1349153 - Win64 ASan TEST-UNEXPECTED-FAIL | jsapi-tests.exe | test failed with return code 3221225477

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Ting-Yu Chou [:ting] (away)]

Ran jsapi-tests.exe locally got 0xc0000005 while running testDeepFreeze_deep:

(d40.2110): Access violation - code c0000005 (!!! second chance !!!)
ntdll!RtlpxLookupFunctionTable+0xc:
00007ffa`1d41aedc 4156            push    r14
0:000> k
 # Child-SP          RetAddr           Call Site
00 000000bf`fee01000 00007ffa`1d4183ca ntdll!RtlpxLookupFunctionTable+0xc
01 000000bf`fee01030 00007ffa`1d417689 ntdll!RtlpLookupFunctionEntryForStackWalks+0x14a
02 000000bf`fee010a0 00007ffa`1d41725a ntdll!RtlpWalkFrameChain+0x3d9
03 000000bf`fee01700 00007ffa`1d4171d4 ntdll!RtlWalkFrameChain+0x2a
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\w\fx\mc\obj-asan\dist\bin\clang_rt.asan_dynamic-x86_64.dll - 
04 000000bf`fee01730 00007ff9`ea3b3c46 ntdll!RtlCaptureStackBackTrace+0x44
05 000000bf`fee01760 00007ff9`ea3d4dc2 clang_rt_asan_dynamic_x86_64!OnPrint__dll+0x6316
*** WARNING: Unable to verify checksum for C:\w\fx\mc\obj-asan\dist\bin\jsapi-tests.exe
06 000000bf`fee017a0 00007ff7`485becab clang_rt_asan_dynamic_x86_64!_asan_wrap_atol+0xc12
07 (Inline Function) --------`-------- jsapi_tests!js_malloc+0x9 [c:\w\fx\mc\obj-asan\dist\include\js\Utility.h @ 229]
08 (Inline Function) --------`-------- jsapi_tests!js_pod_malloc+0x1e [c:\w\fx\mc\obj-asan\dist\include\js\Utility.h @ 420]
09 (Inline Function) --------`-------- jsapi_tests!js::TempAllocPolicy::maybe_pod_malloc+0x1e [c:\w\fx\mc\js\src\jsalloc.h @ 84]
0a (Inline Function) --------`-------- jsapi_tests!js::TempAllocPolicy::pod_malloc+0x1e [c:\w\fx\mc\js\src\jsalloc.h @ 99]
0b (Inline Function) --------`-------- jsapi_tests!mozilla::Vector<ModuleValidator::Func *, 0, js::TempAllocPolicy>::convertToHeapStorage+0x1e [c:\w\fx\mc\obj-asan\dist\include\mozilla\Vector.h @ 936]
0c 000000bf`fee02020 00007ff7`48898ae1 jsapi_tests!mozilla::Vector<ModuleValidator::Func *, 0, js::TempAllocPolicy>::growStorageBy+0x1bb [c:\w\fx\mc\obj-asan\dist\include\mozilla\Vector.h @ 1025]
0d (Inline Function) --------`-------- jsapi_tests!mozilla::Vector<js::Shape *, 0, js::TempAllocPolicy>::append+0x34 [c:\w\fx\mc\obj-asan\dist\include\mozilla\Vector.h @ 1386]
0e (Inline Function) --------`-------- jsapi_tests!JS::GCVector<js::Shape *, 0, js::TempAllocPolicy>::append+0x34 [c:\w\fx\mc\obj-asan\dist\include\js\GCVector.h @ 79]
0f (Inline Function) --------`-------- jsapi_tests!js::MutableWrappedPtrOperations<JS::GCVector<js::Shape *, 0, js::TempAllocPolicy>, JS::Rooted<JS::GCVector<js::Shape *, 0, js::TempAllocPolicy> > >::append+0x34 [c:\w\fx\mc\obj-asan\dist\include\js\GCVector.h @ 213]
10 000000bf`fee020a0 00007ff7`47dda83b jsapi_tests!js::SetIntegrityLevel+0x7d1 [c:\w\fx\mc\js\src\jsobj.cpp @ 514]
11 (Inline Function) --------`-------- jsapi_tests!js::FreezeObject+0x13 [c:\w\fx\mc\js\src\jsobj.h @ 1395]
12 000000bf`fee02660 00007ff7`47ddab8a jsapi_tests!JS_DeepFreezeObject+0x2ab [c:\w\fx\mc\js\src\jsapi.cpp @ 3017]
13 (Inline Function) --------`-------- jsapi_tests!DeepFreezeSlot+0xaf [c:\w\fx\mc\js\src\jsapi.cpp @ 3003]
14 000000bf`fee02860 00007ff7`47ddab8a jsapi_tests!JS_DeepFreezeObject+0x5fa [c:\w\fx\mc\js\src\jsapi.cpp @ 3008]
15 (Inline Function) --------`-------- jsapi_tests!DeepFreezeSlot+0xaf [c:\w\fx\mc\js\src\jsapi.cpp @ 3003]
16 000000bf`fee02a60 00007ff7`47ddab8a jsapi_tests!JS_DeepFreezeObject+0x5fa [c:\w\fx\mc\js\src\jsapi.cpp @ 3008]
17 (Inline Function) --------`-------- jsapi_tests!DeepFreezeSlot+0xaf [c:\w\fx\mc\js\src\jsapi.cpp @ 3003]
...
...
...

This seems similar to bug 1347796, which is about the stack limits of JSContext.

Comment 1

[Ting-Yu Chou [:ting] (away)]

It's actually different. In bug 1347796 CheckRecursionLimit() is called, but not here. It's just 2MB of stack is not enough to finish the test...

On linux64 the stack is 8MB.