1278193 - Assertion failure: (((report->flags) & 0x1) != 0), at js/src/shell/js.cpp:5984 with OOM

Status: RESOLVED DUPLICATE of bug 1277278

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 3e8ee3599a67 (build with --enable-optimize --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --enable-debug, run with --fuzzing-safe --no-threads):

lfLogBuffer = `
  evaluate('function g ', {newContext: true})
`.split();
loadFile(lfLogBuffer);
function loadFile(lfVarx)
  oomTest(Function(lfVarx));



Backtrace:

Program received signal SIGSEGV, Segmentation fault.
0x000000000049d58d in js::shell::WarningReporter (cx=0x7ffff5032c00, message=0xf39c9a "out of memory", report=0x7fffffffb920) at js/src/shell/js.cpp:5984
#0  0x000000000049d58d in js::shell::WarningReporter (cx=0x7ffff5032c00, message=0xf39c9a "out of memory", report=0x7fffffffb920) at js/src/shell/js.cpp:5984
#1  0x0000000000456df0 in js::ReportOutOfMemory (cxArg=cxArg@entry=0x7ffff5032c00) at js/src/jscntxt.cpp:321
#2  0x0000000000abb0dd in JSRuntime::onOutOfMemory (this=0x7ffff6965000, allocFunc=allocFunc@entry=js::AllocFunction::Calloc, nbytes=512, nbytes@entry=16, reallocPtr=reallocPtr@entry=0x0, maybecx=0x7ffff5032c00) at js/src/vm/Runtime.cpp:863
#3  0x00000000008a20a8 in js::ExclusiveContext::onOutOfMemory (reallocPtr=0x0, nbytes=16, allocFunc=js::AllocFunction::Calloc, this=<optimized out>) at js/src/jscntxt.h:172
#4  js::TempAllocPolicy::onOutOfMemory (this=this@entry=0x7ffff5032e28, allocFunc=allocFunc@entry=js::AllocFunction::Calloc, nbytes=nbytes@entry=512, reallocPtr=reallocPtr@entry=0x0) at js/src/jsalloc.cpp:16
#5  0x00000000008d0838 in js::TempAllocPolicy::onOutOfMemoryTyped<js::detail::HashTableEntry<JSObject* const> > (reallocPtr=0x0, numElems=32, allocFunc=js::AllocFunction::Calloc, this=0x7ffff5032e28) at js/src/jsalloc.h:79
#6  js::TempAllocPolicy::pod_calloc<js::detail::HashTableEntry<JSObject* const> > (this=this@entry=0x7ffff6965228, numElems=numElems@entry=32) at js/src/jsalloc.h:113
#7  0x00000000008c0d72 in js::detail::HashTable<JSObject* const, js::HashSet<JSObject*, js::MovableCellHasher<JSObject*>, js::TempAllocPolicy>::SetOps, js::TempAllocPolicy>::createTable (reportFailure=js::detail::HashTable<JSObject* const, js::HashSet<JSObject*, js::MovableCellHasher<JSObject*> >::SetOps, js::TempAllocPolicy>::ReportFailure, capacity=32, alloc=...) at js/src/debug64/dist/include/js/HashTable.h:1175
#8  js::detail::HashTable<JSObject* const, js::HashSet<JSObject*, js::MovableCellHasher<JSObject*>, js::TempAllocPolicy>::SetOps, js::TempAllocPolicy>::init (length=16, this=0x7ffff6965228) at js/src/debug64/dist/include/js/HashTable.h:1245
#9  js::HashSet<JSObject*, js::MovableCellHasher<JSObject*>, js::TempAllocPolicy>::init (len=16, this=<optimized out>) at js/src/debug64/dist/include/js/HashTable.h:334
#10 js::NewContext (rt=0x0, stackChunkSize=stackChunkSize@entry=8192) at js/src/jscntxt.cpp:99
#11 0x00000000008c0f8a in JS_NewContext (rt=<optimized out>, stackChunkSize=stackChunkSize@entry=8192) at js/src/jsapi.cpp:576
#12 0x0000000000493247 in NewContext (rt=<optimized out>) at js/src/shell/js.cpp:6501
#13 0x00000000004aaea9 in AutoNewContext::enter (this=0x7fffffffbc70, this@entry=0x1, cx=0x7ffff691ac00) at js/src/shell/js.cpp:1238
#14 0x000000000049f4be in Evaluate (cx=0x7ffff691ac00, argc=<optimized out>, vp=0x7ffff52e31a0) at js/src/shell/js.cpp:1478
#15 0x0000000000a68902 in js::CallJSNative (cx=0x7ffff691ac00, native=0x49ed90 <Evaluate(JSContext*, unsigned int, JS::Value*)>, args=...) at js/src/jscntxtinlines.h:235
#16 0x0000000000a6575f in js::InternalCallOrConstruct (cx=0x7ffff691ac00, args=..., construct=js::NO_CONSTRUCT) at js/src/vm/Interpreter.cpp:452
#17 0x0000000000a590e1 in js::CallFromStack (args=..., cx=<optimized out>) at js/src/vm/Interpreter.cpp:503
#18 Interpret (cx=0x7ffff691ac00, state=...) at js/src/vm/Interpreter.cpp:2840
#19 0x0000000000a65518 in js::RunScript (cx=cx@entry=0x7ffff691ac00, state=...) at js/src/vm/Interpreter.cpp:398
#20 0x0000000000a658b1 in js::InternalCallOrConstruct (cx=0x7ffff691ac00, args=..., construct=construct@entry=js::NO_CONSTRUCT) at js/src/vm/Interpreter.cpp:470
#21 0x0000000000a65b4b in InternalCall (cx=<optimized out>, args=...) at js/src/vm/Interpreter.cpp:497
#22 0x0000000000a65cba in js::Call (cx=<optimized out>, fval=..., fval@entry=..., thisv=..., thisv@entry=..., args=..., rval=..., rval@entry=...) at js/src/vm/Interpreter.cpp:516
#23 0x00000000008ca2fc in JS_CallFunction (cx=0x7ffff691ac00, obj=..., fun=..., fun@entry=..., args=..., rval=..., rval@entry=...) at js/src/jsapi.cpp:2885
#24 0x0000000000bc3ad0 in OOMTest (cx=0x7ffff691ac00, argc=<optimized out>, vp=<optimized out>) at js/src/builtin/TestingFunctions.cpp:1328
#25 0x0000000000a68902 in js::CallJSNative (cx=0x7ffff691ac00, native=0xbc3710 <OOMTest(JSContext*, unsigned int, JS::Value*)>, args=...) at js/src/jscntxtinlines.h:235
[...]
#38 main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at js/src/shell/js.cpp:7466
rax	0x0	0
rbx	0x7fffffffb920	140737488337184
rcx	0x7ffff6c28a10	140737333332496
rdx	0x0	0
rsi	0x7ffff6ef7770	140737336276848
rdi	0x7ffff6ef6540	140737336272192
rbp	0x7fffffffb900	140737488337152
rsp	0x7fffffffb740	140737488336704
r8	0x7ffff6ef7770	140737336276848
r9	0x7ffff7fdc780	140737353992064
r10	0x58	88
r11	0x7ffff6b9f750	140737332770640
r12	0x7ffff5032c00	140737304013824
r13	0x7ffff6ef6540	140737336272192
r14	0xf39c9a	15965338
r15	0x7ffff6989100	140737330581760
rip	0x49d58d <js::shell::WarningReporter(JSContext*, char const*, JSErrorReport*)+1325>
=> 0x49d58d <js::shell::WarningReporter(JSContext*, char const*, JSErrorReport*)+1325>:	movl   $0x1760,0x0
   0x49d598 <js::shell::WarningReporter(JSContext*, char const*, JSErrorReport*)+1336>:	callq  0x4b4030 <abort()>

Comment 1

[Jan de Mooij [:jandem]]

Good catch. We're calling the error/warning reporter right before we set autoJSAPIOwnsErrorReporting.

This will be fixed by the patches in bug 1277278.

Comment 2

[Fuzzing Team]

JSBugMon: Bisection requested, result:
=== Treeherder Build Bisection Results by autoBisect ===

The "good" changeset has the timestamp "20160115010341" and the hash "32a8c6a3be186bbc1f39da147eb09b087ed322e3".
The "bad" changeset has the timestamp "20160115014842" and the hash "df444117c7bea0a407387dca31ed54c3598b054a".

Likely regression window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=32a8c6a3be186bbc1f39da147eb09b087ed322e3&tochange=df444117c7bea0a407387dca31ed54c3598b054a

Comment 3

[Fuzzing Team]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 7f7c7d24700e).

Comment 4

[Jan de Mooij [:jandem]]

(In reply to Jan de Mooij [:jandem] from comment #1)
> Good catch. We're calling the error/warning reporter right before we set
> autoJSAPIOwnsErrorReporting.
> 
> This will be fixed by the patches in bug 1277278.

This landed. Furthermore, evaluate's newContext option was removed in bug 1278223.