1845199 - Crash [@ js::jit::MDefinition::setInstructionBlock]

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect, P2)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 20230724-7b6332c9bce4 (debug build, run with --fuzzing-safe --ion-offthread-compile=off --fast-warmup --blinterp-eager):

function loadFile(lfVarx) {
  oomTest(function() {
    eval(lfVarx);
  })
}
lfLogBuffer = `
  function callbackfn() {}
  function foo() {
    arr = [,,3,,5];
    for (var i89 = 0; i89 < 50; i89++)   
      arr = arr.map(callbackfn)
  } foo();
`;
loadFile(lfLogBuffer);

Backtrace:

received signal SIGSEGV, Segmentation fault.
#0  0x0000555557d9bf07 in js::jit::MDefinition::setInstructionBlock(js::jit::MBasicBlock*, js::jit::BytecodeSite const*) ()
#1  0x0000555557d25ecc in js::jit::MBasicBlock::add(js::jit::MInstruction*) ()
#2  0x0000555557d3992e in js::jit::WarpBuilder::build_GetActualArg(js::BytecodeLocation) ()
#3  0x0000555557d27846 in js::jit::WarpBuilder::buildBody() ()
#4  0x0000555557d45410 in js::jit::WarpBuilder::buildInlinedCall(js::BytecodeLocation, js::jit::WarpInlinedCall const*, js::jit::CallInfo&) ()
#5  0x0000555557d445ec in js::jit::WarpBuilder::buildCallOp(js::BytecodeLocation) ()
#6  0x0000555557d271f6 in js::jit::WarpBuilder::buildBody() ()
#7  0x0000555557d266ca in js::jit::WarpBuilder::build() ()
#8  0x0000555557d10841 in js::jit::CompileBackEnd(js::jit::MIRGenerator*, js::jit::WarpSnapshot*) ()
#9  0x0000555557d11c92 in js::jit::Compile(JSContext*, JS::Handle<JSScript*>, js::jit::BaselineFrame*, unsigned char*) ()
#10 0x0000555557d127bc in IonCompileScriptForBaseline(JSContext*, js::jit::BaselineFrame*, unsigned char*) ()
#11 0x0000555557d130aa in js::jit::IonCompileScriptForBaselineOSR(JSContext*, js::jit::BaselineFrame*, unsigned int, unsigned char*, js::jit::IonOsrTempData**) ()
#12 0x00002ad16d9e86cb in ?? ()
#13 0x00002e5127200000 in ?? ()
#14 0x00007fffffff9e60 in ?? ()
#15 0x0000000000000000 in ?? ()
rax	0x0	0
rbx	0x7ffff1c54090	140737249624208
rcx	0x0	0
rdx	0x7ffff1c54070	140737249624176
rsi	0x7ffff1c54090	140737249624208
rdi	0x0	0
rbp	0x7fffffff9010	140737488326672
rsp	0x7fffffff9000	140737488326656
r8	0x7ffff1c4f518	140737249604888
r9	0x7ffff1c54318	140737249624856
r10	0x1	1
r11	0x7fffffff8f98	140737488326552
r12	0x7ffff3e982bc	140737285554876
r13	0x7fffffff90d0	140737488326864
r14	0x0	0
r15	0x7ffff1c540b8	140737249624248
rip	0x555557d9bf07 <js::jit::MDefinition::setInstructionBlock(js::jit::MBasicBlock*, js::jit::BytecodeSite const*)+7>
=> 0x555557d9bf07 <_ZN2js3jit11MDefinition19setInstructionBlockEPNS0_11MBasicBlockEPKNS0_12BytecodeSiteE+7>:	movzwl 0x24(%rdi),%eax
   0x555557d9bf0b <_ZN2js3jit11MDefinition19setInstructionBlockEPNS0_11MBasicBlockEPKNS0_12BytecodeSiteE+11>:	cmp    $0xa3,%eax

Comment 1

[Christian Holler (:decoder)]

Attachment: Detailed Crash Information

Comment 2

[Christian Holler (:decoder)]

Attachment: Testcase

Comment 3

[Bugmon [:jkratzer for issues]]

Unable to reproduce bug 1845199 using build mozilla-central 20230724091621-7b6332c9bce4. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 4

[Nicolas B. Pierron [:nbp] {away}]

Iain, can you investigate this issue?

Comment 5

[Iain Ireland [:iain]]

Attachment: Bug 1845199: Check return value when allocating variadic instructions r=nbp!

Variadic instructions require us to check for OOM. The fuzzbug is caused by MGetInlinedArgument. I did an audit of variadic instructions and also found a missing check involving MInlineArgumentsSlice.

Not adding the testcase because it is slow and fragile.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/50f9d15abe0d
Check return value when allocating variadic instructions r=nbp

Comment 7

[Atila Butkovits]

https://hg.mozilla.org/mozilla-central/rev/50f9d15abe0d