1363233 - Assertion failure: !Debugger::inFrameMaps(f), at js/src/jit/RematerializedFrame.cpp:109

Status: RESOLVED DUPLICATE of bug 1418971

(Core :: JavaScript Engine, defect, P3)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 1fda52a1f3b8 (build with --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --enable-stdcxx-compat --disable-profiling --enable-debug --enable-optimize, run with --fuzzing-safe --no-threads --ion-eager):

function addRemove() {
    dbg.addDebuggee(g);
    f = dbg.getNewestFrame().older;
}
function testInterrupt() {
    g = newGlobal();
    dbg = new Debugger;
    g.eval("" + function f(script) {
        for (var i = 0; i < 100; evaluate(`
	      class gx { constructor() { } }
            `)) {
            interruptIf(5);
        }
    });
    setInterruptCallback(function() {
        toggleSeq();
        return true;
    });
    g.f();
}
toggleSeq = addRemove;
testInterrupt();



Backtrace:

 received signal SIGSEGV, Segmentation fault.
0x0000000000807758 in js::jit::RematerializedFrame::FreeInVector (frames=...) at js/src/jit/RematerializedFrame.cpp:109
#0  0x0000000000807758 in js::jit::RematerializedFrame::FreeInVector (frames=...) at js/src/jit/RematerializedFrame.cpp:109
#1  0x0000000000c1b94c in js::jit::JitActivation::clearRematerializedFrames (this=this@entry=0x7fffffffa490) at js/src/vm/Stack.cpp:1515
#2  0x0000000000c1bbdb in js::jit::JitActivation::~JitActivation (this=0x7fffffffa490, __in_chrg=<optimized out>) at js/src/vm/Stack.cpp:1442
#3  0x000000000070269f in EnterIon (data=..., cx=0x7ffff694c000) at js/src/jit/Ion.cpp:2799
#4  js::jit::IonCannon (cx=cx@entry=0x7ffff694c000, state=...) at js/src/jit/Ion.cpp:2902
#5  0x000000000053c142 in js::RunScript (cx=0x7ffff694c000, state=...) at js/src/vm/Interpreter.cpp:390
#6  0x000000000053ee31 in js::ExecuteKernel (cx=cx@entry=0x7ffff694c000, script=..., script@entry=..., envChainArg=..., newTargetValue=..., evalInFrame=..., evalInFrame@entry=..., result=result@entry=0x7fffffffb410) at js/src/vm/Interpreter.cpp:699
#7  0x000000000053f228 in js::Execute (cx=cx@entry=0x7ffff694c000, script=script@entry=..., envChainArg=..., rval=rval@entry=0x7fffffffb410) at js/src/vm/Interpreter.cpp:732
#8  0x0000000000945188 in ExecuteScript (cx=cx@entry=0x7ffff694c000, scope=scope@entry=..., script=script@entry=..., rval=rval@entry=0x7fffffffb410) at js/src/jsapi.cpp:4527
#9  0x0000000000945338 in JS_ExecuteScript (cx=cx@entry=0x7ffff694c000, scriptArg=scriptArg@entry=..., rval=...) at js/src/jsapi.cpp:4553
#10 0x000000000045efde in Evaluate (cx=0x7ffff694c000, argc=<optimized out>, vp=<optimized out>) at js/src/shell/js.cpp:1859
#11 0x000000000054779f in js::CallJSNative (cx=cx@entry=0x7ffff694c000, native=0x45e610 <Evaluate(JSContext*, unsigned int, JS::Value*)>, args=...) at js/src/jscntxtinlines.h:293
#12 0x000000000053c463 in js::InternalCallOrConstruct (cx=cx@entry=0x7ffff694c000, args=..., construct=construct@entry=js::NO_CONSTRUCT) at js/src/vm/Interpreter.cpp:470
#13 0x000000000053c878 in InternalCall (cx=cx@entry=0x7ffff694c000, args=...) at js/src/vm/Interpreter.cpp:515
#14 0x000000000053c97a in js::CallFromStack (cx=cx@entry=0x7ffff694c000, args=...) at js/src/vm/Interpreter.cpp:521
#15 0x000000000061537f in js::jit::DoCallFallback (cx=0x7ffff694c000, frame=0x7fffffffb468, stub_=<optimized out>, argc=<optimized out>, vp=0x7fffffffb410, res=...) at js/src/jit/BaselineIC.cpp:2457
#16 0x00003d9c10d1ecb7 in ?? ()
[...]
#40 0x0000000000000000 in ?? ()
rax	0x0	0
rbx	0x7ffff69df2b0	140737330934448
rcx	0x7ffff6c28a2d	140737333332525
rdx	0x0	0
rsi	0x7ffff6ef7770	140737336276848
rdi	0x7ffff6ef6540	140737336272192
rbp	0x7fffffffa280	140737488331392
rsp	0x7fffffffa230	140737488331312
r8	0x7ffff6ef7770	140737336276848
r9	0x7ffff7fe4740	140737354024768
r10	0x58	88
r11	0x7ffff6b9f750	140737332770640
r12	0x7ffff693ab50	140737330260816
r13	0x0	0
r14	0x0	0
r15	0xffffffffffffff	72057594037927935
rip	0x807758 <js::jit::RematerializedFrame::FreeInVector(JS::GCVector<js::jit::RematerializedFrame*, 0ul, js::TempAllocPolicy>&)+376>
=> 0x807758 <js::jit::RematerializedFrame::FreeInVector(JS::GCVector<js::jit::RematerializedFrame*, 0ul, js::TempAllocPolicy>&)+376>:	movl   $0x0,0x0
   0x807763 <js::jit::RematerializedFrame::FreeInVector(JS::GCVector<js::jit::RematerializedFrame*, 0ul, js::TempAllocPolicy>&)+387>:	ud2

Comment 1

[Fuzzing Team]

JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

g = newGlobal();
dbg = new Debugger;
g.eval("" + function f() {
    for (var i = 0; i < 1; evaluate("class h { constructor() {} }")) {
        interruptIf(1);
    }
});
setInterruptCallback(function () {
    dbg.addDebuggee(g);
    dbg.getNewestFrame();
    return true;
});
g.f();

is a slightly-reduced version of the testcase in comment 0. Tested on m-c rev bce03a8eac30, compile with "--enable-debug --enable-more-deterministic" and run with "--fuzzing-safe --no-threads --ion-eager".

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack for testcase in comment 2

Comment 4

[Fuzzing Team]

JSBugMon: Cannot process bug: Error: Failed to isolate test from comment

Comment 5

[Fuzzing Team]

JSBugMon: Bisection requested, failed due to error: Error: Failed to isolate test from comment

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/ac0aa2c21379
user:        Shu-yu Guo
date:        Tue Oct 06 14:00:30 2015 -0700
summary:     Bug 589199 - Implement all-or-nothing redeclaration checks for global and eval scripts. (r=efaust)

Shu-yu, is bug 589199 a likely regressor?

Comment 7

[Liz Henry (:lizzard)]

If you land a patch, please feel free to request uplift. (Assuming this may also affect 56) Thanks!

Comment 8

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autobisectjs shows this is probably related to the following changeset:

The first good revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/66ee3a9fe9ca
user:        Nicolas B. Pierron
date:        Mon May 28 15:41:23 2018 +0000
summary:     Bug 1418971 - Remove rematerialized frames after bailouts and exceptions. r=jandem

Both testcases in comment 0 and comment 2 seem to have been fixed by this.

Nicolas, is bug 1418971 a likely fix?

Comment 9

[Nicolas B. Pierron [:nbp] {away}]

(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #8)
> autobisectjs shows this is probably related to the following changeset:
> 
> The first good revision is:
> changeset:   https://hg.mozilla.org/mozilla-central/rev/66ee3a9fe9ca
> user:        Nicolas B. Pierron
> date:        Mon May 28 15:41:23 2018 +0000
> summary:     Bug 1418971 - Remove rematerialized frames after bailouts and
> exceptions. r=jandem
> 
> Both testcases in comment 0 and comment 2 seem to have been fixed by this.
> 
> Nicolas, is bug 1418971 a likely fix?

Yes, this sounds likely to be a fix.  Bug 1418971 had an issue with non properly balanced rematerialized frames which were created by repeated evaluation of OOMTest, which made it harder to reduce and land the test case.

I suggest we land this test case, as a way to double check Bug 1418971.