1308563 - Assertion failure: OffsetToChunkEnd(src) >= ptrdiff_t(srcSize), at js/src/gc/Marking.cpp:2512 with TypedArray

Status: RESOLVED DUPLICATE of bug 1302682

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 777fb63db8de (build with --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --enable-debug --enable-optimize, run with --fuzzing-safe --thread-count=2 min.js):

for (var i = 0; i < 30000; i++) {
    var a = inIon() ? 1 : 300;
    var obj = new Uint8ClampedArray(a);
    (function() {}) * this;
}
f();


Backtrace:

 received signal SIGSEGV, Segmentation fault.
0x0000000000d5aac8 in js::TenuringTracer::moveObjectToTenured (this=this@entry=0x7fffffffcaa0, dst=dst@entry=0x7ffff3684220, src=src@entry=0x7ffff30fffa8, dstKind=dstKind@entry=js::gc::AllocKind::OBJECT8_BACKGROUND) at js/src/gc/Marking.cpp:2512
#0  0x0000000000d5aac8 in js::TenuringTracer::moveObjectToTenured (this=this@entry=0x7fffffffcaa0, dst=dst@entry=0x7ffff3684220, src=src@entry=0x7ffff30fffa8, dstKind=dstKind@entry=js::gc::AllocKind::OBJECT8_BACKGROUND) at js/src/gc/Marking.cpp:2512
#1  0x0000000000d5b183 in js::TenuringTracer::moveToTenured (this=this@entry=0x7fffffffcaa0, src=0x7ffff30fffa8) at js/src/gc/Marking.cpp:2406
#2  0x0000000000d5b4ac in js::TenuringTracer::traverse<JSObject> (this=0x7fffffffcaa0, objp=0x7fffffffc8b0) at js/src/gc/Marking.cpp:2226
#3  0x0000000000d6942c in js::TenuringTraversalFunctor<JS::Value>::operator()<JSObject> (this=<synthetic pointer>, trc=0x7fffffffcaa0, t=0x7ffff30fffa8) at js/src/gc/Marking.cpp:2232
#4  js::DispatchTyped<js::TenuringTraversalFunctor<JS::Value>, js::TenuringTracer*>(js::TenuringTraversalFunctor<JS::Value>, JS::Value const&, js::TenuringTracer*&&) (f=..., val=...) at /srv/jenkins/jobs/mozilla-central-build-jsshell/workspace/arch/64/compiler/gcc/sanitizer/none/type/debug/dist/include/js/Value.h:1919
#5  0x0000000000d5b7a1 in js::TenuringTracer::traverse<JS::Value> (thingp=0x7ffff3322a38, this=0x7fffffffcaa0) at js/src/gc/Marking.cpp:2241
#6  js::TenuringTracer::traceSlots (end=<optimized out>, vp=0x7ffff3322a38, this=0x7fffffffcaa0) at js/src/gc/Marking.cpp:2482
#7  js::TenuringTracer::traceObjectSlots (this=this@entry=0x7fffffffcaa0, nobj=nobj@entry=0x7ffff3678060, start=start@entry=0, length=<optimized out>) at js/src/gc/Marking.cpp:2475
#8  0x0000000000d5bbdc in js::TenuringTracer::traceObject (this=this@entry=0x7fffffffcaa0, obj=obj@entry=0x7ffff3678060) at js/src/gc/Marking.cpp:2461
#9  0x0000000000d5bf75 in TraceWholeCell (object=0x7ffff3678060, mover=...) at js/src/gc/Marking.cpp:2297
#10 TraceBufferedCells<JSObject> (cells=<optimized out>, arena=<optimized out>, mover=...) at js/src/gc/Marking.cpp:2331
#11 js::gc::StoreBuffer::traceWholeCells (this=this@entry=0x7ffff6944d88, mover=...) at js/src/gc/Marking.cpp:2348
#12 0x0000000000d8bf09 in js::Nursery::doCollection (this=this@entry=0x7ffff69449e8, rt=rt@entry=0x7ffff6944208, reason=reason@entry=JS::gcreason::OUT_OF_NURSERY, tenureCounts=...) at js/src/gc/Nursery.cpp:685
#13 0x0000000000d8c8cf in js::Nursery::collect (this=this@entry=0x7ffff69449e8, rt=0x7ffff6944208, reason=reason@entry=JS::gcreason::OUT_OF_NURSERY) at js/src/gc/Nursery.cpp:581
#14 0x00000000009390ff in js::gc::GCRuntime::minorGC (this=this@entry=0x7ffff6944990, reason=reason@entry=JS::gcreason::OUT_OF_NURSERY, phase=phase@entry=js::gcstats::PHASE_MINOR_GC) at js/src/jsgc.cpp:6540
#15 0x0000000000d48c61 in js::gc::GCRuntime::tryNewNurseryObject<(js::AllowGC)1> (this=this@entry=0x7ffff6944990, cx=cx@entry=0x7ffff6944000, thingSize=thingSize@entry=64, nDynamicSlots=nDynamicSlots@entry=0, clasp=clasp@entry=0x1d975e0 <JSFunction::class_>) at js/src/gc/Allocator.cpp:87
#16 0x0000000000d4d488 in js::Allocate<JSObject, (js::AllowGC)1> (cx=cx@entry=0x7ffff6944000, kind=kind@entry=js::gc::AllocKind::FIRST, nDynamicSlots=0, heap=heap@entry=js::gc::DefaultHeap, clasp=clasp@entry=0x1d975e0 <JSFunction::class_>) at js/src/gc/Allocator.cpp:51
#17 0x00000000009c1339 in JSObject::create (cx=0x7ffff6944000, kind=js::gc::AllocKind::FIRST, heap=js::gc::DefaultHeap, shape=..., group=...) at js/src/jsobjinlines.h:378
#18 0x000000000099a589 in NewObject (cx=0x7ffff6944000, group=..., kind=js::gc::AllocKind::FIRST, newKind=js::GenericObject, initialShapeFlags=<optimized out>) at js/src/jsobj.cpp:668
#19 0x000000000099adf2 in js::NewObjectWithClassProtoCommon (cx=cx@entry=0x7ffff6944000, clasp=clasp@entry=0x1d975e0 <JSFunction::class_>, protoArg=..., protoArg@entry=..., allocKind=allocKind@entry=js::gc::AllocKind::FIRST, newKind=newKind@entry=js::GenericObject) at js/src/jsobj.cpp:788
#20 0x000000000095c4cf in js::NewObjectWithClassProto (newKind=js::GenericObject, allocKind=js::gc::AllocKind::FIRST, proto=..., clasp=0x1d975e0 <JSFunction::class_>, cx=0x7ffff6944000) at js/src/jsobjinlines.h:727
#21 NewFunctionClone (cx=cx@entry=0x7ffff6944000, fun=..., fun@entry=..., newKind=newKind@entry=js::GenericObject, allocKind=allocKind@entry=js::gc::AllocKind::FIRST, proto=..., proto@entry=...) at js/src/jsfun.cpp:2059
#22 0x000000000095cf9e in js::CloneFunctionReuseScript (cx=cx@entry=0x7ffff6944000, fun=fun@entry=..., enclosingEnv=enclosingEnv@entry=..., allocKind=allocKind@entry=js::gc::AllocKind::FIRST, newKind=newKind@entry=js::GenericObject, proto=proto@entry=...) at js/src/jsfun.cpp:2094
#23 0x0000000000b3b703 in js::CloneFunctionObjectIfNotSingleton (cx=cx@entry=0x7ffff6944000, fun=..., fun@entry=..., parent=..., proto=..., proto@entry=..., newKind=newKind@entry=js::GenericObject) at js/src/jsfuninlines.h:89
#24 0x0000000000b08596 in js::Lambda (cx=0x7ffff6944000, fun=..., parent=...) at js/src/vm/Interpreter.cpp:4306
#25 0x00007ffff7e44a70 in ?? ()
#26 0x0000000000000000 in ?? ()
rax	0x0	0
rbx	0x7ffff30fffa8	140737271300008
rcx	0x7ffff6c28a2d	140737333332525
rdx	0x0	0
rsi	0x7ffff6ef7770	140737336276848
rdi	0x7ffff6ef6540	140737336272192
rbp	0x7fffffffc800	140737488340992
rsp	0x7fffffffc740	140737488340800
r8	0x7ffff6ef7770	140737336276848
r9	0x7ffff7fe4740	140737354024768
r10	0x58	88
r11	0x7ffff6b9f750	140737332770640
r12	0x60	96
r13	0x7ffff3684220	140737277084192
r14	0x7ffff3684220	140737277084192
r15	0x9	9
rip	0xd5aac8 <js::TenuringTracer::moveObjectToTenured(JSObject*, JSObject*, js::gc::AllocKind)+728>
=> 0xd5aac8 <js::TenuringTracer::moveObjectToTenured(JSObject*, JSObject*, js::gc::AllocKind)+728>:	movl   $0x0,0x0
   0xd5aad3 <js::TenuringTracer::moveObjectToTenured(JSObject*, JSObject*, js::gc::AllocKind)+739>:	ud2

Comment 1

[Jon Coppeard (:jonco)]

I probably should have held off landing this assertion until the fix for bug 1302682 landed.