1303015 - Assertion failure: !IsInsideNursery(wrapper), at js/src/proxy/CrossCompartmentWrapper.cpp:476 with OOM

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, critical)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 29af101880db (build with --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --enable-debug --enable-optimize, run with --fuzzing-safe --thread-count=2 --baseline-eager):

var x = ``.split();
oomTest(function() {
    var lfGlobal = newGlobal();
    for (lfLocal in this) {
        if (!(lfLocal in lfGlobal)) {
                lfGlobal[lfLocal] = this[lfLocal];
        }
    }
});



Backtrace:

 received signal SIGSEGV, Segmentation fault.
0x00000000009c7f38 in js::NukeCrossCompartmentWrapper (cx=cx@entry=0x7ffff695f000, wrapper=0x7ffff374ac78) at js/src/proxy/CrossCompartmentWrapper.cpp:476
#0  0x00000000009c7f38 in js::NukeCrossCompartmentWrapper (cx=cx@entry=0x7ffff695f000, wrapper=0x7ffff374ac78) at js/src/proxy/CrossCompartmentWrapper.cpp:476
#1  0x00000000008da34d in JSCompartment::wrap (this=this@entry=0x7fffeb290800, cx=cx@entry=0x7ffff695f000, obj=obj@entry=..., existingArg=..., existingArg@entry=...) at js/src/jscompartment.cpp:461
#2  0x000000000046d15b in JSCompartment::wrap (this=0x7fffeb290800, cx=0x7ffff695f000, vp=...) at js/src/jscompartmentinlines.h:119
#3  0x00000000009cf37b in js::CrossCompartmentWrapper::set (this=0x1da9720 <js::CrossCompartmentWrapper::singleton>, cx=0x7ffff695f000, wrapper=..., id=..., v=..., receiver=..., result=...) at js/src/proxy/CrossCompartmentWrapper.cpp:221
#4  0x00000000009c9e5c in js::Proxy::set (cx=cx@entry=0x7ffff695f000, proxy=proxy@entry=..., id=..., id@entry=..., v=..., v@entry=..., receiver_=..., receiver_@entry=..., result=...) at js/src/proxy/Proxy.cpp:334
#5  0x0000000000637512 in ProxySetProperty (cx=0x7ffff695f000, proxy=..., id=..., v=..., strict=<optimized out>) at js/src/jit/IonCaches.cpp:2538
#6  0x00007ffff7e1af08 in ?? ()
#7  0x0000000000000000 in ?? ()
rax	0x0	0
rbx	0x7ffff374ac78	140737277897848
rcx	0x7ffff6c28a2d	140737333332525
rdx	0x0	0
rsi	0x7ffff6ef7770	140737336276848
rdi	0x7ffff6ef6540	140737336272192
rbp	0x7fffffffbb90	140737488337808
rsp	0x7fffffffbb80	140737488337792
r8	0x7ffff6ef7770	140737336276848
r9	0x7ffff7fe4740	140737354024768
r10	0x58	88
r11	0x7ffff6b9f750	140737332770640
r12	0x7fffffffbca0	140737488338080
r13	0x0	0
r14	0x7fffeb290800	140737138722816
r15	0x7ffff695f000	140737330409472
rip	0x9c7f38 <js::NukeCrossCompartmentWrapper(JSContext*, JSObject*)+184>
=> 0x9c7f38 <js::NukeCrossCompartmentWrapper(JSContext*, JSObject*)+184>:	movl   $0x0,0x0
   0x9c7f43 <js::NukeCrossCompartmentWrapper(JSContext*, JSObject*)+195>:	ud2

Comment 1

[Gary Kwong [:gkw] [:nth10sd]]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/9ff810febb0a
user:        Terrence Cole
date:        Mon Apr 04 11:50:12 2016 -0700
summary:     Bug 1237058 - Nursery allocate cross-compartment wrappers; r=jonco,r=terrence

Jon/Terrence, is bug 1237058 a likely regressor? (note that this is a fuzzblocker)

Comment 2

[Jon Coppeard (:jonco)]

Attachment: bug1303015-ccw-assertions

Since CCWs can be in the nursery now we just need to remove that assertion.

Comment 3

[Terrence Cole [:terrence]]

Comment on attachment 8793725 [details] [diff] [review]
bug1303015-ccw-assertions

Review of attachment 8793725 [details] [diff] [review]:
-----------------------------------------------------------------

Yup! I guess even in automation tests, windows always live longer than one nursery collection. I was a bit worried about putting things we know are long lived in the nursery, but it seems like there are probably few enough that it doesn't matter too much. Still, something to consider taking a look at later.

Comment 4

[Terrence Cole [:terrence]]

Clearing ni.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/e15d82589f84
Update assertions now CCWs can be allocated in the nursery r=terrence

Comment 6

[Iris Hsiao [:ihsiao]]

https://hg.mozilla.org/mozilla-central/rev/e15d82589f84

Comment 7

[Gary Kwong [:gkw] [:nth10sd]]

Jon, do you mind nominating for backport this fuzzblocker as well, to mozilla-aurora? Thanks!

Comment 8

[Jon Coppeard (:jonco)]

Comment on attachment 8793725 [details] [diff] [review]
bug1303015-ccw-assertions

Approval Request Comment
[Feature/regressing bug #]: Bug 1237058.
[User impact if declined]: None, requested to help the fuzzers.
[Describe test coverage new/current, TreeHerder]: On m-c since 26th September.
[Risks and why]: Low
[String/UUID change made/needed]: None

Comment 9

[Gerry Chang [:gchang]]

Comment on attachment 8793725 [details] [diff] [review]
bug1303015-ccw-assertions

Fix a fuzzblocker. Take it in 51 aurora.

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/9942a916850c