3eef in SetArgument (value=..., arg=0, script=0x7ffff7e62300, cx=0x7ffff6907000) at js/src/vm/TypeInference-inl.h:635
#2  js::jit::DoTypeMonitorFallback (cx=0x7ffff6907000, frame=<optimized out>, stub=0x7ffff69ccc88, value=..., res=...) at js/src/jit/BaselineIC.cpp:522
#3  0x00007ffff7feff2b in ?? ()
[...]
#15 0x0000000000000000 in ?? ()
rax	0x7ffff4800781	140737295419265
rbx	0x7ffff6907000	140737330049024
rcx	0xfffbffffffffffff	-1125899906842625
rdx	0xfffc2b2b2b2b2b2b	-1078435499005141
rsi	0x7ffff69ccc88	140737330859144
rdi	0x7fffffffc090	140737488339088
rbp	0x7fffffffbf40	140737488338752
rsp	0x7fffffffbf40	140737488338752
r8	0x7fffffffc058	140737488339032
r9	0x7ffff6930170	140737330217328
r10	0x7fffffffc080	140737488339072
r11	0xfff9000000000000	-1970324836974592
r12	0x7fffffffc090	140737488339088
r13	0x7ffff69ccc88	140737330859144
r14	0x7fffffffc058	140737488339032
r15	0x7fffffffbf80	140737488338816
rip	0x51c5cc <js::TypeSet::GetValueType(JS::Value const&)+124>
=> 0x51c5cc <js::TypeSet::GetValueType(JS::Value const&)+124>:	mov    0x18(%rdx),%ecx
   0x51c5cf <js::TypeSet::GetValueType(JS::Value const&)+127>:	test   $0x2,%cl


Not marking s-s as it seems to require the debugger.

Comment 1

[Fuzzing Team]

JSBugMon: Bisection requested, result:
=== Treeherder Build Bisection Results by autoBisect ===

The "good" changeset has the timestamp "20150816173138" and the hash "6fc3ec170fb24e211b579428edb255c67d1d363a".
The "bad" changeset has the timestamp "20150817145539" and the hash "bd4464cd4be8c21f898058a7feeec7fcbdcaf8b4".

Likely regression window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=6fc3ec170fb24e211b579428edb255c67d1d363a&tochange=bd4464cd4be8c21f898058a7feeec7fcbdcaf8b4

Comment 2

[Fuzzing Team]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 6ca9518d7cf9).

Comment 3

[Christian Holler (:decoder)]

I think this is an intermittent issue. I filed bug 1204726 with a test that also uses "dbg.onIonCompilation" so it might be related.

Comment 4

[Jan de Mooij [:jandem]]

For me it's not intermittent, so I bisected this too:

The first bad revision is:
changeset:   257986:3bbd0d929128
user:        Hannes Verschore <[e-mail]>
date:        Fri Aug 14 17:57:57 2015 +0200
summary:     Bug 1178834: IonMonkey - Always lazy link code, r=jandem

Will take a closer look.

Comment 5

[Jan de Mooij [:jandem]]

Attachment: Patch

MarkThisAndArguments has to mark formal arguments if we have a lazy link frame.

Comment 6

[Nicolas B. Pierron [:nbp]]

Comment on attachment 8663775 [details] [diff] [review]
Patch

Review of attachment 8663775 [details] [diff] [review]:
-----------------------------------------------------------------

Nice catch!

Comment 7

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/e64d983ee34e

Comment 8

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/e64d983ee34e