1240527 - Assertion failure: pdata, at js/src/vm/RegExpStatics.cpp:33 with OOM

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 8cb42e7a16b4 (build with --enable-optimize --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --enable-debug, run with --fuzzing-safe --thread-count=2 --ion-extra-checks):

offThreadCompileScript(`
 oomTest(() => "".search(/d/));
 fullcompartmentchecks(3);
`);
runOffThreadScript();



Backtrace:

Program received signal SIGSEGV, Segmentation fault.
0x0000000000abb225 in resc_trace (trc=<optimized out>, obj=<optimized out>) at js/src/vm/RegExpStatics.cpp:33
#0  0x0000000000abb225 in resc_trace (trc=<optimized out>, obj=<optimized out>) at js/src/vm/RegExpStatics.cpp:33
#1  0x000000000094c0f1 in JSObject::traceChildren (this=0x7ffff7e7a070, trc=0x7fffffffd388) at js/src/jsobj.cpp:3861
#2  0x0000000000903b1a in js::gc::GCRuntime::checkForCompartmentMismatches (this=this@entry=0x7ffff695d420) at js/src/jsgc.cpp:3931
#3  0x00000000009235a5 in js::gc::GCRuntime::beginMarkPhase (this=this@entry=0x7ffff695d420, reason=reason@entry=JS::gcreason::DESTROY_CONTEXT) at js/src/jsgc.cpp:3960
#4  0x0000000000925974 in js::gc::GCRuntime::incrementalCollectSlice (this=this@entry=0x7ffff695d420, budget=..., reason=reason@entry=JS::gcreason::DESTROY_CONTEXT) at js/src/jsgc.cpp:6086
#5  0x0000000000926890 in js::gc::GCRuntime::gcCycle (this=this@entry=0x7ffff695d420, nonincrementalByAPI=nonincrementalByAPI@entry=true, budget=..., reason=reason@entry=JS::gcreason::DESTROY_CONTEXT) at js/src/jsgc.cpp:6342
#6  0x0000000000926dc1 in js::gc::GCRuntime::collect (this=this@entry=0x7ffff695d420, nonincrementalByAPI=nonincrementalByAPI@entry=true, budget=..., reason=reason@entry=JS::gcreason::DESTROY_CONTEXT) at js/src/jsgc.cpp:6448
#7  0x0000000000926ff3 in js::gc::GCRuntime::gc (this=this@entry=0x7ffff695d420, gckind=gckind@entry=GC_NORMAL, reason=reason@entry=JS::gcreason::DESTROY_CONTEXT) at js/src/jsgc.cpp:6506
#8  0x00000000008d3c1c in js::DestroyContext (cx=0x7ffff6907800, mode=js::DCM_FORCE_GC) at js/src/jscntxt.cpp:181
#9  0x00000000008d3e6e in JS_DestroyContext (cx=<optimized out>) at js/src/jsapi.cpp:580
#10 0x000000000047db9f in DestroyContext (withGC=true, cx=0x7ffff6907800) at js/src/shell/js.cpp:6089
#11 main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at js/src/shell/js.cpp:6994
rax	0x0	0
rbx	0x0	0
rcx	0x7ffff6ca53cd	140737333842893
rdx	0x0	0
rsi	0x7ffff6f7a9d0	140737336814032
rdi	0x7ffff6f791c0	140737336807872
rbp	0x7fffffffd2d0	140737488343760
rsp	0x7fffffffd2c0	140737488343744
r8	0x7ffff7fe0780	140737354008448
r9	0x6372732f736a2f6c	7165916604736876396
r10	0x7fffffffd080	140737488343168
r11	0x7ffff6c27960	140737333328224
r12	0x7ffff7e7a070	140737352540272
r13	0x7fffffffd388	140737488343944
r14	0x4	4
r15	0x7fffffffd388	140737488343944
rip	0xabb225 <resc_trace(JSTracer*, JSObject*)+181>
=> 0xabb225 <resc_trace(JSTracer*, JSObject*)+181>:	movl   $0x21,0x0
   0xabb230 <resc_trace(JSTracer*, JSObject*)+192>:	callq  0x4a2e10 <abort()>

Comment 1

[Benjamin Bouvier [:bbouvier] (inactive)]

Attachment: regexp.patch

Comment 2

[Nicolas B. Pierron [:nbp]]

Comment on attachment 8709075 [details] [diff] [review]
regexp.patch

Review of attachment 8709075 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/vm/RegExpStatics.cpp
@@ +30,5 @@
>  resc_trace(JSTracer* trc, JSObject* obj)
>  {
>      void* pdata = obj->as<RegExpStaticsObject>().getPrivate();
> +    if (pdata)
> +        static_cast<RegExpStatics*>(pdata)->mark(trc);

I guess this case is possible if we OOM inside RegExpStatics::create, right?

Comment 3

[Benjamin Bouvier [:bbouvier] (inactive)]

(In reply to Nicolas B. Pierron [:nbp] from comment #2)
> I guess this case is possible if we OOM inside RegExpStatics::create, right?

Yes indeed.

Comment 4

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/bdaf35f4626f

Comment 5

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/bdaf35f4626f