WRITE null pointer error
Categories
(Core :: JavaScript Engine: JIT, defect)
Tracking
()
People
(Reporter: vulbugs, Unassigned)
Details
User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 Edg/96.0.1054.62
Steps to reproduce:
js --no-threads --cpu-count=1 --ion-offthread-compile=off --ion-offthread-compile=off --fast-warmup bug.js
=====================bug.js=====================
function v0() {
function v3(v4,v5) {
function v6(v7,v8) {
function v9(v10,v11) {
try {
const v16 = BigInt"asUintN";
const v17 = Int16Array;
} catch(v18) {
}
}
const v19 = v9();
}
const v20 = v6();
}
const v21 = v3();
for (let v25 = 2561753871; v25 >= 2; v25 = v25 || 0) {
v25 /= 2;
}
}
for(i = 0;i < 100; i++){
v0();
}
============================================
==2141351==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x559b10fccc3f bp 0x7ffdb8ab2f80 sp 0x7ffdb8ab2ee0 T2141351)
==2141351==The signal is caused by a WRITE memory access.
==2141351==Hint: address points to the zero page.
#0 0x559b10fccc3f in js::jit::WarpOracle::createSnapshot() /home/SpiderMonkey/js/src/jit/WarpOracle.cpp:189:5
#1 0x559b1139a361 in js::jit::CreateWarpSnapshot(JSContext*, js::jit::MIRGenerator*, JS::Handle<JSScript*>) /home/SpiderMonkey/js/src/jit/Ion.cpp:1606:48
#2 0x559b11368032 in js::jit::IonCompile(JSContext*, JS::Handle<JSScript*>, unsigned char*) /home/SpiderMonkey/js/src/jit/Ion.cpp:1683:41
#3 0x559b11368032 in js::jit::Compile(JSContext*, JS::Handle<JSScript*>, js::jit::BaselineFrame*, unsigned char*) /home/SpiderMonkey/js/src/jit/Ion.cpp:1905:24
#4 0x559b1136931b in BaselineCanEnterAtEntry(JSContext*, JS::Handle<JSScript*>, js::jit::BaselineFrame*) /home/SpiderMonkey/js/src/jit/Ion.cpp:2037:25
#5 0x559b1136931b in IonCompileScriptForBaseline(JSContext*, js::jit::BaselineFrame*, unsigned char*) /home/SpiderMonkey/js/src/jit/Ion.cpp:2161:12
#6 0x192c03099444 (<unknown module>)
Actual results:
crash
Expected results:
no crash
function v0() {
function v3(v4,v5) {
function v6(v7,v8) {
function v9(v10,v11) {
try {
const v16 = BigInt["asUintN"](633084459,-1108343544n);
const v17 = Int16Array;
} catch(v18) {
}
}
const v19 = v9();
}
const v20 = v6();
}
const v21 = v3();
for (let v25 = 2561753871; v25 >= 2; v25 = v25 || 0) {
v25 /= 2;
}
}
for(i = 0;i < 100; i++){
v0();
}
(In reply to vulbugs from comment #0)
User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 Edg/96.0.1054.62
Steps to reproduce:
js --no-threads --cpu-count=1 --ion-offthread-compile=off --ion-offthread-compile=off --fast-warmup bug.js
=====================bug.js=====================
function v0() {
function v3(v4,v5) {
function v6(v7,v8) {
function v9(v10,v11) {
try {
const v16 = BigInt"asUintN";
const v17 = Int16Array;
} catch(v18) {
}
}
const v19 = v9();
}
const v20 = v6();
}
const v21 = v3();
for (let v25 = 2561753871; v25 >= 2; v25 = v25 || 0) {
v25 /= 2;
}
}for(i = 0;i < 100; i++){
v0();
}============================================
==2141351==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x559b10fccc3f bp 0x7ffdb8ab2f80 sp 0x7ffdb8ab2ee0 T2141351)
==2141351==The signal is caused by a WRITE memory access.
==2141351==Hint: address points to the zero page.
#0 0x559b10fccc3f in js::jit::WarpOracle::createSnapshot() /home/SpiderMonkey/js/src/jit/WarpOracle.cpp:189:5
#1 0x559b1139a361 in js::jit::CreateWarpSnapshot(JSContext*, js::jit::MIRGenerator*, JS::Handle<JSScript*>) /home/SpiderMonkey/js/src/jit/Ion.cpp:1606:48
#2 0x559b11368032 in js::jit::IonCompile(JSContext*, JS::Handle<JSScript*>, unsigned char*) /home/SpiderMonkey/js/src/jit/Ion.cpp:1683:41
#3 0x559b11368032 in js::jit::Compile(JSContext*, JS::Handle<JSScript*>, js::jit::BaselineFrame*, unsigned char*) /home/SpiderMonkey/js/src/jit/Ion.cpp:1905:24
#4 0x559b1136931b in BaselineCanEnterAtEntry(JSContext*, JS::Handle<JSScript*>, js::jit::BaselineFrame*) /home/SpiderMonkey/js/src/jit/Ion.cpp:2037:25
#5 0x559b1136931b in IonCompileScriptForBaseline(JSContext*, js::jit::BaselineFrame*, unsigned char*) /home/SpiderMonkey/js/src/jit/Ion.cpp:2161:12
#6 0x192c03099444 (<unknown module>)Actual results:
crash
Expected results:
no crash
|
||
Comment 3•4 years ago
|
||
I get:
$ obj-shell-dbgopt/dist/bin/js --no-threads --cpu-count=1 --ion-offthread-compile=off --ion-offthread-compile=off --fast-warmup test.js
Assertion failure: cx_->hadNondeterministicException(), at js/src/jit/WarpOracle.cpp:189
Likely harmless but a potential performance issue.
|
||
Comment 4•4 years ago
|
||
Thanks for the report!
This is a duplicate of bug 1745907: a BigIntAsUintN that always throws is removed by the optimizer because we don't see any uses, so we hit the first-execution bailout afterwards and loop.
Description
•