746768 - Crash [@ js::gc::Chunk::allocateArena]

Status: RESOLVED DUPLICATE of bug 754242

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

Attachment: shell testcase, unpack, chdir and read README

The attached test crashes on mozilla-central revision df9ea73ec1f4. This test requires a 64 bit opt-build (--disable-debug --enable-optimize --enable-valgrind). Running instructions are in the README file in the archive. The test is very large and fragile, if you cannot reproduce, let me know.

Backtrace in GDB:

Program received signal SIGSEGV, Segmentation fault.
js::gc::Chunk::allocateArena (this=0x7ffff0a00420, comp=<value optimized out>, thingKind=js::gc::FINALIZE_TYPE_OBJECT) at /home/ownhero/homes/mozilla/repos/mozilla-central/js/src/jsgc.cpp:756
756                                : fetchNextDecommittedArena();
(gdb) bt 8
#0  js::gc::Chunk::allocateArena (this=0x7ffff0a00420, comp=<value optimized out>, thingKind=js::gc::FINALIZE_TYPE_OBJECT) at /home/ownhero/homes/mozilla/repos/mozilla-central/js/src/jsgc.cpp:756
#1  0x000000000046cb94 in allocateFromArena (cx=0x97d850, thingKind=js::gc::FINALIZE_TYPE_OBJECT) at /home/ownhero/homes/mozilla/repos/mozilla-central/js/src/jsgc.cpp:1474
#2  js::gc::ArenaLists::refillFreeList (cx=0x97d850, thingKind=js::gc::FINALIZE_TYPE_OBJECT) at /home/ownhero/homes/mozilla/repos/mozilla-central/js/src/jsgc.cpp:1693
#3  0x0000000000488ffd in NewGCThing<js::types::TypeObject> (this=<value optimized out>, cx=0x97d850, script=<value optimized out>, key=JSProto_Object, proto=0x7ffff0905060, unknown=true) at ../jsgcinlines.h:455
#4  js::types::TypeCompartment::newTypeObject (this=<value optimized out>, cx=0x97d850, script=<value optimized out>, key=JSProto_Object, proto=0x7ffff0905060, unknown=true)
    at /home/ownhero/homes/mozilla/repos/mozilla-central/js/src/jsinfer.cpp:1917
#5  0x000000000048c95e in JSObject::getNewType (this=0x7ffff0905060, cx=0x97d850, fun=0x0) at /home/ownhero/homes/mozilla/repos/mozilla-central/js/src/jsinfer.cpp:5654
#6  0x000000000043404b in NewArray<true> (cx=0x97d850, length=0, proto=<value optimized out>) at /home/ownhero/homes/mozilla/repos/mozilla-central/js/src/jsarray.cpp:3834
#7  js::NewDenseAllocatedArray (cx=0x97d850, length=0, proto=<value optimized out>) at /home/ownhero/homes/mozilla/repos/mozilla-central/js/src/jsarray.cpp:3871
(More stack frames follow...)
(gdb) x /i $pc
=> 0x464779 <js::gc::Chunk::allocateArena(JSCompartment*, js::gc::AllocKind)+41>:       mov    0xffff8(%rdi),%r8d
(gdb) info reg rdi
rdi            0x7ffff0a00420   140737230406688


I will also attach a Valgrind log, it contains lots of errors and shows the crash differently. S-s due to gc-related memory corruption, also assuming sg:critical based on that.

Luke also had a brief look on this issue and might be able to provide more information.

Comment 1

[Christian Holler (:decoder)]

Attachment: Valgrind log

Comment 2

[Luke Wagner [:luke]]

What I noticed is that, at the crash, rt->gcChunkSet was all zeroed out.

However the valgrind log shows weird touching-after-GC happening well before that.

Comment 3

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Attachment: poisoning patch

I'm attaching a patch that makes this test crash at the first valgrind warning. I also found that I can compile with --disable-debug --disable-optimize --enable-gczeal --enable-valgrind --enable-debug-symbols and it crashes, and I get debug info.

Christian, is there any chance you could reduce this test case further using the attached patch?

Comment 4

[Daniel Veditz [:dveditz]]

Assigning to Christian to answer comment 2

Comment 5

[Christian Holler (:decoder)]

I talked to billm on IRC and he has access to the reduced test, but the reducing didn't help much so far. 

@billm: If there's anything else I should try to make the test more stable, let me know and I'll try to reduce further.

Comment 7

[Lukas Blakk [:lsblakk] use ?needinfo]

marking esr10 unaffected, same as bug 754242

Comment 8

[Christian Holler (:decoder)]

A testcase for this bug was already added in the original bug (bug 754242).