667824 - TM: Crash [@ js::TraceRecorder::record_NativeCallComplete] or "Assertion failure: pendingSpecializedNative,"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

var x;
for (let a = 0; a < 8; a++) {
    Function.prototype()
}

asserts js debug shell on TM changeset 208160c856b7 with -j at Assertion failure: pendingSpecializedNative, and crashes js opt shell with -j at js::TraceRecorder::record_NativeCallComplete

Examining the registers, seems to be a null deref but locking s-s just-to-be-safe.

(gdb) x/i $pc
0x1001b927e <_ZN2js13TraceRecorder25record_NativeCallCompleteEv+78>:    mov    0x18(%rcx),%edx
(gdb) x/b $rcx
0x0:    Cannot access memory at address 0x0(gdb) x/b $edx
Value can't be converted to integer.

autoBisect is running as I type.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   71128:ce10e78d030d
user:        Luke Wagner
date:        Tue Jun 14 16:36:13 2011 -0700
summary:     Bug 664252 - Turn lemons (LLVM-only build bustage) into lemonade (rewrite JSOP_CALL/EVAL/NEW to have less goto madness) (r=waldo)

Comment 2

[Luke Wagner [:luke]]

Null-deref, so not ss.

Comment 3

[Luke Wagner [:luke]]

Attachment: fix with test

Simple fix.  Thanks for the simple test-case Gary.

Comment 4

[Christian Holler (:decoder)]

I reported this before in 666701. Is this the same issue?

Comment 6

[Luke Wagner [:luke]]

Oops, yes, I missed that.

Comment 7

[Luke Wagner [:luke]]

http://hg.mozilla.org/tracemonkey/rev/c1afc79e7676

Comment 8

[Chris Leary [:cdleary] (not checking bugmail)]

cdleary-bot mozilla-central merge info:
http://hg.mozilla.org/mozilla-central/rev/c1afc79e7676

Comment 9

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This bug is nominated tracking-firefox7 because it fixes a crash that made it to mozilla-central. [@ js::TraceRecorder::record_NativeCallComplete]

Comment 10

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to comment #9)
> This bug is nominated tracking-firefox7 because it fixes a crash that made
> it to mozilla-central. [@ js::TraceRecorder::record_NativeCallComplete]

Brendan mentions this particular bug should be taken:

http://groups.google.com/group/mozilla.dev.tech.js-engine.internals/browse_thread/thread/626c85124555c0c9

From fuzzers' perspective, it fixes a bug that fuzzers find *really* easily.

Luke will have to nominate the attachment with a risk analysis.

Comment 11

[Luke Wagner [:luke]]

Low-risk, should definitely take.

Comment 12

[Luke Wagner [:luke]]

(But I should also point out that its unexploitable and fuzzers will probably be the only thing that finds this)

Comment 13

[Luke Wagner [:luke]]

nm, it has been merged to aurora.

Comment 14

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929