1299103 - Assertion failure: cx_->runtime()->profilingActivation_ == this, at js/src/vm/Stack.cpp:1685 with OOM

Status: RESOLVED DUPLICATE of bug 1293311

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 4f72b1d05267 (build with --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --enable-debug --without-intl-api --enable-optimize --target=i686-pc-linux-gnu, run with --fuzzing-safe --ion-offthread-compile=off):

lfLogBuffer = `function eval(source) {}`.split();
lfCodeBuffer = ""
while (true) {
    line = lfLogBuffer.shift()
    if (line == null) {
        loadFile(lfCodeBuffer)
        lfCodeBuffer = ""
    }
    lfCodeBuffer += line + "\n"
}
function loadFile(lfVarx) {
    oomTest(function() {
        eval(lfVarx)
    })
}



Backtrace:

 received signal SIGSEGV, Segmentation fault.
0x0875a2e6 in js::Activation::unregisterProfiling (this=0xffffc118) at js/src/vm/Stack.cpp:1685
#0  0x0875a2e6 in js::Activation::unregisterProfiling (this=0xffffc118) at js/src/vm/Stack.cpp:1685
#1  0x08777c89 in js::jit::JitActivation::~JitActivation (this=0xffffc118, __in_chrg=<optimized out>) at js/src/vm/Stack.cpp:1406
#2  0x081f889e in EnterBaseline (cx=cx@entry=0xf7953000, data=...) at js/src/jit/BaselineJIT.cpp:146
#3  0x082261c4 in js::jit::EnterBaselineAtBranch (cx=0xf7953000, fp=0xf1233018, pc=0xf1234771 "\343\201C\b\377\377\377\225晝\f\210\t\230\001ш\016ɐ\321(p\235\004\210\004\231\003\220\210\004ш\aɐ\017\226\210\bӐ\210\bј\t\210\004ܘ\003\210\aɘ\f\230\020\210\001") at js/src/jit/BaselineJIT.cpp:263
#4  0x086fbf9d in Interpret (cx=0xf7953000, state=...) at js/src/vm/Interpreter.cpp:1911
[...]
#14 main (argc=4, argv=0xffffcde4, envp=0xffffcdf8) at js/src/shell/js.cpp:7623
eax	0x0	0
ebx	0xffffc118	-16104
ecx	0xf7da4864	-136689564
edx	0x0	0
esi	0x8c33ff4	147013620
edi	0xffffc2c0	-15680
ebp	0xffffc068	4294951016
esp	0xffffc060	4294951008
eip	0x875a2e6 <js::Activation::unregisterProfiling()+182>
=> 0x875a2e6 <js::Activation::unregisterProfiling()+182>:	movl   $0x0,0x0
   0x875a2f0 <js::Activation::unregisterProfiling()+192>:	ud2

Comment 1

[Fuzzing Team]

JSBugMon: Bisection requested, failed due to error (try manually).

Comment 2

[Fuzzing Team]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision b7f7ae14590a).

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Due to skipped revisions, the first bad revision could be any of:
changeset:   https://hg.mozilla.org/mozilla-central/rev/cb6fc6d38f8d
user:        Shu-yu Guo
date:        Thu Aug 25 01:28:47 2016 -0700
summary:     Bug 1263355 - Rewrite the frontend: bindings. (r=jorendorff,Waldo)

changeset:   https://hg.mozilla.org/mozilla-central/rev/18bec78f348e
user:        Shu-yu Guo
date:        Thu Aug 25 01:28:47 2016 -0700
summary:     Bug 1263355 - Report memory metrics for Scopes. (r=njn)


autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/d128c9990a76
parent:      311975:3d9cabea1e56
user:        Jan de Mooij
date:        Wed Aug 31 10:58:15 2016 +0200
summary:     Bug 1298878 - Don't store the actual builtin constructor properties on the global in reserved slots. r=Waldo

Jan, is bug 1263355 a likely regressor and bug 1298878 a likely fix?

Comment 4

[Jan de Mooij [:jandem]]

This is bug 1293311.

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Setting core-security-release because bug 1293311 is marked as such.