If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

Crash [@ js::ExclusiveContext::addPendingCompileError] with OOM

RESOLVED FIXED in Firefox 46

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
2 years ago
a year ago

People

(Reporter: decoder, Assigned: jandem)

Tracking

(Blocks: 2 bugs, {crash, regression, testcase})

Trunk
mozilla46
x86_64
Linux
crash, regression, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox46 fixed)

Details

(Whiteboard: [jsbugmon:update], crash signature)

Attachments

(1 attachment)

(Reporter)

Description

2 years ago
The following testcase crashes on mozilla-central revision 749f9328dd76 (build with --enable-optimize --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --enable-debug, run with --fuzzing-safe --thread-count=2):

oomTest(() => {
    offThreadCompileScript("function a(x) {");
    runOffThreadScript();
});



Backtrace:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7ffff5cc3700 (LWP 41702)]
0x0000000000a10d68 in js::ExclusiveContext::addPendingCompileError (this=0x7ffff45028b0) at js/src/vm/HelperThreads.cpp:1342
#0  0x0000000000a10d68 in js::ExclusiveContext::addPendingCompileError (this=0x7ffff45028b0) at js/src/vm/HelperThreads.cpp:1342
#1  0x0000000000bc0425 in js::frontend::TokenStream::reportCompileErrorNumberVA (this=0x7ffff5cc1ec0, offset=14, flags=0, errorNumber=164, args=0x7ffff5cc0fc8) at js/src/frontend/TokenStream.cpp:620
#2  0x00000000004e3bc7 in js::frontend::Parser<js::frontend::SyntaxParseHandler>::report (this=this@entry=0x7ffff5cc1e90, kind=kind@entry=js::frontend::ParseError, strict=strict@entry=false, pn=pn@entry=js::frontend::SyntaxParseHandler::NodeFailure, errorNumber=<optimized out>) at js/src/frontend/Parser.cpp:599
#3  0x00000000004f76d6 in js::frontend::Parser<js::frontend::SyntaxParseHandler>::functionArgsAndBodyGeneric (this=this@entry=0x7ffff5cc1e90, inHandling=inHandling@entry=js::frontend::InAllowed, yieldHandling=yieldHandling@entry=js::frontend::YieldIsName, pn=pn@entry=js::frontend::SyntaxParseHandler::NodeGeneric, fun=..., fun@entry=..., kind=kind@entry=js::frontend::Statement) at js/src/frontend/Parser.cpp:2977
#4  0x00000000004d72a5 in js::frontend::Parser<js::frontend::FullParseHandler>::functionArgsAndBody (this=this@entry=0x7ffff5cc23e0, inHandling=inHandling@entry=js::frontend::InAllowed, pn=0x7ffff3c60058, fun=..., fun@entry=..., kind=kind@entry=js::frontend::Statement, generatorKind=generatorKind@entry=js::NotGenerator, inheritedDirectives=..., newDirectives=newDirectives@entry=0x7ffff5cc1600) at js/src/frontend/Parser.cpp:2766
#5  0x00000000004ffdda in js::frontend::Parser<js::frontend::FullParseHandler>::functionDef (this=this@entry=0x7ffff5cc23e0, inHandling=inHandling@entry=js::frontend::InAllowed, yieldHandling=yieldHandling@entry=js::frontend::YieldIsName, funName=..., funName@entry=..., kind=kind@entry=js::frontend::Statement, generatorKind=generatorKind@entry=js::NotGenerator, invoked=invoked@entry=js::frontend::Parser<js::frontend::FullParseHandler>::PredictUninvoked) at js/src/frontend/Parser.cpp:2634
#6  0x00000000005000a9 in js::frontend::Parser<js::frontend::FullParseHandler>::functionStmt (this=this@entry=0x7ffff5cc23e0, yieldHandling=yieldHandling@entry=js::frontend::YieldIsName, defaultHandling=defaultHandling@entry=js::frontend::NameRequired) at js/src/frontend/Parser.cpp:3083
#7  0x00000000004fec3d in js::frontend::Parser<js::frontend::FullParseHandler>::statement (this=this@entry=0x7ffff5cc23e0, yieldHandling=yieldHandling@entry=js::frontend::YieldIsName, canHaveDirectives=<optimized out>) at js/src/frontend/Parser.cpp:6908
#8  0x00000000004ff141 in js::frontend::Parser<js::frontend::FullParseHandler>::statements (this=this@entry=0x7ffff5cc23e0, yieldHandling=yieldHandling@entry=js::frontend::YieldIsName) at js/src/frontend/Parser.cpp:3306
#9  0x00000000004d68ba in js::frontend::Parser<js::frontend::FullParseHandler>::globalBody (this=this@entry=0x7ffff5cc23e0) at js/src/frontend/Parser.cpp:1055
#10 0x0000000000b9f778 in BytecodeCompiler::compileScript (this=this@entry=0x7ffff5cc1d70, scopeChain=..., scopeChain@entry=..., evalCaller=evalCaller@entry=...) at js/src/frontend/BytecodeCompiler.cpp:527
#11 0x0000000000b9fdeb in js::frontend::CompileScript (cx=cx@entry=0x7ffff45028b0, alloc=alloc@entry=0x7ffff46d77c8, scopeChain=scopeChain@entry=..., enclosingStaticScope=..., enclosingStaticScope@entry=..., evalCaller=evalCaller@entry=..., options=..., srcBuf=..., source_=source_@entry=0x0, extraSct=extraSct@entry=0x0, sourceObjectOut=sourceObjectOut@entry=0x7ffff46d7838) at js/src/frontend/BytecodeCompiler.cpp:738
#12 0x0000000000a12547 in js::HelperThread::handleParseWorkload (this=this@entry=0x7ffff6933800) at js/src/vm/HelperThreads.cpp:1388
#13 0x0000000000a13b0e in js::HelperThread::threadLoop (this=0x7ffff6933800) at js/src/vm/HelperThreads.cpp:1584
#14 0x0000000000a94ee1 in nspr::Thread::ThreadRoutine (arg=0x7ffff692e160) at js/src/vm/PosixNSPR.cpp:45
#15 0x00007ffff7bc4182 in start_thread (arg=0x7ffff5cc3700) at pthread_create.c:312
#16 0x00007ffff6cb3fbd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111
rax	0x0	0
rbx	0x7ffff5cc0ac0	140737317178048
rcx	0x7ffff6ca53cd	140737333842893
rdx	0x0	0
rsi	0x7ffff6f7a9d0	140737336814032
rdi	0x7ffff6f791c0	140737336807872
rbp	0x7ffff5cc09e0	140737317177824
rsp	0x7ffff5cc09a0	140737317177760
r8	0x7ffff5cc3700	140737317189376
r9	0x6372732f736a2f6c	7165916604736876396
r10	0x7ffff5cc0760	140737317177184
r11	0x7ffff6c27960	140737333328224
r12	0x7ffff45028b0	140737292282032
r13	0xa4	164
r14	0x7ffff5cc1ec0	140737317183168
r15	0x0	0
rip	0xa10d68 <js::ExclusiveContext::addPendingCompileError()+536>
=> 0xa10d68 <js::ExclusiveContext::addPendingCompileError()+536>:	movl   $0x53e,0x0
   0xa10d73 <js::ExclusiveContext::addPendingCompileError()+547>:	callq  0x4a3db0 <abort()>

Updated

2 years ago
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]

Comment 1

2 years ago
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/de72e2291ae8
user:        Jan de Mooij
date:        Wed Dec 09 22:55:50 2015 -0500
summary:     Bug 1225396 part 3 - Make %GeneratorPrototype% inherit from %IteratorPrototype%. r=jorendorff

This iteration took 276.877 seconds to run.
Jan, is bug 1225396 a likely regressor?
Blocks: 1225396
Flags: needinfo?(jdemooij)
(Assignee)

Comment 3

2 years ago
Created attachment 8699443 [details] [diff] [review]
Patch

I don't see how bug 1225396 is related but here's a patch.

In addPendingCompileError we have to use AutoEnterOOMUnsafeRegion instead of MOZ_CRASH. We were also missing an OOM check in TraceLogger code.
Assignee: nobody → jdemooij
Status: NEW → ASSIGNED
Flags: needinfo?(jdemooij)
Attachment #8699443 - Flags: review?(jcoppeard)
(Assignee)

Updated

2 years ago
No longer blocks: 1225396

Updated

2 years ago
Attachment #8699443 - Flags: review?(jcoppeard) → review+

Comment 4

2 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/a2af02211477

Comment 5

2 years ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/a2af02211477
Status: ASSIGNED → RESOLVED
Last Resolved: 2 years ago
status-firefox46: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla46
Blocks: 1265667
You need to log in before you can comment on or make changes to this bug.