1367437 - Assertion failure: offset < length(), at js/src/jsscript.h:1238

Status: RESOLVED DUPLICATE of bug 1365518

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 9851fcb0bf4d (build with --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --enable-stdcxx-compat --disable-profiling --enable-debug --enable-optimize, run with --fuzzing-safe --ion-eager --ion-offthread-compile=off):

lfAccumulatedCode = ""
loadFile(`
  function f() get++;
`);
loadFile(`
  f = function() {}
  f.__proto__ = [];
`);
loadFile(`
  function foreachweird(a)
    a.forEach(f);
  foreachweird([0]);
  foreachweird([0]);
`);
loadFile()
function loadFile(lfVarx) {
    try {
        function newFunc(x) Function(x)();
        newFunc(lfVarx);
        eval(lfAccumulatedCode);
    } catch (lfVare) {}
    lfAccumulatedCode += "try { evaluate(`\n" + lfVarx + "\n`) } catch(exc) {}\n"
}



Backtrace:

 received signal SIGSEGV, Segmentation fault.
0x000000000072820b in JSScript::offsetToPC (offset=<optimized out>, this=<optimized out>) at js/src/jsscript.h:1238
#0  0x000000000072820b in JSScript::offsetToPC (offset=<optimized out>, this=<optimized out>) at js/src/jsscript.h:1238
#1  js::jit::InlineFrameIterator::findNextFrame (this=this@entry=0x7fffffff8958) at js/src/jit/JitFrames.cpp:2438
#2  0x0000000000728a10 in js::jit::InlineFrameIterator::resetOn (this=this@entry=0x7fffffff8958, iter=iter@entry=0x7fffffff88e8) at js/src/jit/JitFrames.cpp:2359
#3  0x0000000000bda168 in js::FrameIter::nextJitFrame (this=0x7fffffff8890) at js/src/vm/Stack.cpp:653
#4  0x0000000000bdcc88 in js::FrameIter::settleOnActivation (this=0x7fffffff8890) at js/src/vm/Stack.cpp:544
#5  0x0000000000957f51 in js::NonBuiltinFrameIter::NonBuiltinFrameIter (principals=<optimized out>, cx=0x7fffffff8d30, this=0x7fffffff8890) at js/src/vm/Stack.h:2022
#6  PopulateReportBlame (cx=cx@entry=0x7ffff6924000, report=report@entry=0x7fffffff8d30) at js/src/jscntxt.cpp:326
#7  0x000000000095f199 in js::ReportErrorNumberVA (cx=cx@entry=0x7ffff6924000, flags=flags@entry=0, callback=callback@entry=0x94a000 <js::GetErrorMessage(void*, unsigned int)>, userRef=userRef@entry=0x0, errorNumber=errorNumber@entry=1, argumentsType=argumentsType@entry=js::ArgumentsAreLatin1, ap=0x7fffffff8e10) at js/src/jscntxt.cpp:898
#8  0x00000000008e12f8 in JS_ReportErrorNumberLatin1VA (cx=0x7ffff6924000, errorCallback=0x94a000 <js::GetErrorMessage(void*, unsigned int)>, userRef=0x0, errorNumber=1, ap=ap@entry=0x7fffffff8e10) at js/src/jsapi.cpp:5876
#9  0x00000000008e13a8 in JS_ReportErrorNumberLatin1 (cx=cx@entry=0x7ffff6924000, errorCallback=errorCallback@entry=0x94a000 <js::GetErrorMessage(void*, unsigned int)>, userRef=userRef@entry=0x0, errorNumber=errorNumber@entry=1) at js/src/jsapi.cpp:5865
#10 0x000000000094fd75 in js::ReportIsNotDefined (cx=cx@entry=0x7ffff6924000, id=id@entry=...) at js/src/jscntxt.cpp:956
#11 0x0000000000956b7e in js::ReportIsNotDefined (cx=0x7ffff6924000, name=..., name@entry=...) at js/src/jscntxt.cpp:965
#12 0x000000000053db70 in js::FetchName<(js::GetNameMode)0> (cx=0x7ffff6924000, receiver=..., holder=..., name=..., prop=..., vp=...) at js/src/vm/Interpreter-inl.h:187
#13 0x00000000007270b5 in js::jit::IonGetNameIC::update (cx=0x7ffff6924000, outerScript=..., ic=<optimized out>, envChain=..., res=...) at js/src/jit/IonIC.cpp:306
#14 0x00000602d8ebd233 in ?? ()
#15 0xffffffffff000000 in ?? ()
#16 0x00007fffffff9308 in ?? ()
#17 0x0000000000000000 in ?? ()
rax	0x0	0
rbx	0x7fffffff89f8	140737488325112
rcx	0x7ffff6c28a2d	140737333332525
rdx	0x0	0
rsi	0x7ffff6ef7770	140737336276848
rdi	0x7ffff6ef6540	140737336272192
rbp	0x7fffffff8500	140737488323840
rsp	0x7fffffff8460	140737488323680
r8	0x7ffff6ef7770	140737336276848
r9	0x7ffff7fe4740	140737354024768
r10	0x58	88
r11	0x7ffff6b9f750	140737332770640
r12	0x7ffff47009a0	140737294371232
r13	0x7fffffff8a60	140737488325216
r14	0xb	11
r15	0x7fffffff8958	140737488324952
rip	0x72820b <js::jit::InlineFrameIterator::findNextFrame()+2491>
=> 0x72820b <js::jit::InlineFrameIterator::findNextFrame()+2491>:	movl   $0x0,0x0
   0x728216 <js::jit::InlineFrameIterator::findNextFrame()+2502>:	ud2    


Assuming this is s-s because the assertion looks like it. It should be noted that this neither crashes nor trips any ASan checks. Could we figure out why this is the case and potentially improve the situation? The assertion clearly sounds like we are accessing something out-of-bounds.

Comment 1

[Fuzzing Team]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/b6315d186b4b
user:        Jan de Mooij
date:        Tue May 02 14:26:44 2017 +0200
summary:     Bug 1357680 part 3 - Don't mark the new group as having unknown properties when changing an object's proto. r=bhackett

This iteration took 267.247 seconds to run.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Jan, is bug 1357680 a likely regressor?

Comment 3

[Fuzzing Team]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 6a235092bda7).

Comment 4

[Jan de Mooij [:jandem]]

Same issue as bug 1365518.

Comment 5

[Liz Henry (:lizzard) (relman/hg->git project)]

Fixed in bug 1365518.