1439180 - Crash [@ ??]

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision dde7eb1a589f (build with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --no-threads --ion-eager):

h = function() {
    ff = encodeURIComponent;
    function f(x) {
        x = +ff(0 / 0);
        return /I/ (~x);
    }
    return f;
}()
for (var j = 0; j < 3; j++) {
    try {
        h();
    } catch (e) {}
}

Backtrace:

(gdb) bt
#0  0x000007507a556396 in ?? ()
#1  0xfff9800000000000 in ?? ()
#2  0xfff88000ffffffff in ?? ()
#3  0x00007ffff5d8e040 in ?? ()
#4  0x7ff8000000000000 in ?? ()
/snip

For detailed crash information, see attachment.

Setting [fuzzblocker] because this is happening very often.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/52f1dfd75ff7
user:        Matthew Gaudet
date:        Fri Feb 02 10:38:43 2018 -0500
summary:     Bug 1434717: Part 5: Connect UnaryArith IC to IonMonkey r=tcampbell

Matthew, is bug 1434717 a likely regressor?

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Since this got landed just before the long weekend, causing jsfunfuzz to continuously hit this bug, I contemplated backing the offending patch out. However, it is a series of patches, so I am not sure if all the patches should be backed out or just this one, so I didn't do anything.

Please consider fixing this as soon as possible.

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(gdb) x/i $pc
=> 0x7507a556396:       mov    (%rax),%rdi
(gdb) x/b $rax
0x0:    Cannot access memory at address 0x0
(gdb) x/b $rdi
0x7fffffffce98: 0x00
(gdb)

Actually, locking s-s until more analysis is in place. While it seems to be a null deref, memory addresses are all over the stack.

Comment 5

[Matthew Gaudet (he/him) [:mgaudet]]

Attachment: Revert CacheIR UnaryArith Stubs

This patch reverts the following revisions:

 52f1dfd75ff7
 286c42a171d8
 bf1d9d0ebbe7
 5c5ec856f0a6
 43a875bf1c8a
 7fd6eaf7fc97

reverting the delivery of Bug 1434717.

Comment 6

[Matthew Gaudet (he/him) [:mgaudet]]

Comment on attachment 8951944 [details] [diff] [review]
Revert CacheIR UnaryArith Stubs

(r=me because this is a revert commit generated by hg backout)

Comment 7

[Matthew Gaudet (he/him) [:mgaudet]]

Attempting to land this via the original bug 1434717, depends on review.

Comment 8

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Backout of bug 1434717: https://hg.mozilla.org/integration/mozilla-inbound/rev/11e086a7d4634a6e8f33f288422233a93734d601

Comment 9

[Fuzzing Team]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 48b635e3d447).

Comment 10

[Christian Holler (:decoder)]

Fixed by the backout of bug 1434717.

Comment 11

[Fuzzing Team]

JSBugMon: This bug has been automatically verified fixed.