1306913 - MOZ_ASSERT crashes in ShellOpenAsmJSCacheEntryForWrite() while running jit-tests

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan Beich]

After bug 900669 comment 78 many tests started to fail but nowadays the list is short

    js/src/jit-test/tests/asm.js/testCaching.js
    --wasm-always-baseline js/src/jit-test/tests/asm.js/testCaching.js
    js/src/jit-test/tests/asm.js/testCloning.js
    --wasm-always-baseline js/src/jit-test/tests/asm.js/testCloning.js
    js/src/jit-test/tests/asm.js/testBullet.js
    --wasm-always-baseline js/src/jit-test/tests/asm.js/testBullet.js
    js/src/jit-test/tests/asm.js/testHeapAccess.js
    --wasm-always-baseline js/src/jit-test/tests/asm.js/testHeapAccess.js
    js/src/jit-test/tests/asm.js/testSource.js
    --wasm-always-baseline js/src/jit-test/tests/asm.js/testSource.js
    js/src/jit-test/tests/asm.js/testStackWalking.js
    --wasm-always-baseline js/src/jit-test/tests/asm.js/testStackWalking.js
    js/src/jit-test/tests/latin1/asm.js

which points at

  * thread #1: tid = 101293, 0x0000000000438c1f js`ShellOpenAsmJSCacheEntryForWrite(global=<unavailable>, installed=<unavailable>, begin=<unavailable>, end=<unavailable>, serializedSize=5216, memoryOut=0x00007fffffffbab0, handleOut=0x0000000802ba5c6a) + 255 at js.cpp:6850, stop reason = signal SIGSEGV: address access protected (fault address: 0x801d37000)
      frame #0: 0x0000000000438c1f js`ShellOpenAsmJSCacheEntryForWrite(global=<unavailable>, installed=<unavailable>, begin=<unavailable>, end=<unavailable>, serializedSize=5216, memoryOut=0x00007fffffffbab0, handleOut=0x0000000802ba5c6a) + 255 at js.cpp:6850
     6847
     6848     // The embedding added the cookie so strip it off of the buffer returned to
     6849     // the JS engine. The asmJSCacheCookie will be written on close, below.
  -> 6850     MOZ_ASSERT(*(uint32_t*)memory == 0);
     6851     *memoryOut = (uint8_t*)memory + sizeof(uint32_t);
     6852     *handleOut = fd.forget();
     6853     return JS::AsmJSCache_Success;

Comment 1

[Jan Beich]

Attachment: Bug 1306913 - Allow MOZ_ASSERT to check contents before disabling PROT_READ.

Review commit: https://reviewboard.mozilla.org/r/82592/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/82592/

Comment 2

[Luke Wagner [:luke]]

Comment on attachment 8796886 [details]
Bug 1306913 - Allow MOZ_ASSERT to check contents before disabling PROT_READ.

https://reviewboard.mozilla.org/r/82592/#review81404

Oh wow, that's a pretty silly bug, thanks!  I guess FreeBSD is the only OS to prevent reads when only PROT_WRITE?

Comment 3

[Jan Beich]

Attachment: simplified test case

(In reply to Luke Wagner [:luke] from comment #2)
> FreeBSD is the only OS to prevent reads when only PROT_WRITE?

No, write() to stdout succeeds but dereferencing crashes. This also happens at least on DragonFly and OpenBSD. -fsanitize=address shows something but not enough without symbols.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/5a0c00314737
Allow MOZ_ASSERT to check contents before disabling PROT_READ. r=luke

Comment 5

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/5a0c00314737