1226816 - Crash [@ ??] with --ion-shared-stubs=on

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision 0b2b0570777f (build with --enable-more-deterministic, run with --fuzzing-safe --no-threads --ion-eager --ion-shared-stubs=on):

x = 1;
x;
function g(y) {}
g(this);
x = /x/;
function f() {
    f(x.flags);
}
f();



Backtrace:


warning: core file may not match specified executable file.
[New LWP 7156]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `/home/fuzz3lin/shell-cache/js-64-dm-linux-0b2b0570777f/js-64-dm-linux-0b2b05707'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00007fa20dd4ceb4 in ?? ()


backtrace

#0  0x00007fa20dd4ceb4 in ?? ()
#1  0x0000000000000000 in ?? ()


info reg

rax            0x7fa20dc1af28	140333992226600
rbx            0x7fa20dd4cc6d	140333993479277
rcx            0xfffaffa20dc1af28	-1407778379682008
rdx            0x7ffda54a24d8	140727376553176
rsi            0x7fa20dc68f60	140333992546144
rdi            0x2002	8194
rbp            0x7ffda54a2610	0x7ffda54a2610
rsp            0x7ffda54a2518	0x7ffda54a2518
r8             0x7ffda54a2470	140727376553072
r9             0x1a	26
r10            0x3	3
r11            0x1fff3	131059
r12            0x0	0
r13            0x7ffda54a2a60	140727376554592
r14            0x7fa20dc7d100	140333992628480
r15            0x7fa20dd3f660	140333993424480
rip            0x7fa20dd4ceb4	0x7fa20dd4ceb4
eflags         0x10206	[ PF IF RF ]
cs             0x33	51
ss             0x2b	43
ds             0x0	0
es             0x0	0
fs             0x0	0
gs             0x0	0


x/8i $pc

=> 0x7fa20dd4ceb4:	mov    0x18(%rdi),%rdi
0x7fa20dd4ceb8:	jmpq   *(%rdi)
0x7fa20dd4ceba:	pop    %rdi
0x7fa20dd4cebb:	pop    %rsi
0x7fa20dd4cebc:	mov    0x8(%rdi),%rdi
0x7fa20dd4cec0:	jmpq   *(%rdi)
0x7fa20dd4cec2:	push   %rbp
0x7fa20dd4cec3:	add    (%rax),%al


thread apply all backtrace


Thread 1 (Thread 0x7fa20dd2c740 (LWP 7156)):
#0  0x00007fa20dd4ceb4 in ?? ()
#1  0x0000000000000000 in ?? ()

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

=== Treeherder Build Bisection Results by autoBisect ===

The "good" changeset has the timestamp "20151117080511" and the hash "fe34d01fb2ecb2dd4cda82e788cf7b541d5cbdb4".
The "bad" changeset has the timestamp "20151117094304" and the hash "c6139e8bad12b756a178dd7eb005c82cf247bd43".

Likely regression window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=fe34d01fb2ecb2dd4cda82e788cf7b541d5cbdb4&tochange=c6139e8bad12b756a178dd7eb005c82cf247bd43

Hannes, is bug 1214508 a likely regressor? Setting s-s because this seems to be crashing at a weird memory address, but note that it seems to require --ion-shared-stubs=on.

This blocks fuzzing with --ion-shared-stubs=on as it does not have an easy signature to ignore.

Comment 2

[Hannes Verschore [:h4writer]]

Attachment: Patch

ICGetProp_CallScripted has code that only works in baseline. We shouldn't try to run it in IonMonkey. This will need refactoring to get this stub working in IM.

Comment 3

[Jan de Mooij [:jandem]]

Comment on attachment 8693050 [details] [diff] [review]
Patch

Review of attachment 8693050 [details] [diff] [review]:
-----------------------------------------------------------------

Sorry for the delay.

Comment 4

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/0d88461fff1b

Comment 5

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/0d88461fff1b