606662 - Crash [@ js::mjit::JITScript::release] or "Assertion failure: unsigned(sp - entries) < nargs + script->nslots,"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

new(function() {
    #1#
})

asserts js debug shell on TM changeset ee1746020149 with -m at Assertion failure: unsigned(sp - entries) < nargs + script->nslots,

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Due to skipped revisions, the first bad revision could be any of:

changeset:   55675:e000b5963fde
user:        David Anderson
date:        Fri Oct 15 11:36:56 2010 -0700
summary:     Remove JSOP_BEGIN and fix tracer integration issues (bug 603044, r=luke+dmandelin).

changeset:   55676:ae031ec5ad63
user:        David Anderson
date:        Mon Oct 18 20:30:36 2010 -0700
summary:     Build bustage fix.

So likely to be bug 603044.

Comment 2

[Brendan Eich [:brendan]]

A bogus assertion. Fixable per script->hasSharps() usage in js::Execute.

/be

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: opt crash testcase

I could make another testcase (that asserts similarly in a debug shell) crash in an opt shell, but it has to lie in a subdirectory for some reason.

===

(gdb) r
Starting program: /Users/fuzz1/Desktop/jsfunfuzz-dbg-32-tm-56418-1c573c884629/js-opt-32-tm-darwin -m test/w36966-cj.js
Reading symbols for shared libraries .+++...................................................................................... done

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_PROTECTION_FAILURE at address: 0x00000001
0x001eec6e in js::mjit::JITScript::release ()
(gdb) bt
#0  0x001eec6e in js::mjit::JITScript::release ()
#1  0x001eefd7 in js::mjit::ReleaseScriptCode ()
(gdb) x/i $eip
0x1eec6e <_ZN2js4mjit9JITScript7releaseEv+14>:  mov    (%edi),%eax
(gdb) x/b $edi
0x1:    Cannot access memory at address 0x1
(gdb) x/b $eax
0x413580:       0x02
(gdb)

Comment 4

[David Mandelin [:dmandelin]]

Attachment: Patch

Comment 5

[David Mandelin [:dmandelin]]

http://hg.mozilla.org/tracemonkey/rev/258744efa972

Comment 6

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/258744efa972

Comment 7

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug606662-2.js.