Closed Bug 1315946 Opened 3 years ago Closed 3 years ago

Assertion failure: table, at dist/include/js/HashTable.h:1377 with OOM

Categories

(Core :: JavaScript Engine, defect, critical)

x86_64
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla52
Tracking Status
firefox51 --- fix-optional
firefox52 --- fixed

People

(Reporter: decoder, Assigned: jonco)

References

(Blocks 2 open bugs)

Details

(Keywords: assertion, jsbugmon, testcase, Whiteboard: [jsbugmon:update])

Attachments

(1 file)

The following testcase crashes on mozilla-central revision 2c773b971672 (build with --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --enable-debug --enable-optimize, run with --fuzzing-safe --ion-offthread-compile=off):

loadFile(`   
gczeal(15,3);
foo();
`);
function loadFile(lfVarx) oomTest(Function(lfVarx))



Backtrace:

 received signal SIGSEGV, Segmentation fault.
#0  0x0000000000db21f8 in js::detail::HashTable<js::gc::Cell* const, js::HashSet<js::gc::Cell*, js::DefaultHasher<js::gc::Cell*>, js::SystemAllocPolicy>::SetOps, js::SystemAllocPolicy>::lookup (this=this@entry=0x7fffffffb910, l=@0x7fffffffb598: 0x7ffff0600028, keyHash=<optimized out>, collisionBit=collisionBit@entry=0) at dist/include/js/HashTable.h:1377
#1  0x0000000000daa458 in js::detail::HashTable<js::gc::Cell* const, js::HashSet<js::gc::Cell*, js::DefaultHasher<js::gc::Cell*>, js::SystemAllocPolicy>::SetOps, js::SystemAllocPolicy>::lookup (l=@0x7fffffffb598: 0x7ffff0600028, this=0x7fffffffb910) at dist/include/js/HashTable.h:1736
#2  js::HashSet<js::gc::Cell*, js::DefaultHasher<js::gc::Cell*>, js::SystemAllocPolicy>::lookup (l=@0x7fffffffb598: 0x7ffff0600028, this=0x7fffffffb910) at dist/include/js/HashTable.h:357
#3  CheckHeapTracer::onChild (this=this@entry=0x7fffffffb8c0, thing=...) at js/src/gc/Verifier.cpp:486
#4  0x0000000000dad52c in JS::CallbackTracer::onStringEdge (strp=0x7fffffffb668, this=0x7fffffffb8c0) at dist/include/js/TracingAPI.h:143
#5  JS::CallbackTracer::dispatchToOnEdge (strp=0x7fffffffb668, this=0x7fffffffb8c0) at dist/include/js/TracingAPI.h:225
#6  DoCallback<JSString*> (trc=0x7fffffffb8c0, thingp=thingp@entry=0x7fffffffb668, name=name@entry=0x10821b7 "unit-static-string") at js/src/gc/Tracer.cpp:51
#7  0x0000000000d82800 in js::TraceProcessGlobalRoot<JSAtom> (trc=trc@entry=0x7fffffffb8c8, thing=0x7ffff0600028, name=name@entry=0x10821b7 "unit-static-string") at js/src/gc/Marking.cpp:604
#8  0x0000000000bccc87 in js::StaticStrings::trace (this=0x7ffff698c000, trc=trc@entry=0x7fffffffb8c8) at js/src/vm/String.cpp:861
#9  0x0000000000507d57 in js::MarkPermanentAtoms (trc=trc@entry=0x7fffffffb8c8) at js/src/jsatom.cpp:229
#10 0x0000000000d9e23b in js::gc::GCRuntime::traceRuntimeAtoms (this=this@entry=0x7ffff695f9b0, trc=trc@entry=0x7fffffffb8c8, lock=...) at js/src/gc/RootMarking.cpp:315
#11 0x0000000000d9ee6f in js::gc::GCRuntime::traceRuntime (this=0x7ffff695f9b0, trc=0x7fffffffb8c8, lock=...) at js/src/gc/RootMarking.cpp:307
#12 0x0000000000da0386 in CheckHeapTracer::check (this=this@entry=0x7fffffffb8c0, lock=...) at js/src/gc/Verifier.cpp:521
#13 0x0000000000da4916 in js::gc::CheckHeapAfterGC (rt=<optimized out>) at js/src/gc/Verifier.cpp:550
#14 0x000000000095d995 in js::gc::GCRuntime::minorGC (this=0x7ffff695f9b0, reason=JS::gcreason::DEBUG_GC, phase=<optimized out>) at js/src/jsgc.cpp:6568
#15 0x0000000000999856 in js::gc::GCRuntime::evictNursery (reason=JS::gcreason::DEBUG_GC, this=0x7ffff695f9b0) at js/src/gc/GCRuntime.h:624
#16 js::gc::GCRuntime::gcCycle (this=this@entry=0x7ffff695f9b0, nonincrementalByAPI=nonincrementalByAPI@entry=true, budget=..., reason=reason@entry=JS::gcreason::DEBUG_GC) at js/src/jsgc.cpp:6131
#17 0x000000000099a2bc in js::gc::GCRuntime::collect (this=0x7ffff695f9b0, nonincrementalByAPI=true, budget=..., reason=JS::gcreason::DEBUG_GC) at js/src/jsgc.cpp:6326
#18 0x000000000099b334 in js::gc::GCRuntime::gc (reason=<optimized out>, gckind=<optimized out>, this=<optimized out>) at js/src/jsgc.cpp:6394
#19 js::gc::GCRuntime::runDebugGC (this=this@entry=0x7ffff695f9b0) at js/src/jsgc.cpp:6805
#20 0x0000000000d74158 in js::gc::GCRuntime::gcIfNeededPerAllocation (this=this@entry=0x7ffff695f9b0, cx=cx@entry=0x7ffff695f000) at js/src/gc/Allocator.cpp:225
#21 0x0000000000d81759 in js::gc::GCRuntime::checkAllocatorState<(js::AllowGC)1> (this=0x7ffff695f9b0, cx=0x7ffff695f000, kind=kind@entry=js::gc::AllocKind::STRING) at js/src/gc/Allocator.cpp:189
#22 0x0000000000d8c42c in js::Allocate<JSString, (js::AllowGC)1> (cx=cx@entry=0x7ffff695f000) at js/src/gc/Allocator.cpp:139
#23 0x0000000000be2541 in JSFlatString::new_<(js::AllowGC)1, unsigned char> (cx=cx@entry=0x7ffff695f000, chars=0x7ffff6997ca0 "test.js line 5 > Function", length=length@entry=25) at js/src/vm/String-inl.h:223
#24 0x0000000000be27c1 in js::NewStringCopyNDontDeflate<(js::AllowGC)1, unsigned char> (cx=0x7ffff695f000, s=0x7ffff6997b80 "test.js line 5 > Function", n=25) at js/src/vm/String.cpp:1269
#25 0x00000000008babab in js::NewStringCopyN<(js::AllowGC)1> (n=<optimized out>, s=0x7ffff6997b80 "test.js line 5 > Function", cx=0x7ffff695f000) at js/src/vm/String.h:1190
#26 js::NewStringCopyZ<(js::AllowGC)1> (s=0x7ffff6997b80 "test.js line 5 > Function", cx=0x7ffff695f000) at js/src/vm/String.h:1210
#27 JS_NewStringCopyZ (cx=cx@entry=0x7ffff695f000, s=0x7ffff6997b80 "test.js line 5 > Function") at js/src/jsapi.cpp:4914
#28 0x000000000092ccce in js::ErrorToException (cx=0x7ffff695f000, reportp=0x7fffffffc060, callback=<optimized out>, userRef=<optimized out>) at js/src/jsexn.cpp:544
#29 0x0000000000931abc in js::ReportErrorNumberVA (cx=0x7ffff695f000, flags=flags@entry=0, callback=0x921750 <js::GetErrorMessage(void*, unsigned int)>, userRef=0x0, errorNumber=<optimized out>, argumentsType=argumentsType@entry=js::ArgumentsAreLatin1, ap=0x7fffffffc110) at js/src/jscntxt.cpp:693
#30 0x00000000008bde11 in JS_ReportErrorNumberLatin1VA (cx=<optimized out>, errorCallback=<optimized out>, userRef=<optimized out>, errorNumber=<optimized out>, ap=ap@entry=0x7fffffffc110) at js/src/jsapi.cpp:5588
#31 0x00000000008bdeb8 in JS_ReportErrorNumberLatin1 (cx=cx@entry=0x7ffff695f000, errorCallback=errorCallback@entry=0x921750 <js::GetErrorMessage(void*, unsigned int)>, userRef=userRef@entry=0x0, errorNumber=errorNumber@entry=1) at js/src/jsapi.cpp:5577
#32 0x0000000000926da5 in js::ReportIsNotDefined (cx=cx@entry=0x7ffff695f000, id=id@entry=...) at js/src/jscntxt.cpp:754
#33 0x000000000092d075 in js::ReportIsNotDefined (cx=0x7ffff695f000, name=..., name@entry=...) at js/src/jscntxt.cpp:763
#34 0x00000000006f5a00 in js::FetchName<false> (cx=0x7ffff695f000, obj=..., obj2=..., name=..., shape=..., vp=...) at js/src/vm/Interpreter-inl.h:185
#35 0x0000000000b254b8 in GetNameOperation (vp=..., pc=<optimized out>, fp=<optimized out>, cx=<optimized out>) at js/src/vm/Interpreter.cpp:232
#36 Interpret (cx=0x7ffff695f000, state=...) at js/src/vm/Interpreter.cpp:3064
#37 0x0000000000b310ad in js::RunScript (cx=cx@entry=0x7ffff695f000, state=...) at js/src/vm/Interpreter.cpp:404
#38 0x0000000000b313e5 in js::InternalCallOrConstruct (cx=cx@entry=0x7ffff695f000, args=..., construct=construct@entry=js::NO_CONSTRUCT) at js/src/vm/Interpreter.cpp:476
#39 0x0000000000b31616 in InternalCall (cx=cx@entry=0x7ffff695f000, args=...) at js/src/vm/Interpreter.cpp:503
#40 0x0000000000b3176e in js::Call (cx=cx@entry=0x7ffff695f000, fval=..., fval@entry=..., thisv=..., thisv@entry=..., args=..., rval=..., rval@entry=...) at js/src/vm/Interpreter.cpp:522
#41 0x00000000008fc43f in JS_CallFunction (cx=cx@entry=0x7ffff695f000, obj=..., fun=..., fun@entry=..., args=..., rval=..., rval@entry=...) at js/src/jsapi.cpp:2786
#42 0x0000000000cbd60b in OOMTest (cx=cx@entry=0x7ffff695f000, argc=<optimized out>, vp=<optimized out>) at js/src/builtin/TestingFunctions.cpp:1392
#43 0x0000000000b40ee9 in js::CallJSNative (cx=cx@entry=0x7ffff695f000, native=0xcbd2e0 <OOMTest(JSContext*, unsigned int, JS::Value*)>, args=...) at js/src/jscntxtinlines.h:239
[...]
#56 main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at js/src/shell/js.cpp:7928
rax	0x0	0
rbx	0x7fffffffb5b0	140737488336304
rcx	0x7ffff6c28a2d	140737333332525
rdx	0x0	0
rsi	0x7ffff6ef7770	140737336276848
rdi	0x7ffff6ef6540	140737336272192
rbp	0x7fffffffb550	140737488336208
rsp	0x7fffffffb530	140737488336176
r8	0x7ffff6ef7770	140737336276848
r9	0x7ffff7fe4740	140737354024768
r10	0x58	88
r11	0x7ffff6b9f750	140737332770640
r12	0x7fffffffb910	140737488337168
r13	0x7fffffffb930	140737488337200
r14	0x7fffffffb8c0	140737488337088
r15	0x7fffffffb620	140737488336416
rip	0xdb21f8 <js::detail::HashTable<js::gc::Cell* const, js::HashSet<js::gc::Cell*, js::DefaultHasher<js::gc::Cell*>, js::SystemAllocPolicy>::SetOps, js::SystemAllocPolicy>::lookup(js::gc::Cell* const&, unsigned int, unsigned int) const+584>
=> 0xdb21f8 <js::detail::HashTable<js::gc::Cell* const, js::HashSet<js::gc::Cell*, js::DefaultHasher<js::gc::Cell*>, js::SystemAllocPolicy>::SetOps, js::SystemAllocPolicy>::lookup(js::gc::Cell* const&, unsigned int, unsigned int) const+584>:	movl   $0x0,0x0
   0xdb2203 <js::detail::HashTable<js::gc::Cell* const, js::HashSet<js::gc::Cell*, js::DefaultHasher<js::gc::Cell*>, js::SystemAllocPolicy>::SetOps, js::SystemAllocPolicy>::lookup(js::gc::Cell* const&, unsigned int, unsigned int) const+595>:	ud2
Assignee: nobody → jcoppeard
Blocks: 1307361
Ugh, so this was dumb.  I broke the heap checking zeal mode when I changed this code to ignore errors.  The fix is to get the condition on the if statement the right way round.
Attachment #8808600 - Flags: review?(lhansen)
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/c00f9da4f27d
user:        Tooru Fujisawa
date:        Sat Oct 01 16:23:25 2016 +0900
summary:     Bug 1283710 - Part 7: Use UTF-8 in js::ExpandErrorArgumentsVA and AutoMessageArgs. r=jwalden

This iteration took 258.124 seconds to run.
Attachment #8808600 - Flags: review?(lhansen) → review+
Pushed by jcoppeard@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/b1d62e7171ef
Make heap checking zeal mode work again r=lth
https://hg.mozilla.org/mozilla-central/rev/b1d62e7171ef
Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla52
Jon, would it be a good idea to uplift this to 51 ? If we do it before next Monday it can still make it to 51 before the merge to beta.
Flags: needinfo?(jcoppeard)
There's no user impact to this so I think we can leave it.
Flags: needinfo?(jcoppeard)
You need to log in before you can comment on or make changes to this bug.