1292564 - Assertion failure: CurrentThreadIsGCSweeping(), at js/src/jsweakmap.cpp:35 with OOM and Debugger

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 1576e7bc1bec (build with --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --enable-debug --enable-optimize, run with --fuzzing-safe --ion-offthread-compile=off):

loadFile(`
  global = newGlobal();
  Debugger(global).onDebuggerStatement = function (frame) {
    frame.eval("f")
  }
  global.eval("function f(n){printprintprint} debugger");
`);
loadFile(lfLogBuffer);
function loadFile(lfVarx) 
  oomTest(Function(lfVarx))



Backtrace:

 received signal SIGSEGV, Segmentation fault.
0x00000000009958f8 in js::WeakMapBase::~WeakMapBase (this=0x7fffed05a400, __in_chrg=<optimized out>) at js/src/jsweakmap.cpp:35
#0  0x00000000009958f8 in js::WeakMapBase::~WeakMapBase (this=0x7fffed05a400, __in_chrg=<optimized out>) at js/src/jsweakmap.cpp:35
#1  0x0000000000b1ea0e in js::WeakMap<js::HeapPtr<JSObject*>, js::HeapPtr<JS::Value>, js::MovableCellHasher<js::HeapPtr<JSObject*> > >::~WeakMap (this=0x7fffed05a400, __in_chrg=<optimized out>) at js/src/jsweakmap.h:120
#2  js::ObjectValueMap::~ObjectValueMap (this=0x7fffed05a400, __in_chrg=<optimized out>) at js/src/jsweakmap.h:376
#3  js::ObjectWeakMap::~ObjectWeakMap (this=0x7fffed05a400, __in_chrg=<optimized out>) at js/src/jsweakmap.h:390
#4  js::DebugScopes::~DebugScopes (this=0x7fffed05a400, __in_chrg=<optimized out>) at js/src/vm/ScopeObject.cpp:2494
#5  0x0000000000b1ec76 in js_delete<js::DebugScopes> (p=0x7fffed05a400) at /srv/jenkins/jobs/mozilla-central-build-jsshell/workspace/arch/64/compiler/gcc/sanitizer/none/type/debug/dist/include/js/Utility.h:382
#6  JS::DeletePolicy<js::DebugScopes>::operator() (this=<optimized out>, ptr=0x7fffed05a400) at /srv/jenkins/jobs/mozilla-central-build-jsshell/workspace/arch/64/compiler/gcc/sanitizer/none/type/debug/dist/include/js/Utility.h:484
#7  mozilla::UniquePtr<js::DebugScopes, JS::DeletePolicy<js::DebugScopes> >::reset (aPtr=0x0, this=<synthetic pointer>) at /srv/jenkins/jobs/mozilla-central-build-jsshell/workspace/arch/64/compiler/gcc/sanitizer/none/type/debug/dist/include/mozilla/UniquePtr.h:343
#8  mozilla::UniquePtr<js::DebugScopes, JS::DeletePolicy<js::DebugScopes> >::~UniquePtr (this=<synthetic pointer>, __in_chrg=<optimized out>) at /srv/jenkins/jobs/mozilla-central-build-jsshell/workspace/arch/64/compiler/gcc/sanitizer/none/type/debug/dist/include/mozilla/UniquePtr.h:288
#9  js::DebugScopes::ensureCompartmentData (cx=cx@entry=0x7ffff6965000) at js/src/vm/ScopeObject.cpp:2596
#10 0x0000000000b1ed68 in js::DebugScopes::addDebugScope (cx=cx@entry=0x7ffff6965000, scope=..., debugScope=...) at js/src/vm/ScopeObject.cpp:2630
#11 0x0000000000b2b789 in GetDebugScopeForScope (si=..., cx=0x7ffff6965000) at js/src/vm/ScopeObject.cpp:2985
#12 GetDebugScope (cx=0x7ffff6965000, si=...) at js/src/vm/ScopeObject.cpp:3106
#13 0x0000000000b2b60e in GetDebugScope (cx=0x7ffff6965000, si=...) at js/src/vm/ScopeObject.cpp:3112
#14 0x0000000000b2ba0d in GetDebugScopeForMissing (si=..., cx=0x7ffff6965000) at js/src/vm/ScopeObject.cpp:3000
#15 GetDebugScope (cx=0x7ffff6965000, si=...) at js/src/vm/ScopeObject.cpp:3109
#16 0x0000000000b2c23b in js::GetDebugScopeForFrame (cx=cx@entry=0x7ffff6965000, frame=..., pc=pc@entry=0x7ffff69b7331 "sș\215\t\210\037\212\b") at js/src/vm/ScopeObject.cpp:3137
#17 0x0000000000a551fb in DebuggerGenericEval (cx=cx@entry=0x7ffff6965000, bindings=bindings@entry=..., options=..., vp=..., dbg=0x7fffe63d3000, scope=..., iter=0x7fffffff9a58, chars=...) at js/src/vm/Debugger.cpp:7961
#18 0x0000000000a56bfd in DebuggerFrame_eval (cx=0x7ffff6965000, argc=<optimized out>, vp=<optimized out>) at js/src/vm/Debugger.cpp:8025
#19 0x00007ffff7ff59a5 in ?? ()
#20 0x0000000000000216 in ?? ()
#21 0x00007fffffff9f00 in ?? ()
#22 0x0000000000000000 in ?? ()
rax	0x0	0
rbx	0x7fffed05a400	140737169957888
rcx	0x7ffff6c28a2d	140737333332525
rdx	0x0	0
rsi	0x7ffff6ef7770	140737336276848
rdi	0x7ffff6ef6540	140737336272192
rbp	0x7fffffff9040	140737488326720
rsp	0x7fffffff9030	140737488326704
r8	0x7ffff6ef7770	140737336276848
r9	0x7ffff7fdc740	140737353992000
r10	0x0	0
r11	0x0	0
r12	0x0	0
r13	0x7fffed05a400	140737169957888
r14	0x0	0
r15	0x0	0
rip	0x9958f8 <js::WeakMapBase::~WeakMapBase()+264>
=> 0x9958f8 <js::WeakMapBase::~WeakMapBase()+264>:	movl   $0x0,0x0
   0x995903 <js::WeakMapBase::~WeakMapBase()+275>:	ud2

Comment 1

[Fuzzing Team]

JSBugMon: Bisection requested, result:
=== Treeherder Build Bisection Results by autoBisect ===

The "good" changeset has the timestamp "20151013053056" and the hash "8d9c20c241be7d7b3cfa90a3368a77db42172781".
The "bad" changeset has the timestamp "20151013054956" and the hash "d80f9d6921f8209ef01aa730be9a97ab727704d1".

Likely regression window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=8d9c20c241be7d7b3cfa90a3368a77db42172781&tochange=d80f9d6921f8209ef01aa730be9a97ab727704d1

Comment 2

[Jon Coppeard (:jonco)]

Simplified test case:

oomTest(() => {
    let global = newGlobal();
    Debugger(global).onDebuggerStatement = function (frame) {
        frame.eval("f")
    }
    global.eval("debugger")
}, false);

Comment 3

[Jon Coppeard (:jonco)]

Attachment: bug1292564-debug-scope-oom

I messed up part of the fix for bug 1288780 by adding a DeletePolicy that did the wrong thing, for the wrong class.  Fortunately the fuzzers found the problem.

Comment 4

[Terrence Cole [:terrence]]

Comment on attachment 8779383 [details] [diff] [review]
bug1292564-debug-scope-oom

Review of attachment 8779383 [details] [diff] [review]:
-----------------------------------------------------------------

Wow, nice find indeed!

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/3d8a4df99f0f
Fix OOM handling while constructing DebugScopes r=terrence

Comment 6

[Pulsebot]

Backout by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/1b6779af98aa
Backed out changeset 3d8a4df99f0f for rooting hazards

Comment 7

[Jon Coppeard (:jonco)]

I'm going to add roots in a couple of places and re-land.

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/c205c2aeb5db
Fix OOM handling while constructing DebugScopes r=terrence

Comment 9

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/c205c2aeb5db

Comment 10

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Jon, it will be nice if we could have this backported to aurora, thanks!

Comment 11

[Jon Coppeard (:jonco)]

Comment on attachment 8779383 [details] [diff] [review]
bug1292564-debug-scope-oom

Approval Request Comment
[Feature/regressing bug #]: Bug 1288780.
[User impact if declined]: Possible crashes on OOM.
[Describe test coverage new/current, TreeHerder]: On m-c since August 11th.
[Risks and why]: Low.
[String/UUID change made/needed]: None.

Comment 12

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Comment on attachment 8779383 [details] [diff] [review]
bug1292564-debug-scope-oom

Crash fix, has stabilized on Nightly for a few days, Aurora50+

Comment 13

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/b263ff7776f2