1834038 - Assertion failure: cx_->hadResourceExhaustion(), at gecko-dev/js/src/jit/WarpOracle.cpp:199

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect, P3)

Description

[2628388509]

User Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36

Steps to reproduce:

My fuzzer found an crash in SpiderMonkey and I verified it on latest gecko-dev (https://github.com/mozilla/gecko-dev) commit id: e409c755f313f6befb2c00f260bf873ccc191924

1. compile args:

ac_add_options --enable-application=js
ac_add_options --enable-optimize
ac_add_options --disable-debug
ac_add_options --disable-shared-js

2. run js with: ./js test.js

for (let v0 = 0; v0 < 100; v0++) {
    const v3 = (1024).match;
    const v4 = [];
    v4[1024] = {}
    v4.splice(v3).push(v3);
    for (let v7 = 0; v7 < 100; v7++) {}
}

Actual results:

Assertion failure: cx_->hadResourceExhaustion(), at gecko-dev/js/src/jit/WarpOracle.cpp:199

Backtrace:

* thread #1, name = 'js', stop reason = signal SIGSEGV: invalid address (fault address: 0x0)
  * frame #0: 0x0000555557c5af1a js`js::jit::WarpOracle::createSnapshot(this=0x00007fffffffbd80) at WarpOracle.cpp:198:5
    frame #1: 0x0000555557c005ed js`js::jit::CreateWarpSnapshot(cx=0x00007fffe992e100, mirGen=0x00007fffe8153178, script=JS::HandleScript @ rbx) at Ion.cpp:1586:48
    frame #2: 0x0000555557bfd43e js`js::jit::Compile(JSContext*, JS::Handle<JSScript*>, js::jit::BaselineFrame*, unsigned char*) [inlined] js::jit::IonCompile(cx=0x00007fffe992e100, script=JS::HandleScript @ 0x00007fffffffbf40, osrPc=<unavailable>) at Ion.cpp:1656:41
    frame #3: 0x0000555557bfd080 js`js::jit::Compile(cx=0x00007fffe992e100, script=JS::HandleScript @ r14, osrFrame=0x00007fffffffc0f8, osrPc="\x94") at Ion.cpp:1861
    frame #4: 0x0000555557bfe039 js`IonCompileScriptForBaseline(JSContext*, js::jit::BaselineFrame*, unsigned char*) [inlined] BaselineCanEnterAtBranch(cx=0x00007fffe992e100, osrFrame=0x00007fffffffc0f8, pc="\x94") at Ion.cpp:2062:25
    frame #5: 0x0000555557bfdf00 js`IonCompileScriptForBaseline(cx=0x00007fffe992e100, frame=0x00007fffffffc0f8, pc="\x94") at Ion.cpp:2113
    frame #6: 0x0000555557bfe6da js`js::jit::IonCompileScriptForBaselineOSR(cx=0x00007fffe992e100, frame=0x00007fffffffc0f8, frameSize=104, pc="\x94", infoPtr=0x00007fffffffc098) at Ion.cpp:2225:8
    frame #7: 0x00001d4fe0dffcab
    frame #8: 0x00001d4fe0e409c1
    frame #9: 0x00001d4fe0df0d89
    frame #10: 0x000055555787cc07 js`js::jit::EnterBaselineInterpreterAtBranch(JSContext*, js::InterpreterFrame*, unsigned char*) at BaselineJIT.cpp:143:5
    frame #11: 0x000055555787c96a js`js::jit::EnterBaselineInterpreterAtBranch(cx=0x00007fffe992e100, fp=0x0000000000000064, pc=<unavailable>) at BaselineJIT.cpp:199
    frame #12: 0x0000555556e3fc1f js`js::Interpret(cx=<unavailable>, state=0x00007fffffffca18) at Interpreter.cpp:2252:17
    frame #13: 0x0000555556e3a50d js`MaybeEnterInterpreterTrampoline(cx=<unavailable>, state=<unavailable>) at Interpreter.cpp:400:10 [artificial]
    frame #14: 0x0000555556e3a20a js`js::RunScript(cx=0x00007fffe992e100, state=0x00007fffffffca18) at Interpreter.cpp:458:13
    frame #15: 0x0000555556e3cfeb js`js::ExecuteKernel(cx=0x00007fffe992e100, script=JS::HandleScript @ scalar, envChainArg=JS::HandleObject @ r12, evalInFrame=(ptr_ = 0), result=JS::MutableHandleValue @ 0x00007fffffffca68) at Interpreter.cpp:845:13
    frame #16: 0x0000555556e3d3e0 js`js::Execute(cx=0x00007fffe992e100, script=JS::HandleScript @ 0x00007fffffffcac0, envChain=JS::HandleObject @ r14, rval=JS::MutableHandleValue @ 0x00007fffffffcab8) at Interpreter.cpp:877:10
    frame #17: 0x0000555556f7eb50 js`ExecuteScript(cx=0x00007fffe992e100, envChain=JS::HandleObject @ 0x00007fffffffcb20, script=JS::HandleScript @ 0x00007fffffffcb18, rval=JS::MutableHandleValue @ rbx) at CompilationAndEvaluation.cpp:495:10
    frame #18: 0x0000555556f7ed8c js`JS_ExecuteScript(cx=0x00007fffe992e100, scriptArg=JS::HandleScript @ rbx) at CompilationAndEvaluation.cpp:519:10
    frame #19: 0x0000555556d81819 js`RunFile(cx=0x00007fffe992e100, filename="/home/wjm/SpiderMonkey/note/crash/poc.js", file=<unavailable>, compileMethod=DontInflate, compileOnly=false, fullParse=<unavailable>) at js.cpp:1100:10
    frame #20: 0x0000555556d80fb7 js`Process(cx=0x00007fffe992e100, filename=<unavailable>, forceTTY=false, kind=FileScript) at js.cpp:0
    frame #21: 0x0000555556d433b3 js`Shell(JSContext*, js::cli::OptionParser*) at js.cpp:10624:10
    frame #22: 0x0000555556d4337e js`Shell(cx=0x00007fffe992e100, op=0x00007fffffffd228) at js.cpp:10848
    frame #23: 0x0000555556d3d890 js`main(argc=<unavailable>, argv=0x00007fffffffd498) at js.cpp:11280:12
    frame #24: 0x00007ffff7a7f1e2 libc.so.6`__libc_start_main + 242
    frame #25: 0x0000555556d338d9 js`_start + 41

Expected results:

This testcase should not crash SpiderMonkey.

Comment 1

[Nicolas B. Pierron [:nbp] {away}]

Thanks for opening this bug, based on the comment in the code This assertion is an issue where we would be recompiling with no new information.

I will ask Iain for more information once he comes back.

Comment 2

[Iain Ireland [:iain]]

It looks like this is similar to bug 1797486, except with Array.push instead of storing the element directly. I noticed at the time that Array.push seemed to have a similar problem, but I couldn't get a testcase to fail. This one seems to do so robustly.

The best fix is probably bug 1654180: if we use the same code in both baseline ICs and Ion, then this problem won't occur. I'll take a look and see which version we should go with.

Comment 3

[Iain Ireland [:iain]]

Attachment: Bug 1834038: Rewrite Ion implementation of ArrayPush to match CacheIR r=jandem

Prior to this patch, when reaching capacity, the Ion implementation of ArrayPush called ArrayPushDensePure to reallocate and store the value, but the CacheIR implementation called addDenseElementPure to reallocate, and then returned to jit code for the store. This could lead to a bailout loop, because ArrayPushDensePure is more strict about reallocating arrays with many holes than addDenseElementPure.

This patch rewrites the Ion implementation to use the same strategy as CacheIR. I considered sharing a masm implementation, but there are enough differences between the two cases to make it awkward.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/79c414a997b5
Rewrite Ion implementation of ArrayPush to match CacheIR r=jandem

Comment 6

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/79c414a997b5