1459244 - Assertion failure: task->outOfMemory || task->overRecursed || !task->errors.empty(), at frontend/BytecodeCompiler.cpp:595 or Assertion failure: false (Expected script), at vm/HelperThreads.cpp:1672 with OOM

Status: RESOLVED DUPLICATE of bug 1459258

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 8994f35fe5fc (build with --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --disable-profiling --enable-debug --enable-optimize, run with --fuzzing-safe):

function eval(source) {
  offThreadCompileModule(source);
  finishOffThreadModule();
}
oomTest(function() {
  eval(`
    print(BUGNUMBER + ": " + summary);
    test(q++, "\\\\\\\\n");
    test(/\\\\\\n/, "\\\\\\\\\\\\n");
    test(/\\\\\\\\n/, "\\\\\\\\\\\\\\\\n");
    test(RegExp("\\\\\\n"), "\\\\n");
    test(/\\\\\\\\r/, "\\\\\\\\\\\\\\\\r");
    test(RegExp("\\\\\\r"), "\\\\r");
    test(RegExp("\\\\\\\\r"), "\\\\\\\\r");
    test(/\\\\u2028/, "\\\\\\\\u2028");
    test(/\\\\\\u2028/, "\\\\\\\\\\\\u2028");
    Object.prototype[Symbol.toPrimitive] = Array;
    test(RegExp("\\\\\\u2028"), "\\\\u2028");
  `);
});


Backtrace:

received signal SIGSEGV, Segmentation fault.
#0  0x0000000000eb0ff3 in AutoAssertReportedException::~AutoAssertReportedException (this=0x7ffff5cfc2e0, __in_chrg=<optimized out>) at js/src/frontend/BytecodeCompiler.cpp:593
#1  0x0000000000eae64b in js::frontend::CompileModule (cx=<optimized out>, optionsInput=..., srcBuf=..., alloc=..., sourceObjectOut=sourceObjectOut@entry=0x7ffff5cfcf30) at js/src/frontend/BytecodeCompiler.cpp:696
#2  0x0000000000b68f5b in js::ModuleParseTask::parse (this=0x7ffff5f22000, cx=<optimized out>) at js/src/vm/HelperThreads.cpp:506
#3  0x0000000000b64e77 in js::HelperThread::handleParseWorkload (this=<optimized out>, locked=...) at js/src/vm/HelperThreads.cpp:2004
[...]
#9  0x00007ffff6c383dd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109
rax	0x0	0
rbx	0x7ffff5cfc2e0	140737317421792
rcx	0x7ffff6c282ad	140737333330605
rdx	0x0	0
rsi	0x7ffff6ef7770	140737336276848
rdi	0x7ffff6ef6540	140737336272192
rbp	0x7ffff5cfc2c0	140737317421760
rsp	0x7ffff5cfc2a0	140737317421728
r8	0x7ffff6ef7770	140737336276848
r9	0x7ffff5cfe700	140737317431040
r10	0x58	88
r11	0x7ffff6b9e7a0	140737332766624
r12	0x7ffff5cfd070	140737317425264
r13	0x7ffff5cfd070	140737317425264
r14	0x7ffff5cfc2f0	140737317421808
r15	0x7ffff5cfc3c0	140737317422016
rip	0xeb0ff3 <AutoAssertReportedException::~AutoAssertReportedException()+291>
=> 0xeb0ff3 <AutoAssertReportedException::~AutoAssertReportedException()+291>:	movl   $0x0,0x0
   0xeb0ffe <AutoAssertReportedException::~AutoAssertReportedException()+302>:	ud2

Comment 1

[Fuzzing Team]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/92824bef6153
user:        Jan de Mooij
date:        Thu Apr 26 09:59:32 2018 +0200
summary:     Bug 1452114 part 2 - Add diagnostic asserts. r=jonco

This iteration took 284.024 seconds to run.

Comment 2

[Jan de Mooij [:jandem]]

This is the off-thread version of bug 1459258.