630048 - Crash in Method JIT generated code

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

Attachment: Shell testcase, unpack and run with "js -m -f main.js"

The attached testcase will crash TM tip (tested on 64 bit). It consists of multiple files (I minimized this but wasn't able to fully combine all files), run like this after unpacking:

$ ./js -m -f main.js
Evaluation complete
TypeError: SECTION is undefined
TypeError: SECTION is undefined
Segmentation fault

Debugging information:

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7f979fd in ?? ()
(gdb) bt
#0  0x00007ffff7f979fd in ?? ()
#1  0x00007ffff7f98000 in ?? ()
#2  0x0000000000000027 in ?? ()
#3  0xfffafffff69130e0 in ?? ()
[...]
#18 0x000000000064d3ba in js::mjit::EnterMethodJIT (cx=0x7ffff7f979d9, fp=0x7fffffffc750, code=0x7ffff69121a0, stackLimit=0x7ffff690be80) at ./methodjit/MethodJIT.cpp:748
Backtrace stopped: frame did not save the PC


(gdb) x/8i $pc 
=> 0x7ffff7f979fd:      mov    0x14(%r9),%edi
   0x7ffff7f97a01:      cmp    $0x8fffffff,%edi
   0x7ffff7f97a07:      jne    0x7ffff7f97b49
   0x7ffff7f97a0d:      mov    0x40(%r9),%r9
   0x7ffff7f97a11:      mov    0x1000000(%r9),%rdi
   0x7ffff7f97a18:      mov    %r14,%r9
   0x7ffff7f97a1b:      and    %rdi,%r9
   0x7ffff7f97a1e:      xor    %r9,%rdi


At first glance, this could be an illegal write to a NULL pointer class/struct field, but I cannot tell for sure, so locking this.

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix

Nice catch. An opcode was missing in the bytecode analyzer. This only has an effect when the trace JIT is off (which is when we use the analyzer's use-def results).

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

http://hg.mozilla.org/tracemonkey/rev/62ba32799f6f

Comment 3

[Chris Leary [:cdleary] (not checking bugmail)]

cdleary-bot mozilla-central merge info:
http://hg.mozilla.org/mozilla-central/rev/62ba32799f6f