Last Comment Bug 727341 - JS OOM Testing: Assertion failure: function() && types && types->hasScope(), at ../jsscriptinlines.h:224 or Crash [@ JSScript::nesting]
: JS OOM Testing: Assertion failure: function() && types && types->hasScope(), ...
: assertion, crash, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86_64 Linux
-- critical (vote)
: mozilla14
Assigned To: Brian Hackett (:bhackett)
: Jason Orendorff [:jorendorff]
: 735013 (view as bug list)
Depends on:
  Show dependency treegraph
Reported: 2012-02-14 18:48 PST by Christian Holler (:decoder)
Modified: 2012-04-11 09:15 PDT (History)
5 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

patch (4.29 KB, patch)
2012-04-10 08:05 PDT, Brian Hackett (:bhackett)
luke: review+
Details | Diff | Splinter Review

Description User image Christian Holler (:decoder) 2012-02-14 18:48:15 PST
The following command crashes/aborts on mozilla-central revision d45c7d7b0079:

js -m -n -a -A 1325 -f js/src/tests/shell.js -f js/src/tests/ecma_5/shell.js -f js/src/tests/ecma_5/strict/shell.js -f js/src/tests/ecma_5/strict/10.4.2.js

Stepping through assertion crashes:

Program received signal SIGSEGV, Segmentation fault.
0x00000000004ac050 in JSScript::nesting (this=0x7ffff651cb78) at ../jsscriptinlines.h:225
225         return types->nesting;
(gdb) bt
#0  0x00000000004ac050 in JSScript::nesting (this=0x7ffff651cb78) at ../jsscriptinlines.h:225
#1  0x000000000050b160 in js::StackFrame::functionPrologue (this=0x7ffff676e0d8, cx=0xb5fae0) at /home/decoder/LangFuzz/mozilla-central/js/src/vm/Stack-inl.h:380
#2  0x00000000004f1791 in js::InvokeKernel (cx=0xb5fae0, args=..., construct=js::NO_CONSTRUCT) at /home/decoder/LangFuzz/mozilla-central/js/src/jsinterp.cpp:510
#3  0x000000000045e49d in js::Invoke (cx=0xb5fae0, args=..., construct=js::NO_CONSTRUCT) at /home/decoder/LangFuzz/mozilla-central/js/src/jsinterp.h:157
#4  0x00000000004a6dd2 in js_fun_call (cx=0xb5fae0, argc=1, vp=0x7ffff676e0a0) at /home/decoder/LangFuzz/mozilla-central/js/src/jsfun.cpp:1641
#5  0x0000000000509afb in js::CallJSNative (cx=0xb5fae0, native=0x4a6c3a <js_fun_call(JSContext*, uintN, JS::Value*)>, args=...) at ../jscntxtinlines.h:311
#6  0x00000000004f16f4 in js::InvokeKernel (cx=0xb5fae0, args=..., construct=js::NO_CONSTRUCT) at /home/decoder/LangFuzz/mozilla-central/js/src/jsinterp.cpp:499
#7  0x00000000004fd514 in js::Interpret (cx=0xb5fae0, entryFrame=0x7ffff676e030, interpMode=js::JSINTERP_NORMAL) at /home/decoder/LangFuzz/mozilla-central/js/src/jsinterp.cpp:2702
#8  0x000000000068645f in js::mjit::EnterMethodJIT (cx=0xb5fae0, fp=0x7ffff676e030, code=0x7ffff7fc9ab0, stackLimit=0x7ffff6b4e000, partial=false)
    at /home/decoder/LangFuzz/mozilla-central/js/src/methodjit/MethodJIT.cpp:1079

225         return types->nesting;
(gdb) p types
$1 = (js::types::TypeScript *) 0x0

Safe null-pointer crash, no security impact.
Comment 1 User image Brian Hackett (:bhackett) 2012-04-10 08:05:08 PDT
Created attachment 613608 [details] [diff] [review]

TypeMonitorCall is used to ensure the callee script has had a TypeScript allocated, whether TI is enabled or not.  If this allocation fails then the caller needs to throw.
Comment 2 User image Brian Hackett (:bhackett) 2012-04-10 08:36:52 PDT
*** Bug 735013 has been marked as a duplicate of this bug. ***
Comment 3 User image Brian Hackett (:bhackett) 2012-04-10 12:25:07 PDT
Comment 4 User image Matt Brubeck (:mbrubeck) 2012-04-11 09:15:36 PDT

Note You need to log in before you can comment on or make changes to this bug.