654001 - TI: Crash [@ js::StackFrame::isScriptFrame]

Status: RESOLVED DUPLICATE of bug 653980

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following code crashes on TI revision 02c4a0f752f3 (run with -m -n -a), tested on 64 bit:

function tryItOut(code) {
  wtt = 
  f = Function(code)
  if (wtt && f) rv=tryRunning(f, code);
}function tryRunning(f, code)
{
  try { 
    f()
  } catch(runError) {}
}
for (let iters = 0; ; ) { 
   tryItOut( '');
   tryItOut();
   tryItOut("M:with((p={}, (p.z = <x/> ===  '' )()))/*TUUL*/for each (let y in [true, {}, {}, (void 0), true, true, true, (void 0), true, (void 0)]) { return; }");
   gc(); 
   tryItOut();
}


Valgrind output:

==20895== Invalid read of size 1
==20895==    at 0x6A78D8: js::mjit::Compiler::generateMethod() (Compiler.cpp:2275)
==20895==    by 0x69D0FA: js::mjit::Compiler::performCompilation(js::mjit::JITScript**) (Compiler.cpp:331)
==20895==    by 0x69C7B1: js::mjit::Compiler::compile() (Compiler.cpp:166)
==20895==    by 0x69DEFA: js::mjit::TryCompile(JSContext*, js::StackFrame*) (Compiler.cpp:487)
==20895==    by 0x4F601B: js::mjit::CanMethodJIT(JSContext*, JSScript*, js::StackFrame*, js::mjit::CompileRequest) (MethodJIT-inl.h:75)
==20895==    by 0x4F7567: js::RunScript(JSContext*, JSScript*, js::StackFrame*) (jsinterp.cpp:600)
==20895==    by 0x4F8BA3: js::Execute(JSContext*, JSObject&, JSScript*, js::StackFrame*, unsigned int, js::Value*) (jsinterp.cpp:997)
==20895==    by 0x434739: JS_ExecuteScript (jsapi.cpp:5138)
==20895==    by 0x405A2C: Process(JSContext*, JSObject*, char*, int, int) (js.cpp:453)
==20895==    by 0x406ACF: ProcessArgs(JSContext*, JSObject*, char**, int) (js.cpp:983)
==20895==    by 0x411BCC: Shell(JSContext*, int, char**, char**) (js.cpp:5890)
==20895==    by 0x411EB2: main (js.cpp:6019)
==20895==  Address 0x5ef0fe0 is 0 bytes after a block of size 32 alloc'd
==20895==    at 0x4C267CC: calloc (vg_replace_malloc.c:467)
==20895==    by 0x41A4FE: js_calloc (jsutil.h:244)
==20895==    by 0x43A09C: JSRuntime::calloc_(unsigned long, JSContext*) (jscntxt.h:734)
==20895==    by 0x43A547: JSContext::calloc_(unsigned long) (jscntxt.h:1297)
==20895==    by 0x69DCD4: js::mjit::Compiler::prepareInferenceTypes(JSScript*, js::mjit::Compiler::ActiveFrame*) (Compiler.cpp:448)
==20895==    by 0x69CD35: js::mjit::Compiler::pushActiveFrame(JSScript*, unsigned int) (Compiler.cpp:267)
==20895==    by 0x69CFD4: js::mjit::Compiler::performCompilation(js::mjit::JITScript**) (Compiler.cpp:329)
==20895==    by 0x69C7B1: js::mjit::Compiler::compile() (Compiler.cpp:166)
==20895==    by 0x69DEFA: js::mjit::TryCompile(JSContext*, js::StackFrame*) (Compiler.cpp:487)
==20895==    by 0x4F601B: js::mjit::CanMethodJIT(JSContext*, JSScript*, js::StackFrame*, js::mjit::CompileRequest) (MethodJIT-inl.h:75)
==20895==    by 0x4F7567: js::RunScript(JSContext*, JSScript*, js::StackFrame*) (jsinterp.cpp:600)
==20895==    by 0x4F8BA3: js::Execute(JSContext*, JSObject&, JSScript*, js::StackFrame*, unsigned int, js::Value*) (jsinterp.cpp:997)
==20895==
==20895== Invalid read of size 4
==20895==    at 0x4141C2: js::StackFrame::isScriptFrame() const (Stack.h:353)
==20895==    by 0x4142ED: js::StackFrame::script() const (Stack.h:472)
==20895==    by 0x73AF3F: js::mjit::Recompiler::recompile() (Retcon.cpp:517)
==20895==    by 0x4E319B: js::types::TypeCompartment::processPendingRecompiles(JSContext*) (jsinfer.cpp:2017)
==20895==    by 0x415080: js::types::AutoEnterTypeInference::~AutoEnterTypeInference() (jsinferinlines.h:174)
==20895==    by 0x4EC63B: JSScript::typeSetThis(JSContext*, unsigned long) (jsinferinlines.h:694)
==20895==    by 0x4E285E: js::types::TypeCompartment::dynamicCall(JSContext*, JSObject*, js::CallArgs const&, bool) (jsinfer.cpp:1821)
==20895==    by 0x4FC0DC: JSContext::typeMonitorCall(js::CallArgs const&, bool) (jsinferinlines.h:504)
==20895==    by 0x736231: UncachedInlineCall(js::VMFrame&, unsigned int, void**, bool*, unsigned int, js::types::ClonedTypeSet*) (InvokeHelpers.cpp:382)
==20895==    by 0x73689C: js::mjit::stubs::UncachedCallHelper(js::VMFrame&, unsigned int, js::types::ClonedTypeSet*, js::mjit::stubs::UncachedCallResult*) (InvokeHelpers.cpp:509)
==20895==    by 0x71BC59: CallCompiler::update() (MonoIC.cpp:1019)
==20895==    by 0x7157E6: js::mjit::ic::Call(js::VMFrame&, js::mjit::ic::CallICInfo*) (MonoIC.cpp:1079)
==20895==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
==20895==
==20895==
==20895== Process terminating with default action of signal 11 (SIGSEGV)

Comment 2

[Christian Holler (:decoder)]

A testcase for this bug was already added in the original bug (bug 653980).