226782 - Crash in debug JS shell with certain stack sizes set

Status: RESOLVED INVALID

(Core :: JavaScript Engine, defect)

Description

[Phil Schwartau]

Using debug JS shell on WinNT4.0, built from CVS tip.

The testcase js1_5/Regress/regress-226507.js (bug 226507) crashes
if I pass certain values via -S to set the JS shell's stack size.

If I allow the JS shell a stacksize of 10^6, the test passes.
If I allow the JS shell a stacksize of 10^7, the test crashes.


----- VIA THE TEST DRIVER (using the -o option to pass the -S option) -----

PASSES
perl jsDriver.pl -e smdebug -fTEST.html -o "-S 1000000"
                 -k -l js1_5/Regress/regress-226507.js

CRASHES
perl jsDriver.pl -e smdebug -fTEST.html -o "-S 10000000"
                 -k -l js1_5/Regress/regress-226507.js



-------------------- RUNNING THE TEST MANUALLY: -------------------------

PASSES
js.exe -S 1000000 -f js1_5/shell.js -f js1_5/Regress/regress-226507.js
BUGNUMBER: 226507
STATUS: Testing for recursion check in js_EmitTree


CRASHES:
js.exe -S 10000000 -f js1_5/shell.js -f js1_5/Regress/regress-226507.js
Assertion failure: limitAddr < (jsuword)&dummy2, at jsapi.c:1772



STACK TRACE:

NTDLL! 77f7645c()
CheckStackGrowthDirection(int * 0x0012ee90, unsigned long 2148728632) line 1772
+ 39 bytes
JS_SetThreadStackLimit(JSContext * 0x00301c60, unsigned long 2148728632) line
1783 + 13 bytes
Process(JSContext * 0x00301c60, JSObject * 0x002fb348, char * 0x00301f28) line
331 + 14 bytes
ProcessArgs(JSContext * 0x00301c60, JSObject * 0x002fb348, char * * 0x00301ec4,
int 6) line 544 + 23 bytes
main(int 6, char * * 0x00301ec4, char * * 0x00300e70) line 2318 + 21 bytes
JS! mainCRTStartup + 227 bytes
KERNEL32! 77f1bbb5()


CRASHPOINT:

#ifdef DEBUG
static void
CheckStackGrowthDirection(int *dummy1addr, jsuword limitAddr)
{
    int dummy2;

#if JS_STACK_GROWTH_DIRECTION > 0
    JS_ASSERT(dummy1addr < &dummy2);
    JS_ASSERT((jsuword)&dummy2 < limitAddr);
#else
    /* Stack grows downward, the common case on modern architectures. */
    JS_ASSERT(&dummy2 < dummy1addr);
    JS_ASSERT(limitAddr < (jsuword)&dummy2); <<<----------------CRASHED HERE
#endif
}
#endif


SOME VALUES AT CRASHPOINT:

dummy1addr  0x0012ee90
dummy2	    2013506696
&dummy2	    0x0012ee7c
limitAddr   4286212280

Comment 1

[Phil Schwartau]

No crash found so far with the optimized JS shell on WinNT, but 
similar weirdness. Note I get "too much recursion" errors after
INCREASING the stacksize. Why?


PASSES
js.exe -S 150000  -f js1_5/shell.js -f js1_5/Regress/regress-226507.js
BUGNUMBER: 226507
STATUS: Testing for recursion check in js_EmitTree


TOO MUCH RECURSION:
js.exe -S 1500000 -f js1_5/shell.js -f js1_5/Regress/regress-226507.js
js1_5/shell.js:1: InternalError: too much recursion:
js1_5/shell.js:1:
js1_5/shell.js:1: ^
js1_5/Regress/regress-226507.js:1: InternalError: too much recursion:
js1_5/Regress/regress-226507.js:1:
js1_5/Regress/regress-226507.js:1: ^

Comment 2

[Brendan Eich [:brendan]]

Find a windows guru.

/be

Comment 3

[David Bradley]

I believe the address space reserved for the Windows stack is 1meg by default.
I'm not sure how that fact would play in this, but I thought it might spark an
idea from someone else.

Comment 4

[Bob Clary [:bc] (inactive)]

-> default qa

Comment 5

[Bob Clary [:bc] (inactive)]

on winxp with software dep enabled.

passes with -S 1M + 255K
fails  with -S 1M + 256K

$ ./js -S 1310720 -f js1_5/shell.js -f js1_5/Regress/regress-226507.js
too much recursion
js1_5/shell.js:1: unknown (can't convert to string):
js1_5/shell.js:1: 
js1_5/shell.js:1: ^
too much recursion
js1_5/Regress/regress-226507.js:1: unknown (can't convert to string):
js1_5/Regress/regress-226507.js:1: 
js1_5/Regress/regress-226507.js:1: ^

using editbin to change the stack reserve to 2M shows the same pattern.

I say invalid.