Crash [@ js_GetUpvar]

RESOLVED FIXED in mozilla1.9.3a5

Status

()

P1
critical
RESOLVED FIXED
9 years ago
6 years ago

People

(Reporter: jruderman, Assigned: brendan)

Tracking

({crash, regression, testcase})

Trunk
mozilla1.9.3a5
crash, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(status1.9.2 wanted)

Details

(Whiteboard: [ccbr][sg:dos] fixed-in-tracemonkey, crash signature)

Attachments

(1 attachment)

(Reporter)

Description

9 years ago
Removing the line "a = 3;" from bug560234b.js leads to a crash [@ js_GetUpvar].  This bug exists even in an older version, before the fix for bug 560234.

Here's a slightly simpler testcase:

function f(a) {
   function g() {
       yield function () a;
   }
   return g();
}
var x;
f(7).next()();
(Reporter)

Comment 1

9 years ago
Simpler:

function f(a) {
   function g() {
       yield function () a;
   }
   return g();
}
f(7).next()();
(Assignee)

Comment 2

9 years ago
Does this go back to the upvar2 bug, or a more recent regressing change?

/be
Assignee: general → brendan
Status: NEW → ASSIGNED
OS: Mac OS X → All
Priority: -- → P1
Hardware: x86 → All
Target Milestone: --- → mozilla1.9.3a5
(Assignee)

Comment 3

9 years ago
Created attachment 442853 [details] [diff] [review]
fix
Attachment #442853 - Flags: review?(jorendorff)
Comment on attachment 442853 [details] [diff] [review]
fix

Looks like a strict improvement, but as mentioned on IRC, I'm not sure ->isFunArg() means what we're using it to mean. As Waldo suggests, we'd probably be better off adding another method with the right name and semantics.
Attachment #442853 - Flags: review?(jorendorff) → review+
(Assignee)

Comment 5

9 years ago
http://hg.mozilla.org/tracemonkey/rev/910e40e2f0ef

/be
Whiteboard: fixed-in-tracemonkey
(In reply to comment #2)
> Does this go back to the upvar2 bug, or a more recent regressing change?
> 
> /be

autoBisect shows this is probably related to bug 492914:

The first bad revision is:
changeset:   28181:010768e6119c
user:        Brendan Eich
date:        Wed May 13 23:01:08 2009 -0700
summary:     Bug 492914 - TM: trace aborts due to flat closure analysis bug (r=mrbkap).

Stack:

Exception Type:  EXC_BAD_ACCESS (SIGBUS)
Exception Codes: KERN_PROTECTION_FAILURE at 0x0000000000000018
Crashed Thread:  0  Dispatch queue: com.apple.main-thread

Thread 0 Crashed:  Dispatch queue: com.apple.main-thread
0   js-opt-32-tm-darwin           	0x000631db js_GetUpvar + 27
1   js-opt-32-tm-darwin           	0x0004ead0 js_NewFlatClosure + 544
2   js-opt-32-tm-darwin           	0x0005a169 js_Interpret + 22073
3   js-opt-32-tm-darwin           	0x00066f9f SendToGenerator(JSContext*, JSGeneratorOp, JSObject*, JSGenerator*, long) + 159
4   js-opt-32-tm-darwin           	0x000673fa generator_op(JSContext*, JSGeneratorOp, long*, unsigned int) + 218
5   js-opt-32-tm-darwin           	0x0005daec js_Interpret + 36796
6   js-opt-32-tm-darwin           	0x00064383 js_Execute + 531
7   js-opt-32-tm-darwin           	0x0000f1cc JS_ExecuteScript + 60
8   js-opt-32-tm-darwin           	0x00004c3f Process(JSContext*, JSObject*, char*, int) + 1647
9   js-opt-32-tm-darwin           	0x00008c7a main + 1626
10  js-opt-32-tm-darwin           	0x0000276d _start + 208
11  js-opt-32-tm-darwin           	0x0000269c start + 40

gdb info:

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_PROTECTION_FAILURE at address: 0x00000018
0x000631db in js_GetUpvar ()
(gdb) bt
#0  0x000631db in js_GetUpvar ()
#1  0x0004ead0 in js_NewFlatClosure ()
#2  0x0005a169 in js_Interpret ()
#3  0x00066f9f in SendToGenerator ()
#4  0x000673fa in generator_op ()
#5  0x0005daec in js_Interpret ()
#6  0x00064383 in js_Execute ()
#7  0x0000f1cc in JS_ExecuteScript ()
#8  0x00004c3f in Process ()
#9  0x00008c7a in main ()
(gdb) x/i $eip
0x631db <js_GetUpvar+27>:       mov    0x18(%edx),%eax
(gdb) x/1b $edx
0x0:    Cannot access memory at address 0x0

Looks like a null +18 dereference.
Blocks: 492914
Severity: normal → critical
blocking1.9.2: --- → ?
Keywords: regression
Whiteboard: fixed-in-tracemonkey → [ccbr][sg:dos] fixed-in-tracemonkey
blocking1.9.2: ? → needed
status1.9.2: --- → wanted

Comment 7

9 years ago
http://hg.mozilla.org/mozilla-central/rev/910e40e2f0ef
Status: ASSIGNED → RESOLVED
Last Resolved: 9 years ago
Resolution: --- → FIXED
(Reporter)

Updated

9 years ago
Blocks: 564338
Can't remember why we marked it "needed" -- doesn't appear to be a topcrash or a security problem. Lowering to "wanted", if you want to patch the branch please request approval.
blocking1.9.2: needed → ---
Crash Signature: [@ js_GetUpvar]
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.