Closed Bug 1385843 Opened 8 years ago Closed 8 years ago

Crash [@ JSFunction::isDerivedClassConstructor] or Assertion failure: fun, at vm/Interpreter.cpp:5203 with Debugger

Categories

(Core :: JavaScript Engine, defect, P2)

x86_64
Linux
defect

Tracking

()

RESOLVED FIXED
mozilla58
Tracking Status
firefox-esr52 --- wontfix
firefox56 --- wontfix
firefox57 --- wontfix
firefox58 --- fixed

People

(Reporter: decoder, Assigned: jandem)

References

Details

(5 keywords, Whiteboard: [jsbugmon:update])

Crash Data

Attachments

(1 file)

The following testcase crashes on mozilla-central revision 26516ba27081 (build with --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --enable-stdcxx-compat --disable-profiling --disable-debug --enable-optimize, run with --fuzzing-safe): var g = newGlobal(); g.parent = this; g.eval("(" + function() { var dbg = new Debugger(parent); dbg.onExceptionUnwind = function(frame) { frame.eval("this"); }; } + ")()"); new class extends class {} { constructor() {} }(); Backtrace: received signal SIGSEGV, Segmentation fault. JSFunction::isDerivedClassConstructor (this=this@entry=0x0) at js/src/jsfun.cpp:1334 #0 JSFunction::isDerivedClassConstructor (this=this@entry=0x0) at js/src/jsfun.cpp:1334 #1 0x00000000004fb05c in js::ThrowUninitializedThis (cx=0x7ffff6924000, frame=...) at js/src/vm/Interpreter.cpp:5206 #2 0x000000000050a8ce in Interpret (cx=0x7ffff6924000, state=...) at js/src/vm/Interpreter.cpp:2755 #3 0x000000000050aca6 in js::RunScript (cx=0x7ffff6924000, state=...) at js/src/vm/Interpreter.cpp:409 #4 0x000000000050cec8 in js::ExecuteKernel (cx=cx@entry=0x7ffff6924000, script=..., script@entry=..., envChainArg=..., newTargetValue=..., evalInFrame=..., result=result@entry=0x7fffffff93f0) at js/src/vm/Interpreter.cpp:698 #5 0x000000000094dbec in EvaluateInEnv (pc=0x0, rval=..., lineno=1, filename=0xe304ad "debugger eval code", chars=..., frame=..., env=..., cx=0x7ffff6924000) at js/src/vm/Debugger.cpp:8218 #6 DebuggerGenericEval (cx=cx@entry=0x7ffff6924000, chars=..., bindings=..., bindings@entry=..., options=..., status=@0x7fffffff9bdc: JSTRAP_ERROR, value=..., dbg=0x7ffff6938000, envArg=..., iter=0x7fffffff9730) at js/src/vm/Debugger.cpp:8305 #7 0x000000000094e7aa in js::DebuggerFrame::eval (cx=cx@entry=0x7ffff6924000, frame=..., frame@entry=..., chars=..., bindings=bindings@entry=..., options=..., status=@0x7fffffff9bdc: JSTRAP_ERROR, value=...) at js/src/vm/Debugger.cpp:8329 #8 0x000000000094ea23 in js::DebuggerFrame::evalMethod (cx=0x7ffff6924000, argc=1, vp=0x7ffff43f6288) at js/src/vm/Debugger.cpp:8986 #9 0x000000000050afce in js::CallJSNative (args=..., native=0x94e7c0 <js::DebuggerFrame::evalMethod(JSContext*, unsigned int, JS::Value*)>, cx=0x7ffff6924000) at js/src/jscntxtinlines.h:293 #10 js::InternalCallOrConstruct (cx=0x7ffff6924000, args=..., construct=<optimized out>) at js/src/vm/Interpreter.cpp:469 #11 0x00000000004fd9f8 in js::CallFromStack (args=..., cx=<optimized out>) at js/src/vm/Interpreter.cpp:520 #12 Interpret (cx=0x7ffff6924000, state=...) at js/src/vm/Interpreter.cpp:3064 #13 0x000000000050aca6 in js::RunScript (cx=0x7ffff6924000, state=...) at js/src/vm/Interpreter.cpp:409 #14 0x000000000050b239 in js::InternalCallOrConstruct (cx=cx@entry=0x7ffff6924000, args=..., construct=construct@entry=js::NO_CONSTRUCT) at js/src/vm/Interpreter.cpp:487 #15 0x000000000050bc42 in InternalCall (args=..., cx=0x7ffff6924000) at js/src/vm/Interpreter.cpp:514 #16 js::Call (cx=cx@entry=0x7ffff6924000, fval=..., fval@entry=..., thisv=..., thisv@entry=..., args=..., rval=..., rval@entry=...) at js/src/vm/Interpreter.cpp:533 #17 0x0000000000956d25 in js::Call (rval=..., arg1=..., arg0=..., thisObj=<optimized out>, fval=..., cx=0x7ffff6924000) at js/src/vm/Interpreter.h:133 #18 js::Debugger::fireExceptionUnwind (this=this@entry=0x7ffff6938000, cx=cx@entry=0x7ffff6924000, vp=..., vp@entry=...) at js/src/vm/Debugger.cpp:1812 #19 0x00000000009570ab in js::Debugger::<lambda(js::Debugger*)>::operator() (dbg=0x7ffff6938000, __closure=<synthetic pointer>) at js/src/vm/Debugger.cpp:1085 #20 js::Debugger::dispatchHook<js::Debugger::slowPathOnExceptionUnwind(JSContext*, js::AbstractFramePtr)::<lambda(js::Debugger*)>, js::Debugger::slowPathOnExceptionUnwind(JSContext*, js::AbstractFramePtr)::<lambda(js::Debugger*)> > (fireHook=..., cx=0x7ffff6924000, hookIsEnabled=...) at js/src/vm/Debugger.cpp:1925 #21 js::Debugger::slowPathOnExceptionUnwind (cx=0x7ffff6924000, frame=...) at js/src/vm/Debugger.cpp:1086 #22 0x00000000004fdfa7 in js::Debugger::onExceptionUnwind (frame=..., cx=<optimized out>) at js/src/vm/Debugger-inl.h:66 #23 HandleError (regs=..., cx=<optimized out>) at js/src/vm/Interpreter.cpp:1349 #24 Interpret (cx=0x7ffff6924000, state=...) at js/src/vm/Interpreter.cpp:4293 #25 0x000000000050aca6 in js::RunScript (cx=0x7ffff6924000, state=...) at js/src/vm/Interpreter.cpp:409 #26 0x000000000050cec8 in js::ExecuteKernel (cx=cx@entry=0x7ffff6924000, script=..., script@entry=..., envChainArg=..., newTargetValue=..., evalInFrame=..., result=result@entry=0x7fffffffb540) at js/src/vm/Interpreter.cpp:698 #27 0x000000000094dbec in EvaluateInEnv (pc=0x0, rval=..., lineno=1, filename=0xe304ad "debugger eval code", chars=..., frame=..., env=..., cx=0x7ffff6924000) at js/src/vm/Debugger.cpp:8218 #28 DebuggerGenericEval (cx=cx@entry=0x7ffff6924000, chars=..., bindings=..., bindings@entry=..., options=..., status=@0x7fffffffbd2c: JSTRAP_ERROR, value=..., dbg=0x7ffff6938000, envArg=..., iter=0x7fffffffb880) at js/src/vm/Debugger.cpp:8305 #29 0x000000000094e7aa in js::DebuggerFrame::eval (cx=cx@entry=0x7ffff6924000, frame=..., frame@entry=..., chars=..., bindings=bindings@entry=..., options=..., status=@0x7fffffffbd2c: JSTRAP_ERROR, value=...) at js/src/vm/Debugger.cpp:8329 #30 0x000000000094ea23 in js::DebuggerFrame::evalMethod (cx=0x7ffff6924000, argc=1, vp=0x7ffff43f6190) at js/src/vm/Debugger.cpp:8986 #31 0x000000000050afce in js::CallJSNative (args=..., native=0x94e7c0 <js::DebuggerFrame::evalMethod(JSContext*, unsigned int, JS::Value*)>, cx=0x7ffff6924000) at js/src/jscntxtinlines.h:293 #32 js::InternalCallOrConstruct (cx=0x7ffff6924000, args=..., construct=<optimized out>) at js/src/vm/Interpreter.cpp:469 #33 0x00000000004fd9f8 in js::CallFromStack (args=..., cx=<optimized out>) at js/src/vm/Interpreter.cpp:520 #34 Interpret (cx=0x7ffff6924000, state=...) at js/src/vm/Interpreter.cpp:3064 #35 0x000000000050aca6 in js::RunScript (cx=0x7ffff6924000, state=...) at js/src/vm/Interpreter.cpp:409 #36 0x000000000050b239 in js::InternalCallOrConstruct (cx=cx@entry=0x7ffff6924000, args=..., construct=construct@entry=js::NO_CONSTRUCT) at js/src/vm/Interpreter.cpp:487 #37 0x000000000050bc42 in InternalCall (args=..., cx=0x7ffff6924000) at js/src/vm/Interpreter.cpp:514 #38 js::Call (cx=cx@entry=0x7ffff6924000, fval=..., fval@entry=..., thisv=..., thisv@entry=..., args=..., rval=..., rval@entry=...) at js/src/vm/Interpreter.cpp:533 #39 0x0000000000956d25 in js::Call (rval=..., arg1=..., arg0=..., thisObj=<optimized out>, fval=..., cx=0x7ffff6924000) at js/src/vm/Interpreter.h:133 #40 js::Debugger::fireExceptionUnwind (this=this@entry=0x7ffff6938000, cx=cx@entry=0x7ffff6924000, vp=..., vp@entry=...) at js/src/vm/Debugger.cpp:1812 #41 0x00000000009570ab in js::Debugger::<lambda(js::Debugger*)>::operator() (dbg=0x7ffff6938000, __closure=<synthetic pointer>) at js/src/vm/Debugger.cpp:1085 #42 js::Debugger::dispatchHook<js::Debugger::slowPathOnExceptionUnwind(JSContext*, js::AbstractFramePtr)::<lambda(js::Debugger*)>, js::Debugger::slowPathOnExceptionUnwind(JSContext*, js::AbstractFramePtr)::<lambda(js::Debugger*)> > (fireHook=..., cx=0x7ffff6924000, hookIsEnabled=...) at js/src/vm/Debugger.cpp:1925 #43 js::Debugger::slowPathOnExceptionUnwind (cx=0x7ffff6924000, frame=...) at js/src/vm/Debugger.cpp:1086 #44 0x00000000004fdfa7 in js::Debugger::onExceptionUnwind (frame=..., cx=<optimized out>) at js/src/vm/Debugger-inl.h:66 #45 HandleError (regs=..., cx=<optimized out>) at js/src/vm/Interpreter.cpp:1349 #46 Interpret (cx=0x7ffff6924000, state=...) at js/src/vm/Interpreter.cpp:4293 [...] #56 main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at js/src/shell/js.cpp:8559 rax 0x0 0 rbx 0x7ffff6924000 140737330167808 rcx 0x0 0 rdx 0x7ffff6924000 140737330167808 rsi 0x7ffff430aca0 140737290218656 rdi 0x0 0 rbp 0x7fffffff92c0 140737488327360 rsp 0x7fffffff8b68 140737488325480 r8 0x3b 59 r9 0x7ffff420d000 140737289179136 r10 0x1d 29 r11 0x0 0 r12 0x7ffff6924020 140737330167840 r13 0x7fffffff8fc0 140737488326592 r14 0x1ad4720 28133152 r15 0x7ffff6924000 140737330167808 rip 0x820fb0 <JSFunction::isDerivedClassConstructor()> => 0x820fb0 <JSFunction::isDerivedClassConstructor()>: movzwl 0x22(%rdi),%eax 0x820fb4 <JSFunction::isDerivedClassConstructor()+4>: test $0x2,%ah
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
JSBugMon: Bisection requested, result: Due to skipped revisions, the first bad revision could be any of: changeset: https://hg.mozilla.org/mozilla-central/rev/cb6fc6d38f8d user: Shu-yu Guo date: Thu Aug 25 01:28:47 2016 -0700 summary: Bug 1263355 - Rewrite the frontend: bindings. (r=jorendorff,Waldo) changeset: https://hg.mozilla.org/mozilla-central/rev/18bec78f348e user: Shu-yu Guo date: Thu Aug 25 01:28:47 2016 -0700 summary: Bug 1263355 - Report memory metrics for Scopes. (r=njn) This iteration took 0.818 seconds to run.
Not sure who to needinfo? here, falling back to :jorendorff and :jandem.
Blocks: 1263355
Flags: needinfo?(jorendorff)
Flags: needinfo?(jdemooij)
Attached patch PatchSplinter Review
After shu left, not sure who's a good reviewer for this. The bug is in ThrowUninitializedThis. For debugger eval frames we look at the evalInFramePrev frame's scope (this is the frame in which the debugger is evaluating an expression). This works fine, except when we have a nested eval-in-frame. The fix is just to loop over evalInFramePrev until we get to a non-debugger-eval frame.
Assignee: nobody → jdemooij
Status: NEW → ASSIGNED
Flags: needinfo?(jorendorff)
Flags: needinfo?(jdemooij)
Attachment #8904564 - Flags: review?(tcampbell)
Comment on attachment 8904564 [details] [diff] [review] Patch Review of attachment 8904564 [details] [diff] [review]: ----------------------------------------------------------------- Seems reasonable. We should double-check that https://searchfox.org/mozilla-central/rev/4d8e389498a08668cce9ebf6232cc96be178c3e4/js/src/vm/Stack.cpp#802 doesn't have same problem though.
Attachment #8904564 - Flags: review?(tcampbell) → review+
I bet this fixes bug 1385844 as well.
Oops, I'll get this landed.
Priority: -- → P2
Pushed by jandemooij@gmail.com: https://hg.mozilla.org/integration/mozilla-inbound/rev/6a54320bbbc0 Handle nested eval-in-frame better in ThrowUninitializedThis. r=tcampbell
(In reply to Ted Campbell [:tcampbell] from comment #4) > Seems reasonable. We should double-check that > https://searchfox.org/mozilla-central/rev/ > 4d8e389498a08668cce9ebf6232cc96be178c3e4/js/src/vm/Stack.cpp#802 doesn't > have same problem though. The code there is okay AFAICS.
Status: ASSIGNED → RESOLVED
Closed: 8 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla58
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: