1412309 - Crash [@ js::gcstats::Statistics::lookupChildPhase] or Assertion failure: CooperativeThreadMayYield(cx), at shell/js.cpp:3431

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect, P1)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision d734e6acf777 (build with --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --enable-stdcxx-compat --disable-profiling --disable-debug --without-intl-api --enable-optimize --target=i686-pc-linux-gnu, run with --fuzzing-safe --disable-oom-functions):

See attachment.


Backtrace:

received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0xf4effb40 (LWP 27510)]
js::gcstats::Statistics::lookupChildPhase (this=0xf79502fc, phaseKind=js::gcstats::PhaseKind::MINOR_GC) at js/src/gc/Statistics.cpp:177
#0  js::gcstats::Statistics::lookupChildPhase (this=0xf79502fc, phaseKind=js::gcstats::PhaseKind::MINOR_GC) at js/src/gc/Statistics.cpp:177
#1  0x0874dd35 in js::gcstats::Statistics::beginPhase (this=0xf79502fc, phaseKind=js::gcstats::PhaseKind::MINOR_GC) at js/src/gc/Statistics.cpp:1153
#2  0x08450a58 in js::gcstats::AutoPhase::AutoPhase (phaseKind=<optimized out>, stats=..., this=<synthetic pointer>) at js/src/gc/Statistics.h:415
#3  js::gc::GCRuntime::minorGC (this=this@entry=0xf79502d0, reason=reason@entry=JS::gcreason::OUT_OF_NURSERY, phase=<optimized out>) at js/src/jsgc.cpp:7671
#4  0x08450bb5 in js::gc::GCRuntime::minorGC (this=0xf79502d0, reason=JS::gcreason::OUT_OF_NURSERY, phase=js::gcstats::PhaseKind::MINOR_GC) at js/src/jsgc.cpp:7691
#5  0x086b55df in js::gc::GCRuntime::tryNewNurseryObject<(js::AllowGC)1> (this=<optimized out>, clasp=<optimized out>, nDynamicSlots=0, thingSize=48, cx=0xf792f800) at js/src/gc/Allocator.cpp:91
#6  js::Allocate<JSObject, (js::AllowGC)1> (cx=0xf792f800, kind=js::gc::AllocKind::OBJECT4_BACKGROUND, nDynamicSlots=0, heap=js::gc::DefaultHeap, clasp=0x8a9c0e0 <js::ArrayObject::class_>) at js/src/gc/Allocator.cpp:55
#7  0x0812e1a7 in js::ArrayObject::createArrayInternal (group=..., shape=..., heap=js::gc::DefaultHeap, kind=js::gc::AllocKind::OBJECT4_BACKGROUND, cx=0xf792f800) at js/src/vm/ArrayObject-inl.h:55
#8  js::ArrayObject::createArray (cx=0xf792f800, kind=js::gc::AllocKind::OBJECT4_BACKGROUND, heap=js::gc::DefaultHeap, shape=..., group=..., length=1, metadata=...) at js/src/vm/ArrayObject-inl.h:83
#9  0x0812654f in NewArray<4294967295u> (newKind=js::GenericObject, protoArg=..., length=1, cx=0xf792f800) at js/src/jsarray.cpp:3800
#10 js::NewDenseFullyAllocatedArray (cx=cx@entry=0xf792f800, length=1, proto=..., newKind=js::GenericObject) at js/src/jsarray.cpp:3842
#11 0x08143931 in js::NewArrayOperationWithTemplate (cx=0xf792f800, templateObject=...) at js/src/vm/Interpreter.cpp:5046
#12 0x08347be9 in js::jit::DoNewArray (cx=0xf792f800, payload=0xf4efe1f8, stub=0xf52910b0, length=1, res=...) at js/src/jit/SharedIC.cpp:2717
#13 0x336aa1fb in ?? ()
[...]
#20 0x336a78d8 in ?? ()
#21 0x082a25d5 in EnterJit (cx=0x336b6b1f, state=..., code=0x336b7010 "\351\026") at js/src/jit/Jit.cpp:106
#22 0x0814fa5f in Interpret (cx=0xf792f800, state=...) at js/src/vm/Interpreter.cpp:3096
#23 0x08154721 in js::RunScript (cx=0xf792f800, state=...) at js/src/vm/Interpreter.cpp:423
#24 0x081561cc in js::ExecuteKernel (cx=<optimized out>, script=..., envChainArg=..., newTargetValue=..., evalInFrame=..., result=<optimized out>) at js/src/vm/Interpreter.cpp:706
#25 0x08156313 in js::Execute (cx=0xf792f800, script=..., envChainArg=..., rval=0xf52e8060) at js/src/vm/Interpreter.cpp:739
#26 0x0840d690 in ExecuteScript (cx=cx@entry=0xf792f800, scope=..., scope@entry=..., script=script@entry=..., rval=0xf52e8060) at js/src/jsapi.cpp:4690
#27 0x08421c23 in ExecuteScript (cx=0xf792f800, envChain=..., scriptArg=..., scriptArg@entry=..., rval=0xf52e8060) at js/src/jsapi.cpp:4709
#28 0x08421c89 in JS_ExecuteScript (cx=<optimized out>, envChain=..., scriptArg=..., rval=...) at js/src/jsapi.cpp:4730
#29 0x0809aae5 in Evaluate (cx=0xf792f800, argc=1, vp=0xf52e8060) at js/src/shell/js.cpp:1779
#30 0x08154ab4 in js::CallJSNative (args=..., native=<optimized out>, cx=0xf792f800) at js/src/jscntxtinlines.h:291
#31 js::InternalCallOrConstruct (cx=0xf792f800, args=..., construct=js::NO_CONSTRUCT) at js/src/vm/Interpreter.cpp:473
#32 0x08154e72 in InternalCall (cx=<optimized out>, args=...) at js/src/vm/Interpreter.cpp:522
#33 0x081481d3 in js::CallFromStack (args=..., cx=<optimized out>) at js/src/vm/Interpreter.cpp:528
#34 Interpret (cx=0xf792f800, state=...) at js/src/vm/Interpreter.cpp:3067
#35 0x08154721 in js::RunScript (cx=0xf792f800, state=...) at js/src/vm/Interpreter.cpp:423
#36 0x081561cc in js::ExecuteKernel (cx=<optimized out>, script=..., envChainArg=..., newTargetValue=..., evalInFrame=..., result=<optimized out>) at js/src/vm/Interpreter.cpp:706
#37 0x08156313 in js::Execute (cx=0xf792f800, script=..., envChainArg=..., rval=0xf4eff288) at js/src/vm/Interpreter.cpp:739
#38 0x0840d690 in ExecuteScript (cx=cx@entry=0xf792f800, scope=..., scope@entry=..., script=script@entry=..., rval=0xf4eff288) at js/src/jsapi.cpp:4690
#39 0x08415dac in JS_ExecuteScript (cx=0xf792f800, scriptArg=..., rval=...) at js/src/jsapi.cpp:4716
#40 0x08098214 in WorkerMain (arg=0xf522acd0) at js/src/shell/js.cpp:3612
#41 0x0809d219 in js::detail::ThreadTrampoline<void (&)(void*), WorkerInput*&>::callMain<0u> (this=0xf790b158) at js/src/threading/Thread.h:239
#42 js::detail::ThreadTrampoline<void (&)(void*), WorkerInput*&>::Start (aPack=0xf790b158) at js/src/threading/Thread.h:232
#43 0xf7fb228a in start_thread (arg=0xf4effb40) at pthread_create.c:333
#44 0xf7cd94ce in clone () from /lib32/libc.so.6
eax	0x8acc574	145540468
ebx	0x8ad0860	145557600
ecx	0x8acaff4	145534964
edx	0x87ef828	142538792
esi	0x586c	22636
edi	0x52	82
ebp	0x69	105
esp	0xf4efdebc	4109360828
eip	0x874cafe <js::gcstats::Statistics::lookupChildPhase(js::gcstats::PhaseKind) const+238>
=> 0x874cafe <js::gcstats::Statistics::lookupChildPhase(js::gcstats::PhaseKind) const+238>:	movl   $0x0,0x0
   0x874cb08 <js::gcstats::Statistics::lookupChildPhase(js::gcstats::PhaseKind) const+248>:	ud2

Comment 1

[Christian Holler (:decoder)]

Attachment: Testcase

Comment 2

[Jason Orendorff [:jorendorff]]

Brian, could you take a look?

Comment 3

[Brian Hackett [Laid off!]]

I can't reproduce this on m-i tip, is it still crashing with the recent cooperative threading fixes?  A stack for the crash in a debug build would also help.

Comment 4

[Christian Holler (:decoder)]

Can't seem to reproduce this anymore, closing as WFM. Will reopen when I see this again.