Closed Bug 1303015 Opened 9 years ago Closed 9 years ago

Assertion failure: !IsInsideNursery(wrapper), at js/src/proxy/CrossCompartmentWrapper.cpp:476 with OOM

Categories

(Core :: JavaScript Engine, defect)

x86_64
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla52
Tracking Status
firefox51 --- fixed
firefox52 --- fixed

People

(Reporter: decoder, Assigned: jonco)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, bugmon, testcase, Whiteboard: [jsbugmon:update][fuzzblocker])

Attachments

(1 file)

The following testcase crashes on mozilla-central revision 29af101880db (build with --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --enable-debug --enable-optimize, run with --fuzzing-safe --thread-count=2 --baseline-eager): var x = ``.split(); oomTest(function() { var lfGlobal = newGlobal(); for (lfLocal in this) { if (!(lfLocal in lfGlobal)) { lfGlobal[lfLocal] = this[lfLocal]; } } }); Backtrace: received signal SIGSEGV, Segmentation fault. 0x00000000009c7f38 in js::NukeCrossCompartmentWrapper (cx=cx@entry=0x7ffff695f000, wrapper=0x7ffff374ac78) at js/src/proxy/CrossCompartmentWrapper.cpp:476 #0 0x00000000009c7f38 in js::NukeCrossCompartmentWrapper (cx=cx@entry=0x7ffff695f000, wrapper=0x7ffff374ac78) at js/src/proxy/CrossCompartmentWrapper.cpp:476 #1 0x00000000008da34d in JSCompartment::wrap (this=this@entry=0x7fffeb290800, cx=cx@entry=0x7ffff695f000, obj=obj@entry=..., existingArg=..., existingArg@entry=...) at js/src/jscompartment.cpp:461 #2 0x000000000046d15b in JSCompartment::wrap (this=0x7fffeb290800, cx=0x7ffff695f000, vp=...) at js/src/jscompartmentinlines.h:119 #3 0x00000000009cf37b in js::CrossCompartmentWrapper::set (this=0x1da9720 <js::CrossCompartmentWrapper::singleton>, cx=0x7ffff695f000, wrapper=..., id=..., v=..., receiver=..., result=...) at js/src/proxy/CrossCompartmentWrapper.cpp:221 #4 0x00000000009c9e5c in js::Proxy::set (cx=cx@entry=0x7ffff695f000, proxy=proxy@entry=..., id=..., id@entry=..., v=..., v@entry=..., receiver_=..., receiver_@entry=..., result=...) at js/src/proxy/Proxy.cpp:334 #5 0x0000000000637512 in ProxySetProperty (cx=0x7ffff695f000, proxy=..., id=..., v=..., strict=<optimized out>) at js/src/jit/IonCaches.cpp:2538 #6 0x00007ffff7e1af08 in ?? () #7 0x0000000000000000 in ?? () rax 0x0 0 rbx 0x7ffff374ac78 140737277897848 rcx 0x7ffff6c28a2d 140737333332525 rdx 0x0 0 rsi 0x7ffff6ef7770 140737336276848 rdi 0x7ffff6ef6540 140737336272192 rbp 0x7fffffffbb90 140737488337808 rsp 0x7fffffffbb80 140737488337792 r8 0x7ffff6ef7770 140737336276848 r9 0x7ffff7fe4740 140737354024768 r10 0x58 88 r11 0x7ffff6b9f750 140737332770640 r12 0x7fffffffbca0 140737488338080 r13 0x0 0 r14 0x7fffeb290800 140737138722816 r15 0x7ffff695f000 140737330409472 rip 0x9c7f38 <js::NukeCrossCompartmentWrapper(JSContext*, JSObject*)+184> => 0x9c7f38 <js::NukeCrossCompartmentWrapper(JSContext*, JSObject*)+184>: movl $0x0,0x0 0x9c7f43 <js::NukeCrossCompartmentWrapper(JSContext*, JSObject*)+195>: ud2
autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: https://hg.mozilla.org/mozilla-central/rev/9ff810febb0a user: Terrence Cole date: Mon Apr 04 11:50:12 2016 -0700 summary: Bug 1237058 - Nursery allocate cross-compartment wrappers; r=jonco,r=terrence Jon/Terrence, is bug 1237058 a likely regressor? (note that this is a fuzzblocker)
Blocks: 1237058
Flags: needinfo?(terrence.d.cole)
Flags: needinfo?(jcoppeard)
Whiteboard: [jsbugmon:update,bisect][fuzzblocker] → [jsbugmon:update][fuzzblocker]
Since CCWs can be in the nursery now we just need to remove that assertion.
Assignee: nobody → jcoppeard
Flags: needinfo?(jcoppeard)
Attachment #8793725 - Flags: review?(terrence.d.cole)
Comment on attachment 8793725 [details] [diff] [review] bug1303015-ccw-assertions Review of attachment 8793725 [details] [diff] [review]: ----------------------------------------------------------------- Yup! I guess even in automation tests, windows always live longer than one nursery collection. I was a bit worried about putting things we know are long lived in the nursery, but it seems like there are probably few enough that it doesn't matter too much. Still, something to consider taking a look at later.
Attachment #8793725 - Flags: review?(terrence.d.cole) → review+
Clearing ni.
Flags: needinfo?(terrence.d.cole)
Pushed by jcoppeard@mozilla.com: https://hg.mozilla.org/integration/mozilla-inbound/rev/e15d82589f84 Update assertions now CCWs can be allocated in the nursery r=terrence
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla52
Jon, do you mind nominating for backport this fuzzblocker as well, to mozilla-aurora? Thanks!
Flags: needinfo?(jcoppeard)
Comment on attachment 8793725 [details] [diff] [review] bug1303015-ccw-assertions Approval Request Comment [Feature/regressing bug #]: Bug 1237058. [User impact if declined]: None, requested to help the fuzzers. [Describe test coverage new/current, TreeHerder]: On m-c since 26th September. [Risks and why]: Low [String/UUID change made/needed]: None
Flags: needinfo?(jcoppeard)
Attachment #8793725 - Flags: approval-mozilla-aurora?
Comment on attachment 8793725 [details] [diff] [review] bug1303015-ccw-assertions Fix a fuzzblocker. Take it in 51 aurora.
Attachment #8793725 - Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: