Closed
Bug 1308563
Opened 8 years ago
Closed 8 years ago
Assertion failure: OffsetToChunkEnd(src) >= ptrdiff_t(srcSize), at js/src/gc/Marking.cpp:2512 with TypedArray
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 1302682
Tracking | Status | |
---|---|---|
firefox52 | --- | affected |
People
(Reporter: decoder, Unassigned)
Details
(4 keywords, Whiteboard: [jsbugmon:update,bisect])
The following testcase crashes on mozilla-central revision 777fb63db8de (build with --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --enable-debug --enable-optimize, run with --fuzzing-safe --thread-count=2 min.js):
for (var i = 0; i < 30000; i++) {
var a = inIon() ? 1 : 300;
var obj = new Uint8ClampedArray(a);
(function() {}) * this;
}
f();
Backtrace:
received signal SIGSEGV, Segmentation fault.
0x0000000000d5aac8 in js::TenuringTracer::moveObjectToTenured (this=this@entry=0x7fffffffcaa0, dst=dst@entry=0x7ffff3684220, src=src@entry=0x7ffff30fffa8, dstKind=dstKind@entry=js::gc::AllocKind::OBJECT8_BACKGROUND) at js/src/gc/Marking.cpp:2512
#0 0x0000000000d5aac8 in js::TenuringTracer::moveObjectToTenured (this=this@entry=0x7fffffffcaa0, dst=dst@entry=0x7ffff3684220, src=src@entry=0x7ffff30fffa8, dstKind=dstKind@entry=js::gc::AllocKind::OBJECT8_BACKGROUND) at js/src/gc/Marking.cpp:2512
#1 0x0000000000d5b183 in js::TenuringTracer::moveToTenured (this=this@entry=0x7fffffffcaa0, src=0x7ffff30fffa8) at js/src/gc/Marking.cpp:2406
#2 0x0000000000d5b4ac in js::TenuringTracer::traverse<JSObject> (this=0x7fffffffcaa0, objp=0x7fffffffc8b0) at js/src/gc/Marking.cpp:2226
#3 0x0000000000d6942c in js::TenuringTraversalFunctor<JS::Value>::operator()<JSObject> (this=<synthetic pointer>, trc=0x7fffffffcaa0, t=0x7ffff30fffa8) at js/src/gc/Marking.cpp:2232
#4 js::DispatchTyped<js::TenuringTraversalFunctor<JS::Value>, js::TenuringTracer*>(js::TenuringTraversalFunctor<JS::Value>, JS::Value const&, js::TenuringTracer*&&) (f=..., val=...) at /srv/jenkins/jobs/mozilla-central-build-jsshell/workspace/arch/64/compiler/gcc/sanitizer/none/type/debug/dist/include/js/Value.h:1919
#5 0x0000000000d5b7a1 in js::TenuringTracer::traverse<JS::Value> (thingp=0x7ffff3322a38, this=0x7fffffffcaa0) at js/src/gc/Marking.cpp:2241
#6 js::TenuringTracer::traceSlots (end=<optimized out>, vp=0x7ffff3322a38, this=0x7fffffffcaa0) at js/src/gc/Marking.cpp:2482
#7 js::TenuringTracer::traceObjectSlots (this=this@entry=0x7fffffffcaa0, nobj=nobj@entry=0x7ffff3678060, start=start@entry=0, length=<optimized out>) at js/src/gc/Marking.cpp:2475
#8 0x0000000000d5bbdc in js::TenuringTracer::traceObject (this=this@entry=0x7fffffffcaa0, obj=obj@entry=0x7ffff3678060) at js/src/gc/Marking.cpp:2461
#9 0x0000000000d5bf75 in TraceWholeCell (object=0x7ffff3678060, mover=...) at js/src/gc/Marking.cpp:2297
#10 TraceBufferedCells<JSObject> (cells=<optimized out>, arena=<optimized out>, mover=...) at js/src/gc/Marking.cpp:2331
#11 js::gc::StoreBuffer::traceWholeCells (this=this@entry=0x7ffff6944d88, mover=...) at js/src/gc/Marking.cpp:2348
#12 0x0000000000d8bf09 in js::Nursery::doCollection (this=this@entry=0x7ffff69449e8, rt=rt@entry=0x7ffff6944208, reason=reason@entry=JS::gcreason::OUT_OF_NURSERY, tenureCounts=...) at js/src/gc/Nursery.cpp:685
#13 0x0000000000d8c8cf in js::Nursery::collect (this=this@entry=0x7ffff69449e8, rt=0x7ffff6944208, reason=reason@entry=JS::gcreason::OUT_OF_NURSERY) at js/src/gc/Nursery.cpp:581
#14 0x00000000009390ff in js::gc::GCRuntime::minorGC (this=this@entry=0x7ffff6944990, reason=reason@entry=JS::gcreason::OUT_OF_NURSERY, phase=phase@entry=js::gcstats::PHASE_MINOR_GC) at js/src/jsgc.cpp:6540
#15 0x0000000000d48c61 in js::gc::GCRuntime::tryNewNurseryObject<(js::AllowGC)1> (this=this@entry=0x7ffff6944990, cx=cx@entry=0x7ffff6944000, thingSize=thingSize@entry=64, nDynamicSlots=nDynamicSlots@entry=0, clasp=clasp@entry=0x1d975e0 <JSFunction::class_>) at js/src/gc/Allocator.cpp:87
#16 0x0000000000d4d488 in js::Allocate<JSObject, (js::AllowGC)1> (cx=cx@entry=0x7ffff6944000, kind=kind@entry=js::gc::AllocKind::FIRST, nDynamicSlots=0, heap=heap@entry=js::gc::DefaultHeap, clasp=clasp@entry=0x1d975e0 <JSFunction::class_>) at js/src/gc/Allocator.cpp:51
#17 0x00000000009c1339 in JSObject::create (cx=0x7ffff6944000, kind=js::gc::AllocKind::FIRST, heap=js::gc::DefaultHeap, shape=..., group=...) at js/src/jsobjinlines.h:378
#18 0x000000000099a589 in NewObject (cx=0x7ffff6944000, group=..., kind=js::gc::AllocKind::FIRST, newKind=js::GenericObject, initialShapeFlags=<optimized out>) at js/src/jsobj.cpp:668
#19 0x000000000099adf2 in js::NewObjectWithClassProtoCommon (cx=cx@entry=0x7ffff6944000, clasp=clasp@entry=0x1d975e0 <JSFunction::class_>, protoArg=..., protoArg@entry=..., allocKind=allocKind@entry=js::gc::AllocKind::FIRST, newKind=newKind@entry=js::GenericObject) at js/src/jsobj.cpp:788
#20 0x000000000095c4cf in js::NewObjectWithClassProto (newKind=js::GenericObject, allocKind=js::gc::AllocKind::FIRST, proto=..., clasp=0x1d975e0 <JSFunction::class_>, cx=0x7ffff6944000) at js/src/jsobjinlines.h:727
#21 NewFunctionClone (cx=cx@entry=0x7ffff6944000, fun=..., fun@entry=..., newKind=newKind@entry=js::GenericObject, allocKind=allocKind@entry=js::gc::AllocKind::FIRST, proto=..., proto@entry=...) at js/src/jsfun.cpp:2059
#22 0x000000000095cf9e in js::CloneFunctionReuseScript (cx=cx@entry=0x7ffff6944000, fun=fun@entry=..., enclosingEnv=enclosingEnv@entry=..., allocKind=allocKind@entry=js::gc::AllocKind::FIRST, newKind=newKind@entry=js::GenericObject, proto=proto@entry=...) at js/src/jsfun.cpp:2094
#23 0x0000000000b3b703 in js::CloneFunctionObjectIfNotSingleton (cx=cx@entry=0x7ffff6944000, fun=..., fun@entry=..., parent=..., proto=..., proto@entry=..., newKind=newKind@entry=js::GenericObject) at js/src/jsfuninlines.h:89
#24 0x0000000000b08596 in js::Lambda (cx=0x7ffff6944000, fun=..., parent=...) at js/src/vm/Interpreter.cpp:4306
#25 0x00007ffff7e44a70 in ?? ()
#26 0x0000000000000000 in ?? ()
rax 0x0 0
rbx 0x7ffff30fffa8 140737271300008
rcx 0x7ffff6c28a2d 140737333332525
rdx 0x0 0
rsi 0x7ffff6ef7770 140737336276848
rdi 0x7ffff6ef6540 140737336272192
rbp 0x7fffffffc800 140737488340992
rsp 0x7fffffffc740 140737488340800
r8 0x7ffff6ef7770 140737336276848
r9 0x7ffff7fe4740 140737354024768
r10 0x58 88
r11 0x7ffff6b9f750 140737332770640
r12 0x60 96
r13 0x7ffff3684220 140737277084192
r14 0x7ffff3684220 140737277084192
r15 0x9 9
rip 0xd5aac8 <js::TenuringTracer::moveObjectToTenured(JSObject*, JSObject*, js::gc::AllocKind)+728>
=> 0xd5aac8 <js::TenuringTracer::moveObjectToTenured(JSObject*, JSObject*, js::gc::AllocKind)+728>: movl $0x0,0x0
0xd5aad3 <js::TenuringTracer::moveObjectToTenured(JSObject*, JSObject*, js::gc::AllocKind)+739>: ud2
Comment 1•8 years ago
|
||
I probably should have held off landing this assertion until the fix for bug 1302682 landed.
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → DUPLICATE
Updated•6 years ago
|
Group: javascript-core-security
You need to log in
before you can comment on or make changes to this bug.
Description
•