1670533 - segmentation fault at gecko-dev/js/src/shell/js.cpp:3711

Status: RESOLVED DUPLICATE of bug 1670532

(Core :: JavaScript Engine, defect)

Description

[Jianwen Sun]

Attachment: 000003.txt

Hit MOZ_CRASH(a) at gecko-dev/js/src/shell/js.cpp:3711
Git commit: 27ded6834ef8b61fa52838acd59fe617bf44c61c
Testing environment: Ubuntu 16.04
Testing command: ./gecko 000003.txt

#0 Crash (cx=0x7ffff6427000, argc=0, vp=<optimized out>) at /root/AFL/compile/gecko-dev/js/src/shell/js.cpp:3711
#1 0x0000555555b5ab5d in CallJSNative (cx=0x7ffff6427000,
native=0x5555559734f0 <Crash(JSContext*, unsigned int, JS::Value*)>, reason=<optimized out>, args=...)
at /root/AFL/compile/gecko-dev/js/src/vm/Interpreter.cpp:456
#2 0x0000555555b31944 in js::InternalCallOrConstruct (cx=<optimized out>, args=..., construct=<optimized out>,
reason=<optimized out>) at /root/AFL/compile/gecko-dev/js/src/vm/Interpreter.cpp:548
#3 0x0000555555b33966 in js::Call (cx=0x7ffff76a8540 <_IO_2_1_stderr_>, fval=..., thisv=..., args=..., rval=...,
reason=js::CallReason::Call) at /root/AFL/compile/gecko-dev/js/src/vm/Interpreter.cpp:634
#4 0x0000555556301372 in js::fun_call (cx=0x7ffff6427000, argc=<optimized out>, vp=<optimized out>)
at /root/AFL/compile/gecko-dev/js/src/vm/JSFunction.cpp:1119
#5 0x0000555555b5ab5d in CallJSNative (cx=0x7ffff6427000,
native=0x555556300d60 <js::fun_call(JSContext*, unsigned int, JS::Value*)>, reason=<optimized out>, args=...)
at /root/AFL/compile/gecko-dev/js/src/vm/Interpreter.cpp:456
#6 0x0000555555b31944 in js::InternalCallOrConstruct (cx=<optimized out>, args=..., construct=<optimized out>,
reason=<optimized out>) at /root/AFL/compile/gecko-dev/js/src/vm/Interpreter.cpp:548
#7 0x0000555555b296aa in js::CallFromStack (cx=0x7ffff6427000, args=...)
at /root/AFL/compile/gecko-dev/js/src/vm/Interpreter.cpp:621
#8 Interpret (cx=<optimized out>, state=...) at /root/AFL/compile/gecko-dev/js/src/vm/Interpreter.cpp:3110
#9 0x0000555555b00955 in js::RunScript (cx=0x7ffff6427000, state=...)
at /root/AFL/compile/gecko-dev/js/src/vm/Interpreter.cpp:423
#10 0x0000555555b370da in js::ExecuteKernel (cx=<optimized out>, script=..., envChainArg=..., newTargetValue=...,
evalInFrame=..., result=0x0) at /root/AFL/compile/gecko-dev/js/src/vm/Interpreter.cpp:810
#11 0x0000555555b37ab7 in js::Execute (cx=0x7ffff6427000, script=..., envChainArg=..., rval=<optimized out>)
at /root/AFL/compile/gecko-dev/js/src/vm/Interpreter.cpp:843
#12 0x000055555602f612 in ExecuteScript (cx=0x7ffff6427000, scope=..., script=..., rval=0x0)
at /root/AFL/compile/gecko-dev/js/src/vm/CompilationAndEvaluation.cpp:449
#13 0x000055555602f94f in JS_ExecuteScript (cx=0x7ffff6427000, scriptArg=...)
at /root/AFL/compile/gecko-dev/js/src/vm/CompilationAndEvaluation.cpp:482
#14 0x000055555597cf02 in RunFile (cx=<optimized out>,
---Type <return> to continue, or q <return> to quit---
filename=0x7fffffffecc8 "crashes/id:000003,sig:11,src:004185+002502,op:expcross,pos:0", file=<optimized out>,
compileMethod=CompileUtf8::DontInflate,
compileOnly=<error reading variable: access outside bounds of object referenced via synthetic pointer>)
at /root/AFL/compile/gecko-dev/js/src/shell/js.cpp:899
#15 0x000055555597b29b in Process (cx=0x7ffff6427000, filename=<optimized out>, forceTTY=<optimized out>,
kind=FileScript) at /root/AFL/compile/gecko-dev/js/src/shell/js.cpp:1459
#16 0x0000555555901328 in ProcessArgs (cx=<optimized out>, op=0x7fffffffe858)
at /root/AFL/compile/gecko-dev/js/src/shell/js.cpp:10234
#17 Shell (cx=<optimized out>, op=<optimized out>, envp=<optimized out>)
at /root/AFL/compile/gecko-dev/js/src/shell/js.cpp:10828
#18 0x00005555558f24de in main (argc=0, argv=<optimized out>, envp=<optimized out>)
at /root/AFL/compile/gecko-dev/js/src/shell/js.cpp:11479

Comment 1

[Johann Hofmann [:johannh]]

Steven, I'll leave this for you to triage