1605254 - Deferred parser allocation leaks BigInt if dead code elimination deletes parse node

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Matthew Gaudet (he/him) [:mgaudet]]

+++ This bug was initially created as a clone of Bug #1604952 +++

128n

ASAN_OPTIONS=detect_leaks=1 $ ./dist/bin/js --fuzzing-safe --no-threads --no-baseline --no-ion --parser-deferred-alloc testcase.js

=================================================================
==18722==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 8 byte(s) in 1 object(s) allocated from:
    #0 0x5634c3844f4d  (/home/matthew/unified/js/src/build_asan_DBG.OBJ/dist/bin/js+0x387cf4d)
    #1 0x5634c3a09264  (/home/matthew/unified/js/src/build_asan_DBG.OBJ/dist/bin/js+0x3a41264)
    #2 0x5634c3a09198  (/home/matthew/unified/js/src/build_asan_DBG.OBJ/dist/bin/js+0x3a41198)
    #3 0x5634c3a0907c  (/home/matthew/unified/js/src/build_asan_DBG.OBJ/dist/bin/js+0x3a4107c)
    #4 0x5634c38a0a9a  (/home/matthew/unified/js/src/build_asan_DBG.OBJ/dist/bin/js+0x38d8a9a)
    #5 0x5634c38a2219  (/home/matthew/unified/js/src/build_asan_DBG.OBJ/dist/bin/js+0x38da219)
    #6 0x5634c39ab549  (/home/matthew/unified/js/src/build_asan_DBG.OBJ/dist/bin/js+0x39e3549)

$

Tested this on m-c rev f870bccd07ee.

Configure flags are:

AR=ar sh ./configure --enable-address-sanitizer --disable-jemalloc --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

This is largely the exact same bug as 1604952.

Comment 1

[Matthew Gaudet (he/him) [:mgaudet]]

Attachment: Bug 1605254 - Move BigIntCreationData to Stencil.h r?tcampbell

Depends on D57904

Comment 2

[Matthew Gaudet (he/him) [:mgaudet]]

Attachment: Bug 1605254 - Change ownership of BigIntCreationData by holding them on frontend::ParseInfo r?tcampbell

Depends on D57936

Comment 3

[Ryan VanderMeulen [:RyanVM]]

Can we land a test for this?

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/9ea8c50d1b1a
Move BigIntCreationData to Stencil.h r=tcampbell
https://hg.mozilla.org/integration/autoland/rev/e36e29c5bd6b
Change ownership of BigIntCreationData by holding them on frontend::ParseInfo r=tcampbell

Comment 5

[Matthew Gaudet (he/him) [:mgaudet]]

Good reminder; I did add a test to the landed patches.

Definitely wontfix for previous releases as this code path is dead without explicit opt in.

Comment 6

[Cristian Brindusan [:cbrindusan]]

https://hg.mozilla.org/mozilla-central/rev/9ea8c50d1b1a
https://hg.mozilla.org/mozilla-central/rev/e36e29c5bd6b