Closed Bug 1640729 Opened 5 months ago Closed 5 months ago

Intermittent SUMMARY: AddressSanitizer: SEGV /build/glibc-6V9RKT/glibc-2.19/string/../sysdeps/x86_64/multiarch/memcpy-ssse3-back.S:130

Categories

(Core :: JavaScript: GC, defect, P5)

defect

Tracking

()

RESOLVED DUPLICATE of bug 1638764

People

(Reporter: intermittent-bug-filer, Unassigned)

Details

(Keywords: intermittent-failure)

Filed by: ncsoregi [at] mozilla.com
Parsed log: https://treeherder.mozilla.org/logviewer.html#?job_id=303678189&repo=autoland
Full log: https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/MhBvuIoXQciSl7JkQpk5_g/runs/0/artifacts/public/logs/live_backing.log


[task 2020-05-25T19:12:14.987Z] TEST-PASS | js/src/jit-test/tests/gc/bug-1490042.js | Success (code 59, args "--no-ion --no-baseline --no-blinterp") [0.1 s]
[task 2020-05-25T19:12:15.022Z] AddressSanitizer:DEADLYSIGNAL
[task 2020-05-25T19:12:15.022Z] =================================================================
[task 2020-05-25T19:12:15.022Z] ==11113==ERROR: AddressSanitizer: SEGV on unknown address 0x000000003ef0 (pc 0x7ffff6e98519 bp 0x7fffffdf4f50 sp 0x7fffffdf4708 T0)
[task 2020-05-25T19:12:15.022Z] ==11113==The signal is caused by a READ memory access.
[task 2020-05-25T19:12:15.022Z] #0 0x7ffff6e98518 /build/glibc-6V9RKT/glibc-2.19/string/../sysdeps/x86_64/multiarch/memcpy-ssse3-back.S:130
[task 2020-05-25T19:12:15.022Z] #1 0x555555a6c6c7 in _asan_memcpy /builds/worker/fetches/llvm-project/llvm/projects/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cc:22:3
[task 2020-05-25T19:12:15.022Z] #2 0x55555709ad0a in swap<js::gc::ChunkBitmap> /builds/worker/fetches/clang/bin/../lib/gcc/x86_64-unknown-linux-gnu/7.4.0/../../../../include/c++/7.4.0/bits/move.h:198:19
[task 2020-05-25T19:12:15.022Z] #3 0x55555709ad0a in js::gc::MarkingValidator::nonIncrementalMark(js::gc::AutoGCSession&) /builds/worker/workspace/build/src/js/src/gc/Verifier.cpp:638:7
[task 2020-05-25T19:12:15.022Z] #4 0x555556fc934b in js::gc::GCRuntime::beginSweepPhase(JS::GCReason, js::gc::AutoGCSession&) /builds/worker/workspace/build/src/js/src/gc/GC.cpp:5469:3
[task 2020-05-25T19:12:15.022Z] #5 0x555556fd5813 in js::gc::GCRuntime::incrementalSlice(js::SliceBudget&, mozilla::Maybe<JSGCInvocationKind> const&, JS::GCReason, js::gc::AutoGCSession&) /builds/worker/workspace/build/src/js/src/gc/GC.cpp:6666:7
[task 2020-05-25T19:12:15.022Z] #6 0x555556fd936c in js::gc::GCRuntime::gcCycle(bool, js::SliceBudget, mozilla::Maybe<JSGCInvocationKind> const&, JS::GCReason) /builds/worker/workspace/build/src/js/src/gc/GC.cpp:7086:3
[task 2020-05-25T19:12:15.022Z] #7 0x555556fdcd00 in js::gc::GCRuntime::collect(bool, js::SliceBudget, mozilla::Maybe<JSGCInvocationKind> const&, JS::GCReason) /builds/worker/workspace/build/src/js/src/gc/GC.cpp:7297:9
[task 2020-05-25T19:12:15.022Z] #8 0x555556fe5b13 in js::gc::GCRuntime::runDebugGC() /builds/worker/workspace/build/src/js/src/gc/GC.cpp:7886:5
[task 2020-05-25T19:12:15.022Z] #9 0x555556f4c358 in gcIfNeededAtAllocation /builds/worker/workspace/build/src/js/src/gc/Allocator.cpp:442:5
[task 2020-05-25T19:12:15.022Z] #10 0x555556f4c358 in checkAllocatorState<js::CanGC> /builds/worker/workspace/build/src/js/src/gc/Allocator.cpp:404:10
[task 2020-05-25T19:12:15.022Z] #11 0x555556f4c358 in js::AccessorShape* js::Allocate<js::AccessorShape, (js::AllowGC)1>(JSContext*) /builds/worker/workspace/build/src/js/src/gc/Allocator.cpp:329:28
[task 2020-05-25T19:12:15.022Z] #12 0x5555565781be in js::Shape::new
(JSContext*, JS::Handle<js::StackShape>, unsigned int) /builds/worker/workspace/build/src/js/src/vm/Shape-inl.h:111:44
[task 2020-05-25T19:12:15.022Z] #13 0x55555650a484 in inlinedGetChild /builds/worker/workspace/build/src/js/src/vm/Shape.cpp:1886:18
[task 2020-05-25T19:12:15.022Z] #14 0x55555650a484 in getChildAccessorProperty /builds/worker/workspace/build/src/js/src/vm/Shape.cpp:472:45
[task 2020-05-25T19:12:15.022Z] #15 0x55555650a484 in js::NativeObject::addAccessorPropertyInternal(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::PropertyKey>, bool ()(JSContext, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JS::MutableHandle<JS::Value>), bool ()(JSContext, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::ObjectOpResult&), unsigned int, js::ShapeTable*, js::ShapeTable::Entry*, js::AutoKeepShapeCaches const&) /builds/worker/workspace/build/src/js/src/vm/Shape.cpp:688:13
[task 2020-05-25T19:12:15.022Z] #16 0x5555563aa2b3 in addAccessorProperty /builds/worker/workspace/build/src/js/src/vm/Shape-inl.h:457:10
[task 2020-05-25T19:12:15.022Z] #17 0x5555563aa2b3 in AddOrChangeProperty<IsAddOrChange::Add> /builds/worker/workspace/build/src/js/src/vm/NativeObject.cpp:1453:15
[task 2020-05-25T19:12:15.022Z] #18 0x5555563aa2b3 in js::NativeDefineProperty(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::PropertyDescriptor>, JS::ObjectOpResult&) /builds/worker/workspace/build/src/js/src/vm/NativeObject.cpp:1758:10
[task 2020-05-25T19:12:15.022Z] #19 0x5555562f99b6 in DefineAccessorProperty /builds/worker/workspace/build/src/js/src/vm/JSObject.cpp:2725:10
[task 2020-05-25T19:12:15.022Z] #20 0x5555562f99b6 in js::DefineAccessorProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JS::Handle<JSObject*>, JS::Handle<JSObject*>, unsigned int) /builds/worker/workspace/build/src/js/src/vm/JSObject.cpp:2744:8
[task 2020-05-25T19:12:15.022Z] #21 0x555555e6e979 in DefineAccessorPropertyById /builds/worker/workspace/build/src/js/src/jsapi.cpp:2108:10
[task 2020-05-25T19:12:15.022Z] #22 0x555555e6e979 in DefineAccessorPropertyById(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JSNativeWrapper const&, JSNativeWrapper const&, unsigned int) /builds/worker/workspace/build/src/js/src/jsapi.cpp:2155:10
[task 2020-05-25T19:12:15.022Z] #23 0x555555e847a4 in JS_DefineProperties(JSContext*, JS::Handle<JSObject*>, JSPropertySpec const*) /builds/worker/workspace/build/src/js/src/jsapi.cpp:3128:14
[task 2020-05-25T19:12:15.022Z] #24 0x5555560ad365 in js::GlobalObject::resolveConstructor(JSContext*, JS::Handle<js::GlobalObject*>, JSProtoKey, js::GlobalObject::IfClassIsDisabled) /builds/worker/workspace/build/src/js/src/vm/GlobalObject.cpp:342:12
[task 2020-05-25T19:12:15.022Z] #25 0x55555645fec8 in ensureConstructor /builds/worker/workspace/build/src/js/src/vm/GlobalObject.h:179:12
[task 2020-05-25T19:12:15.022Z] #26 0x55555645fec8 in getOrCreateSavedFramePrototype /builds/worker/workspace/build/src/js/src/vm/GlobalObject.h:422:10
[task 2020-05-25T19:12:15.022Z] #27 0x55555645fec8 in js::SavedFrame::create(JSContext*) /builds/worker/workspace/build/src/js/src/vm/SavedStacks.cpp:557:22
[task 2020-05-25T19:12:15.022Z] #28 0x5555564778f8 in createFrameFromLookup /builds/worker/workspace/build/src/js/src/vm/SavedStacks.cpp:1730:30
[task 2020-05-25T19:12:15.022Z] #29 0x5555564778f8 in js::SavedStacks::getOrCreateSavedFrame(JSContext*, JS::Handle<js::SavedFrame::Lookup>) /builds/worker/workspace/build/src/js/src/vm/SavedStacks.cpp:1716:30
[task 2020-05-25T19:12:15.022Z] #30 0x55555646f54b in js::SavedStacks::insertFrames(JSContext*, JS::MutableHandle<js::SavedFrame*>, mozilla::Variant<JS::AllFrames, JS::MaxFrames, JS::FirstSubsumedFrame>&&) /builds/worker/workspace/build/src/js/src/vm/SavedStacks.cpp:1570:15
[task 2020-05-25T19:12:15.022Z] #31 0x55555646c8da in js::SavedStacks::saveCurrentStack(JSContext*, JS::MutableHandle<js::SavedFrame*>, mozilla::Variant<JS::AllFrames, JS::MaxFrames, JS::FirstSubsumedFrame>&&) /builds/worker/workspace/build/src/js/src/vm/SavedStacks.cpp:1307:10
[task 2020-05-25T19:12:15.022Z] #32 0x555555eaa3d0 in CaptureCurrentStack /builds/worker/workspace/build/src/js/src/jsapi.cpp:5852:29
[task 2020-05-25T19:12:15.022Z] #33 0x555555eaa3d0 in js::CaptureStack(JSContext*, JS::MutableHandle<JSObject*>) /builds/worker/workspace/build/src/js/src/jsexn.cpp:219:10
[task 2020-05-25T19:12:15.022Z] #34 0x555555eab929 in js::ErrorToException(JSContext*, JSErrorReport*, JSErrorFormatString const* ()(void, unsigned int), void*) /builds/worker/workspace/build/src/js/src/jsexn.cpp:329:8
[task 2020-05-25T19:12:15.022Z] #35 0x555556089f08 in ReportError /builds/worker/workspace/build/src/js/src/vm/ErrorReporting.cpp:164:3
[task 2020-05-25T19:12:15.022Z] #36 0x555556089f08 in js::ReportErrorNumberVA(JSContext*, js::IsWarning, JSErrorFormatString const* ()(void, unsigned int), void*, unsigned int, js::ErrorArgumentsType, __va_list_tag*) /builds/worker/workspace/build/src/js/src/vm/ErrorReporting.cpp:477:3
[task 2020-05-25T19:12:15.022Z] #37 0x555555e572c7 in JS_ReportErrorNumberASCIIVA /builds/worker/workspace/build/src/js/src/jsapi.cpp:4777:3
[task 2020-05-25T19:12:15.022Z] #38 0x555555e572c7 in JS_ReportErrorNumberASCII(JSContext*, JSErrorFormatString const* ()(void, unsigned int), void*, unsigned int, ...) /builds/worker/workspace/build/src/js/src/jsapi.cpp:4767:3
[task 2020-05-25T19:12:15.022Z] #39 0x555556263c5d in js::ReportOverRecursed(JSContext*, unsigned int) /builds/worker/workspace/build/src/js/src/vm/JSContext.cpp:309:7
[task 2020-05-25T19:12:15.022Z] #40 0x555555c78100 in CheckRecursionLimit /builds/worker/workspace/build/src/js/src/jsfriendapi.h:993:5
[task 2020-05-25T19:12:15.022Z] #41 0x555555c78100 in CheckRecursionLimit /builds/worker/workspace/build/src/js/src/jsfriendapi.h:1019:10
[task 2020-05-25T19:12:15.022Z] #42 0x555555c78100 in js::RunScript(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:427:8
[task 2020-05-25T19:12:15.022Z] #43 0x555555cab838 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:620:13
[task 2020-05-25T19:12:15.022Z] #44 0x5555571bc409 in js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICCall_Fallback*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/jit/BaselineIC.cpp:2990:10
[task 2020-05-25T19:12:15.022Z] #45 0x248e090c4bd7 (<unknown module>)
[task 2020-05-25T19:12:15.022Z]
[task 2020-05-25T19:12:15.022Z] AddressSanitizer can not provide additional info.
[task 2020-05-25T19:12:15.022Z] SUMMARY: AddressSanitizer: SEGV /build/glibc-6V9RKT/glibc-2.19/string/../sysdeps/x86_64/multiarch/memcpy-ssse3-back.S:130
[task 2020-05-25T19:12:15.022Z] ==11113==ABORTING
[task 2020-05-25T19:12:15.022Z] Exit code: 1
[task 2020-05-25T19:12:15.022Z] FAIL - gc/bug-1459860.js
[task 2020-05-25T19:12:15.022Z] TEST-UNEXPECTED-FAIL | js/src/jit-test/tests/gc/bug-1459860.js | AddressSanitizer:DEADLYSIGNAL (code 1, args "") [0.8 s]
[task 2020-05-25T19:12:15.022Z] INFO exit-status : 1
[task 2020-05-25T19:12:15.022Z] INFO timed-out : False
[task 2020-05-25T19:12:15.022Z] INFO stderr 2> AddressSanitizer:DEADLYSIGNAL
[task 2020-05-25T19:12:15.022Z] INFO stderr 2> =================================================================

Status: NEW → RESOLVED
Closed: 5 months ago
Resolution: --- → DUPLICATE
Duplicate of bug: 1638764
You need to log in before you can comment on or make changes to this bug.