1585712 - Crash [@ js::jit::ExecutableAllocator::reprotectPool] should use AutoEnterOOMUnsafeRegion instead of MOZ_CRASH

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

We sometimes hit crashes in the ExecutableAllocator that seem to indicate that we are OOMing. The current implementation has a MOZ_CRASH() call in place, it should probably use AutoEnterOOMUnsafeRegion instead so the fuzzers will ignore the crash entirely.

The specific line that we are crashing at is here:

https://searchfox.org/mozilla-central/rev/f372e8a46ef7659ef61be9938ec2a3ea34d343c6/js/src/jit/ExecutableAllocator.cpp#266

Comment 1

[Christian Holler (:decoder)]

NI for :jandem as discussed on IRC.

Comment 2

[Nicolas B. Pierron [:nbp]]

While I agree that this is an OOM and not a crash I want to share what I learned when abusing mprotect calls on LifoAlloc buffers:

• Linux reports an OOM properly.
• Windows reports that arguments are incorrect.
• Mac crashes within mprotect.

Thus, if we see frequent cases of these crashes in crash stat, we should probably look at a different way to handle the granularity of mprotect calls, to avoid having too much fragmentation.

Maybe a work-around or fallback would be to split our reserved space in N chunks of multiple MB to avoid the fragmentation.

Comment 3

[Jan de Mooij [:jandem]]

Attachment: Bug 1585712 - Use AutoEnterOOMUnsafeRegion instead of MOZ_CRASH in ExecutableAllocator::reprotectPool. r?jonco!

mprotect is fallible and this makes it easier for fuzzers to deal with.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/937f71d963ae
Use AutoEnterOOMUnsafeRegion instead of MOZ_CRASH in ExecutableAllocator::reprotectPool. r=jonco

Comment 5

[Raul Gurzau (:RaulG)]

https://hg.mozilla.org/mozilla-central/rev/937f71d963ae