773746 - GC: Rooting analysis fuzz bugs

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Brian Hackett [Laid off!]]

Tinderbox is more or less green (modulo newly broken things) wrt the dynamic rooting analysis for identifying moving GC rooting hazards (bug 707049), and it would be good to start fuzzing to look for new violations.  Some info:

- The rooting analysis needs special configuration options.  It's best to do things on x64 builds (preferably debug), configure --enable-gczeal --enable-root-analysis.

- The environment variable JS_GC_ZEAL needs to be set to '6' when running.

- Violations will show up as crashes at an address similar to 0xda...... (the analysis works by invalidating pointers on the stack).

- Violations are not security risks, and filed bugs should be public.  This will eventually change, but not for months (and all outstanding bugs will be fixed by then).

Comment 1

[Brian Hackett [Laid off!]]

(In reply to Brian Hackett (:bhackett) from comment #0)
> - The environment variable JS_GC_ZEAL needs to be set to '6' when running.

An alternative here is to call gczeal(6) from script somewhere.

Comment 2

[Steve Fink [:sfink] [:s:]]

(In reply to Brian Hackett (:bhackett) from comment #0)
> - Violations will show up as crashes at an address similar to 0xda......
> (the analysis works by invalidating pointers on the stack).

More specifically, it will be 0x??da???? on 32-bit, or 0x??????????da???? on 64-bit. (The 64-bit addresses won't look that long because they'll probably have 4 leading zeroes.)

Alternatively, you might get an assertion about !IsPoisonedPtr. This means pretty much the same thing, but happens when you attempt to root something that has already been poisoned.