1336893 - Assertion failure: ++nwrites <= 2, at js/src/threading/ProtectedData.h:318

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision f8d696a34c17 (build with --32 --enable-debug --enable-simulator=arm, run with --fuzzing-safe --no-threads --no-ion):

// jsfunfuzz-generated
for (var i = 0; i < 9; ++i) {
    Object.getOwnPropertyNames(this);
}
// Adapted from randomly chosen test: js/src/jit-test/tests/debug/bug1219905.js
var g = newGlobal();
g.parent = function(){};
g.eval("new Debugger(parent).onExceptionUnwind = function() {}");
oomTest(() => l);


Backtrace:

0   js-dbg-32-clang-armSim-darwin-f8d696a34c17	0x00275626 js::jit::JitRuntime::debugTrapHandler(JSContext*) + 406 (ProtectedData.h:318)
1   js-dbg-32-clang-armSim-darwin-f8d696a34c17	0x00adc2b7 js::jit::BaselineCompiler::emitDebugTrap() + 231 (BaselineCompiler.cpp:823)
2   js-dbg-32-clang-armSim-darwin-f8d696a34c17	0x00ad7d7a js::jit::BaselineCompiler::emitBody() + 954 (BaselineCompiler.cpp:1013)
3   js-dbg-32-clang-armSim-darwin-f8d696a34c17	0x00ad660d js::jit::BaselineCompiler::compile() + 509 (BaselineCompiler.cpp:119)
4   js-dbg-32-clang-armSim-darwin-f8d696a34c17	0x001d98b6 js::jit::BaselineCompile(JSContext*, JSScript*, bool) + 342 (BaselineJIT.cpp:298)
/snip

For detailed crash information, see attachment.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/d2758f635f72
user:        Brian Hackett
date:        Thu Feb 02 12:12:43 2017 -0700
summary:     Bug 1325050 - Structure reorganization for multithreaded runtimes, r=jandem,jonco,h4writer,luke,lhansen,nbp.

Brian, is bug 1325050 a likely regressor?

Comment 3

[Brian Hackett [Laid off!]]

Attachment: patch

Relax write-once protected data checks to ignore assignments that do not change a location's value (e.g. overwriting null with null).  I didn't add the test because it is crashing without --fuzzing-safe at a cx->isExceptionPending() assert in OOMTest (this seems to be an expected behavior).

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/d6c7252fb769
Tolerate redundant writes in WriteOnceData checks, r=jandem.

Comment 5

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/d6c7252fb769