1478943 - Assertion failure: aIndex < mLength, at dist/include/mozilla/Vector.h:545

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision 8f2f847b2f9d (build with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --no-threads --no-baseline --no-ion):

gcparam("markStackLimit", 1);
startgc(1);

Backtrace:

#0  0x0000000001c9e3c3 in mozilla::Vector<js::gc::MarkStack::TaggedPtr, 0ul, js::SystemAllocPolicy>::operator[] (this=<optimized out>, aIndex=1) at /home/ubuntu/shell-cache/js-dbg-64-dm-linux-8f2f847b2f9d/objdir-js/dist/include/mozilla/Vector.h:545
#1  js::gc::MarkStack::poisonUnused (this=0x7f69ea11a6a8) at js/src/gc/Marking.cpp:2257
#2  0x0000000001c805a7 in js::GCMarker::saveValueRanges (this=<optimized out>) at js/src/gc/Marking.cpp:1820
#3  0x0000000001c64b69 in js::GCMarker::drainMarkStack (this=0x7f69ea11a690, budget=...) at js/src/gc/Marking.cpp:1569
#4  0x0000000001c719b6 in js::gc::GCRuntime::drainMarkStack (sliceBudget=..., phase=js::gcstats::PhaseKind::MARK, this=<optimized out>) at js/src/gc/GC.cpp:5922
#5  js::gc::GCRuntime::incrementalCollectSlice (this=0x7f69ea1196d8, budget=..., reason=JS::gcreason::DEBUG_GC, session=...) at js/src/gc/GC.cpp:7130
#6  0x0000000001c73a4d in js::gc::GCRuntime::gcCycle (this=0x7f69ea1196d8, nonincrementalByAPI=<optimized out>, budget=..., reason=<optimized out>) at js/src/gc/GC.cpp:7519
/snip

For detailed crash information, see attachment.

GC is on the stack and GC functions are involved, so setting s-s as a start.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autobisectjs shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/aa709ea6ba7c
user:        Jon Coppeard
date:        Thu Jul 26 15:33:46 2018 +0100
summary:     Bug 1476239 - Poison unused mark stack memory r=sfink

Jon, is bug 1476239 a likely regressor?

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Setting [fuzzblocker] as this is happening quite frequently.

Comment 4

[Jon Coppeard (:jonco) (PTO until 14th September)]

Not s-s.

I was using the array subscript operator on a vector and taking the address of the the resulting reference, but in the case where the vector index was out of bounds the address will never be accessed.  Also this is during poisoning which is not present in release builds.

Comment 5

[Jon Coppeard (:jonco) (PTO until 14th September)]

Attachment: bug1478943-mark-stack-poison

As above.  Don't use subscript operator on possibly out-of-bounds index.

Comment 6

[Intermittent Failures Robot]

2 failures in 760 pushes (0.003 failures/push) were associated with this bug in the last 7 days.    

Repository breakdown:
* mozilla-central: 1
* autoland: 1

Platform breakdown:
* linux32: 1
* android-em-4-3-armv7-api16: 1

For more details, see:
https://treeherder.mozilla.org/intermittent-failures.html#/bugdetails?bug=1478943&startday=2018-07-23&endday=2018-07-29&tree=trunk

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/351c166e1728
Fix mark stack poisoning r=sfink

Comment 10

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/351c166e1728

Comment 11

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The regressing bug 1476239 was backported to 62, so Jon, do you mind please nominating this for backport to beta?

Comment 12

[Jon Coppeard (:jonco) (PTO until 14th September)]

Comment on attachment 8995465 [details] [diff] [review]
bug1478943-mark-stack-poison

This only affects debug/nightly builds so feel free to reject if this doesn't meet backporting criteria.

Approval Request Comment
[Feature/Bug causing the regression]: Bug 1476239.
[User impact if declined]: This only affects debug builds, so there's no end user impact.  On debug builds there may be an assertion failure.
[Is this code covered by automated tests?]: Yes
[Has the fix been verified in Nightly?]: Yes
[Needs manual test from QE? If yes, steps to reproduce]:  No
[List of other uplifts needed for the feature/fix]: None
[Is the change risky?]: No
[Why is the change risky/not risky?]: This is a very small simple fix
[String changes made/needed]: None

Comment 13

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 8995465 [details] [diff] [review]
bug1478943-mark-stack-poison

Makes life better for our fuzzers. Approved for 62.0b18.

Comment 14

[Cristian Brindusan [:cbrindusan]]

https://hg.mozilla.org/releases/mozilla-beta/rev/486daac9c707