1240803 - Assertion failure: !Debugger::inFrameMaps(f), at js/src/jit/RematerializedFrame.cpp:109 with OOM

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision a77b73c7723e (build with --enable-optimize --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --enable-debug, run with --fuzzing-safe --thread-count=2 --ion-extra-checks --ion-eager --ion-offthread-compile=off):

(function() {
    g = newGlobal()
    dbg = new Debugger
    g.toggle = function(d) {
        if (d) {
            dbg.addDebuggee(g);
            dbg.getNewestFrame();
            oomAfterAllocations(2);
            setBreakpoint;
        }
    }
    g.eval("" + function f(d) toggle(d))
    g.eval("(" + function() {
        f(false);
        f(true);
    } + ")()")
})();



Backtrace:

Program received signal SIGSEGV, Segmentation fault.
0x0000000000790138 in js::jit::RematerializedFrame::FreeInVector (frames=...) at js/src/jit/RematerializedFrame.cpp:109
#0  0x0000000000790138 in js::jit::RematerializedFrame::FreeInVector (frames=...) at js/src/jit/RematerializedFrame.cpp:109
#1  0x0000000000b134e1 in js::jit::JitActivation::clearRematerializedFrames (this=this@entry=0x7fffffff98a0) at js/src/vm/Stack.cpp:1561
#2  0x0000000000b15487 in js::jit::JitActivation::~JitActivation (this=0x7fffffff98a0, __in_chrg=<optimized out>) at js/src/vm/Stack.cpp:1485
#3  0x00000000006b8852 in EnterIon (data=..., cx=0x7ffff6907800) at js/src/jit/Ion.cpp:2718
#4  js::jit::IonCannon (cx=cx@entry=0x7ffff6907800, state=...) at js/src/jit/Ion.cpp:2816
#5  0x0000000000a4b73b in js::RunScript (cx=cx@entry=0x7ffff6907800, state=...) at js/src/vm/Interpreter.cpp:408
#6  0x0000000000a4b97c in js::Invoke (cx=cx@entry=0x7ffff6907800, args=..., construct=construct@entry=js::NO_CONSTRUCT) at js/src/vm/Interpreter.cpp:499
#7  0x0000000000a4d339 in js::Invoke (cx=cx@entry=0x7ffff6907800, thisv=..., fval=..., argc=argc@entry=1, argv=argv@entry=0x7fffffffa248, rval=..., rval@entry=...) at js/src/vm/Interpreter.cpp:533
#8  0x00000000006017de in js::jit::DoCallFallback (cx=0x7ffff6907800, frame=0x7fffffffa288, stub_=<optimized out>, argc=<optimized out>, vp=0x7fffffffa238, res=...) at js/src/jit/BaselineIC.cpp:6186
#9  0x00007ffff7ff1a1f in ?? ()
[...]
#31 0x0000000000000000 in ?? ()
rax	0x0	0
rbx	0x7ffff6922d60	140737330163040
rcx	0x7ffff6ca53cd	140737333842893
rdx	0x0	0
rsi	0x7ffff6f7a9d0	140737336814032
rdi	0x7ffff6f791c0	140737336807872
rbp	0x7fffffff9680	140737488328320
rsp	0x7fffffff9660	140737488328288
r8	0x7ffff7fe0780	140737354008448
r9	0x6372732f736a2f6c	7165916604736876396
r10	0x7fffffff9420	140737488327712
r11	0x7ffff6c27960	140737333328224
r12	0x0	0
r13	0x7ffff69ae8c8	140737330735304
r14	0x7fffffff9780	140737488328576
r15	0x7ffff6907800	140737330051072
rip	0x790138 <js::jit::RematerializedFrame::FreeInVector(mozilla::Vector<js::jit::RematerializedFrame*, 0ul, js::TempAllocPolicy>&)+312>
=> 0x790138 <js::jit::RematerializedFrame::FreeInVector(mozilla::Vector<js::jit::RematerializedFrame*, 0ul, js::TempAllocPolicy>&)+312>:	movl   $0x6d,0x0
   0x790143 <js::jit::RematerializedFrame::FreeInVector(mozilla::Vector<js::jit::RematerializedFrame*, 0ul, js::TempAllocPolicy>&)+323>:	callq  0x4a2e10 <abort()>

Comment 1

[Terrence Cole [:terrence]]

JIT + OOM + CCW + Debugger. Fuzzers are mean. Shu, can you take a look?

Comment 2

[Shu-yu Guo [:shu]]

Attachment: Handle OOM in replaceFrameGuts.

Comment 3

[Jim Blandy :jimb]

Comment on attachment 8709801 [details] [diff] [review]
Handle OOM in replaceFrameGuts.

Review of attachment 8709801 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/vm/Debugger.cpp
@@ +5419,5 @@
> +        }
> +
> +        // Rekey missingScopes to maintain Debugger.Environment identity and
> +        // forward liveScopes to point to the new frame.
> +        // gone.

Looks like the copy-paste of this comment went awry.

Comment 4

[Shu-yu Guo [:shu]]

(In reply to Jim Blandy :jimb from comment #3)
> Comment on attachment 8709801 [details] [diff] [review]
> Handle OOM in replaceFrameGuts.
> 
> Review of attachment 8709801 [details] [diff] [review]:
> -----------------------------------------------------------------
> 
> ::: js/src/vm/Debugger.cpp
> @@ +5419,5 @@
> > +        }
> > +
> > +        // Rekey missingScopes to maintain Debugger.Environment identity and
> > +        // forward liveScopes to point to the new frame.
> > +        // gone.
> 
> Looks like the copy-paste of this comment went awry.

Oops, thanks eagle eye!

Comment 5

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/96fd3c4b8bfd

Comment 6

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/96fd3c4b8bfd