Closed Bug 1308563 Opened 8 years ago Closed 8 years ago

Assertion failure: OffsetToChunkEnd(src) >= ptrdiff_t(srcSize), at js/src/gc/Marking.cpp:2512 with TypedArray

Categories

(Core :: JavaScript Engine, defect)

x86_64
Linux
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 1302682
Tracking Status
firefox52 --- affected

People

(Reporter: decoder, Unassigned)

Details

(4 keywords, Whiteboard: [jsbugmon:update,bisect])

The following testcase crashes on mozilla-central revision 777fb63db8de (build with --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --enable-debug --enable-optimize, run with --fuzzing-safe --thread-count=2 min.js): for (var i = 0; i < 30000; i++) { var a = inIon() ? 1 : 300; var obj = new Uint8ClampedArray(a); (function() {}) * this; } f(); Backtrace: received signal SIGSEGV, Segmentation fault. 0x0000000000d5aac8 in js::TenuringTracer::moveObjectToTenured (this=this@entry=0x7fffffffcaa0, dst=dst@entry=0x7ffff3684220, src=src@entry=0x7ffff30fffa8, dstKind=dstKind@entry=js::gc::AllocKind::OBJECT8_BACKGROUND) at js/src/gc/Marking.cpp:2512 #0 0x0000000000d5aac8 in js::TenuringTracer::moveObjectToTenured (this=this@entry=0x7fffffffcaa0, dst=dst@entry=0x7ffff3684220, src=src@entry=0x7ffff30fffa8, dstKind=dstKind@entry=js::gc::AllocKind::OBJECT8_BACKGROUND) at js/src/gc/Marking.cpp:2512 #1 0x0000000000d5b183 in js::TenuringTracer::moveToTenured (this=this@entry=0x7fffffffcaa0, src=0x7ffff30fffa8) at js/src/gc/Marking.cpp:2406 #2 0x0000000000d5b4ac in js::TenuringTracer::traverse<JSObject> (this=0x7fffffffcaa0, objp=0x7fffffffc8b0) at js/src/gc/Marking.cpp:2226 #3 0x0000000000d6942c in js::TenuringTraversalFunctor<JS::Value>::operator()<JSObject> (this=<synthetic pointer>, trc=0x7fffffffcaa0, t=0x7ffff30fffa8) at js/src/gc/Marking.cpp:2232 #4 js::DispatchTyped<js::TenuringTraversalFunctor<JS::Value>, js::TenuringTracer*>(js::TenuringTraversalFunctor<JS::Value>, JS::Value const&, js::TenuringTracer*&&) (f=..., val=...) at /srv/jenkins/jobs/mozilla-central-build-jsshell/workspace/arch/64/compiler/gcc/sanitizer/none/type/debug/dist/include/js/Value.h:1919 #5 0x0000000000d5b7a1 in js::TenuringTracer::traverse<JS::Value> (thingp=0x7ffff3322a38, this=0x7fffffffcaa0) at js/src/gc/Marking.cpp:2241 #6 js::TenuringTracer::traceSlots (end=<optimized out>, vp=0x7ffff3322a38, this=0x7fffffffcaa0) at js/src/gc/Marking.cpp:2482 #7 js::TenuringTracer::traceObjectSlots (this=this@entry=0x7fffffffcaa0, nobj=nobj@entry=0x7ffff3678060, start=start@entry=0, length=<optimized out>) at js/src/gc/Marking.cpp:2475 #8 0x0000000000d5bbdc in js::TenuringTracer::traceObject (this=this@entry=0x7fffffffcaa0, obj=obj@entry=0x7ffff3678060) at js/src/gc/Marking.cpp:2461 #9 0x0000000000d5bf75 in TraceWholeCell (object=0x7ffff3678060, mover=...) at js/src/gc/Marking.cpp:2297 #10 TraceBufferedCells<JSObject> (cells=<optimized out>, arena=<optimized out>, mover=...) at js/src/gc/Marking.cpp:2331 #11 js::gc::StoreBuffer::traceWholeCells (this=this@entry=0x7ffff6944d88, mover=...) at js/src/gc/Marking.cpp:2348 #12 0x0000000000d8bf09 in js::Nursery::doCollection (this=this@entry=0x7ffff69449e8, rt=rt@entry=0x7ffff6944208, reason=reason@entry=JS::gcreason::OUT_OF_NURSERY, tenureCounts=...) at js/src/gc/Nursery.cpp:685 #13 0x0000000000d8c8cf in js::Nursery::collect (this=this@entry=0x7ffff69449e8, rt=0x7ffff6944208, reason=reason@entry=JS::gcreason::OUT_OF_NURSERY) at js/src/gc/Nursery.cpp:581 #14 0x00000000009390ff in js::gc::GCRuntime::minorGC (this=this@entry=0x7ffff6944990, reason=reason@entry=JS::gcreason::OUT_OF_NURSERY, phase=phase@entry=js::gcstats::PHASE_MINOR_GC) at js/src/jsgc.cpp:6540 #15 0x0000000000d48c61 in js::gc::GCRuntime::tryNewNurseryObject<(js::AllowGC)1> (this=this@entry=0x7ffff6944990, cx=cx@entry=0x7ffff6944000, thingSize=thingSize@entry=64, nDynamicSlots=nDynamicSlots@entry=0, clasp=clasp@entry=0x1d975e0 <JSFunction::class_>) at js/src/gc/Allocator.cpp:87 #16 0x0000000000d4d488 in js::Allocate<JSObject, (js::AllowGC)1> (cx=cx@entry=0x7ffff6944000, kind=kind@entry=js::gc::AllocKind::FIRST, nDynamicSlots=0, heap=heap@entry=js::gc::DefaultHeap, clasp=clasp@entry=0x1d975e0 <JSFunction::class_>) at js/src/gc/Allocator.cpp:51 #17 0x00000000009c1339 in JSObject::create (cx=0x7ffff6944000, kind=js::gc::AllocKind::FIRST, heap=js::gc::DefaultHeap, shape=..., group=...) at js/src/jsobjinlines.h:378 #18 0x000000000099a589 in NewObject (cx=0x7ffff6944000, group=..., kind=js::gc::AllocKind::FIRST, newKind=js::GenericObject, initialShapeFlags=<optimized out>) at js/src/jsobj.cpp:668 #19 0x000000000099adf2 in js::NewObjectWithClassProtoCommon (cx=cx@entry=0x7ffff6944000, clasp=clasp@entry=0x1d975e0 <JSFunction::class_>, protoArg=..., protoArg@entry=..., allocKind=allocKind@entry=js::gc::AllocKind::FIRST, newKind=newKind@entry=js::GenericObject) at js/src/jsobj.cpp:788 #20 0x000000000095c4cf in js::NewObjectWithClassProto (newKind=js::GenericObject, allocKind=js::gc::AllocKind::FIRST, proto=..., clasp=0x1d975e0 <JSFunction::class_>, cx=0x7ffff6944000) at js/src/jsobjinlines.h:727 #21 NewFunctionClone (cx=cx@entry=0x7ffff6944000, fun=..., fun@entry=..., newKind=newKind@entry=js::GenericObject, allocKind=allocKind@entry=js::gc::AllocKind::FIRST, proto=..., proto@entry=...) at js/src/jsfun.cpp:2059 #22 0x000000000095cf9e in js::CloneFunctionReuseScript (cx=cx@entry=0x7ffff6944000, fun=fun@entry=..., enclosingEnv=enclosingEnv@entry=..., allocKind=allocKind@entry=js::gc::AllocKind::FIRST, newKind=newKind@entry=js::GenericObject, proto=proto@entry=...) at js/src/jsfun.cpp:2094 #23 0x0000000000b3b703 in js::CloneFunctionObjectIfNotSingleton (cx=cx@entry=0x7ffff6944000, fun=..., fun@entry=..., parent=..., proto=..., proto@entry=..., newKind=newKind@entry=js::GenericObject) at js/src/jsfuninlines.h:89 #24 0x0000000000b08596 in js::Lambda (cx=0x7ffff6944000, fun=..., parent=...) at js/src/vm/Interpreter.cpp:4306 #25 0x00007ffff7e44a70 in ?? () #26 0x0000000000000000 in ?? () rax 0x0 0 rbx 0x7ffff30fffa8 140737271300008 rcx 0x7ffff6c28a2d 140737333332525 rdx 0x0 0 rsi 0x7ffff6ef7770 140737336276848 rdi 0x7ffff6ef6540 140737336272192 rbp 0x7fffffffc800 140737488340992 rsp 0x7fffffffc740 140737488340800 r8 0x7ffff6ef7770 140737336276848 r9 0x7ffff7fe4740 140737354024768 r10 0x58 88 r11 0x7ffff6b9f750 140737332770640 r12 0x60 96 r13 0x7ffff3684220 140737277084192 r14 0x7ffff3684220 140737277084192 r15 0x9 9 rip 0xd5aac8 <js::TenuringTracer::moveObjectToTenured(JSObject*, JSObject*, js::gc::AllocKind)+728> => 0xd5aac8 <js::TenuringTracer::moveObjectToTenured(JSObject*, JSObject*, js::gc::AllocKind)+728>: movl $0x0,0x0 0xd5aad3 <js::TenuringTracer::moveObjectToTenured(JSObject*, JSObject*, js::gc::AllocKind)+739>: ud2
I probably should have held off landing this assertion until the fix for bug 1302682 landed.
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → DUPLICATE
Group: javascript-core-security
You need to log in before you can comment on or make changes to this bug.